05000285/LER-2010-006
| Fort Calhoun Station | |
| Event date: | 12-23-2010 |
|---|---|
| Report date: | 4-29-2011 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| 2852010006R01 - NRC Website | |
BACKGROUND
The Fort Calhoun Station (FCS) turbine is an 1800 rpm, tandem-compound, non-reheat unit with one high pressure and two double-flow low-pressure turbines. Saturated steam is supplied to the turbine throttle from the steam generators through four stop valves (SV), numbered 1-4, and four control valves (CV), numbered 1-4. Steam flows through the high-pressure turbine and then through four moisture separators in parallel to two double-flow, low-pressure turbines, each of which exhausts to the condenser.
One of the turbine trips is moisture separator high water level. A moisture separator high water level trip protects the turbine from water induction damage due to a failure of the moisture separator level control system. Each moisture separator has a high water level trip. Actuation of any of the moisture separator high water level trip switches for longer than approximately 10 seconds will cause a turbine trip and subsequent reactor loss of load trip. A loss of load reactor trip results from a turbine-generator trip at power levels greater than 15 percent.
The turbine-generator unit is controlled from the operator's panel in the control room. The turbine generator control system is composed of solid state devices and servo-amplifiers which generate current, voltage and pulse-type signals.
EVENT DESCRIPTION
On December 23, 2010, at 1050 Central Standard Time (CST), a turbine trip and subsequent reactor trip occurred while operating at a nominal 100 percent power. Immediate response by operations personnel included implementing procedure EOP-00, "Standard Post Trip Actions," and subsequent entry into procedure EOP-01, "Reactor Trip Recovery." Based on plant system response, the trip was uncomplicated.
The station's sequence of events recorder captured the immediate cause of the turbine trip as resulting from an apparent moisture separator high water level trip signal. Within minutes of the trip, a secondary side system engineer performed walkdowns of the moisture separator drain tanks and feedwater heater system and all associated high level dump valves and verified normal post trip conditions. Based on this walkdown and discussion with operations personnel concerning pre-trip conditions, it was concluded by the system engineer that the moisture separator high water level trip signal was erroneous and not the result of an actual moisture separator high water level trip condition.
CONCLUSION
It appears that the direct cause for an erroneous actuation of the moisture separator trip signal is due to on-going work near the vicinity of the moisture separator level switches. Personnel involved in scaffold construction work had been observed working near moisture separator level sensing lines prior to and immediately after the turbine trip. Movement or inadvertent bumping of the sensing lines has been shown to result in momentary actuation of the moisture separator level switches and was suspected to be the initiating cause for generating the erroneous trip signal. Additionally, coincidental sticking of the inadvertently actuated switch in the trip condition for longer than 10 seconds resulted in the turbine trip signal.
The design of the moisture separator level switch trip circuit includes provisions for inadvertent actuation due to incidental contact. The turbine trip signal is generated only after any one of the four level switches i actuated for approximately 10 seconds. This feature has been in place since initial plant construction and was intended to prevent turbine trip signals due to erroneous jarring, bumping or momentary displacements. The time delay relay associated with the moisture separator high level trip circuit was functioning properly and a false movement of the float or its associated activation sleeve was not likely to have occurred. The evidence supports a conclusion that the most probable cause is due to switch misalignment from its desired vertical orientation. When misaligned from vertical, the increased horizontal alignment of the mercury tube, plus agitation of the mercury contents, are likely to be sufficient to allow the mercury to complete the trip circuit contacts and remain in place long enough to allow the time delay relay to initiate the turbine trip signal.
Through a review of previous maintenance and calibration procedures, mercury switch alignment or other functional aspects of the mercury switch were not checked to ensure that switch reset occurs as desired.
Over time, misalignments in the float chamber and switch mechanism have occurred and gone unnoticed due to the lack of adequate monitoring of these functional aspects of switch operation.
The root cause was insufficient performance monitoring of the moisture separator high level trip mercury switches which resulted in degraded performance and increased risk for susceptibility to binding.
CORRECTIVE ACTIONS
Following the initial determination of the erroneous moisture separator high level trip signal, immediate actions included: halting all work near the moisture separator level sensing lines and level switches, posting the affected areas as "Protected Equipment," and initiating a stop work action for all ongoing scaffold work within the turbine building. In addition, supplementary controls on scaffold erection near instruments that have a vulnerability to a single point failure were strengthened.
Moisture separator high level trip switches will be replaced during the 2011 refueling outage. (Regulatory Commitment) Engineering change (EC) 32387, replaces the moisture separator level switches currently in use with radar guided wave probes. The new probes will incorporate 'two out of three' trip logic for each moisture separator. This action will eliminate the use of mercury switches and result in no need to change existing procedures that implement performance monitoring of the switches. This change also eliminates the ability for incidental contact to trigger an erroneous trip signal.
To address the generic issues, the station is reviewing sensitive single point vulnerable components and evaluating whether or not current maintenance or testing practices and protective strategies are adequate to ensure continued reliable operation.
SAFETY SIGNIFICANCE
Loss of Load is an analyzed plant transient, and plant response was within the predicted response parameters. All trippable control rods were inserted into the reactor core as required. Decay heat removal by the normal main steam and feedwater systems was used for this transient, as required by plant procedures. The other emergency decay heat removal systems were available during the transient.
While this event resulted in an actuation of the Reactor Protective System due to the Loss of Load from the turbine generator, it did not pose a threat to the health and safety of the public.
SAFETY SYSTEM FUNCTIONAL FAILURE
This event does not result in a safety system functional failure in accordance with NEI-99-02.
PREVIOUS SIMILAR EVENTS
FCS has not had any previous similar reactor trips due to failures of scaffold controls.