05000369/LER-2013-001
| Mcguire Nuclear Station, Unit 1 | |
| Event date: | 02-21-2013 |
|---|---|
| Report date: | 04-22-2013 |
| 3692013001R00 - NRC Website | |
BACKGROUND
The following information is provided to assist readers in understanding the event described in this LER.
Applicable Energy Industry Identification [EMS] system and component codes are enclosed within brackets.
McGuire Nuclear Station unique system and component identifiers are contained within parentheses.
Reactor Protection System [JC] (IPE):
The Reactor Protection System keeps the Reactor operating within a safe operating range by automatically shutting down the Reactor whenever the limits of the operating range are approached by monitoring process variables. Whenever a direct or calculated process variable exceeds a setpoint the Reactor is automatically tripped to protect against fuel cladding damage or loss of Reactor Coolant System (NC) integrity. Station operators may elect to manually actuate the reactor trip switchgear (manual reactor trip) using either of two control board switches.
Condensate [KA] (CM):
The Condensate System (CM) takes condensate from the hotwell, purifies it to meet water chemistry specifications, heats it to improve the thermal cycle efficiency, and delivers it to the Feedwater System for makeup to the steam generators.
The CF System takes treated Condensate (CM) System water, heats it further to improve the plant's thermal cycle efficiency, and delivers it at the required flow rate, pressure and temperature to the steam generators. The CF System is designed to maintain proper vessel water levels with respect to reactor power output and turbine steam requirements.
Auxiliary Feedwater System [BA] (CA):
The CA System automatically supplies feedwater to the steam generators to remove decay heat from the NC System upon the loss of normal feedwater supply. The CA System mitigates the consequences of any event with loss of normal feedwater. The design basis of the CA System is to supply water to the S/Gs to remove decay heat and other residual heat by delivering at least the minimum required flow rate to the steam generators.
The CA system is designed to start automatically for any event requiring emergency feedwater.
The CA System will automatically provide feedwater via the Motor Driven Pumps when initiated on any of the following conditions:
1. Loss of both main feedwater pumps 2. AMSAC Actuation 3. Two out of four (2/4) low-low level alarms in any one steam generator 4. Initiation of a safety injection signal 5. Loss of power to the 4160V essential bus (Blackout)
EVENT DESCRIPTION
On February 21, 2013, while in Mode 1, an Operator performing rounds was investigating the cause of an extinguished light bulb indication on the heater drain tank (HDT) panel. In the course of the investigation the operator inadvertently tripped the 1C3 HDT pump.
A single C HDT pump provides approximately 10% of total CF system flow at 100% power. Therefore, when the 1C3 HDT pump was tripped, the rest of the CM system and CF system had to respond to maintain final CF flow.
This forced the hotwell pumps (HWPs) and CBPs to provide more flow, which resulted in lower pressures. The decrease in pressure ultimately caused premature actuation of the CBP suction PSs, as sensed by at least two of three PSs (1CMPS5552, 1CMPS5553 and 1CMPS5554) and operating CBPs (1A and 1B) tripped. The trip of all operating CBPs resulted in a trip signal to both CF pumps, which in turn led to a turbine and reactor trip. The auxiliary feedwater system (CA) automatically started as a result of the CF pumps tripping (Engineered Safety Feature actuation). The 1B Motor-Driven CA pump was not available at the time of the event because it was removed from service to facilitate maintenance. Control power fuses were removed to prevent the 1B Motor- Driven CA pump from automatically starting. The 1B Motor-Driven CA pump could have been restored if it had been needed following the reactor trip.
In addition, the trip of the first Main Feedwater Pump Turbine (CFPT) trip caused a load rejection signal. This load rejection signal resulted in starting the standby HWP (1A), the start/restart of all three CBPs and also caused the Unit 1 Generator Load Rejection Bypass Control Valve (1CM-420) to open.
The relevant sequence of events is as follows (all times approximate, where time is the same the event or action is occurring within fractions of seconds):
09:55:44 1C3 HDT pump tripped 09:56:14 1CM-420 should have begun to modulate open at 100 prig decreasing 09:57:07 1A/1B CBP tripped 09:57:07 Unit 1 CBP Suction Press Emergency Low Alarm Cleared 09:57:07 1B CFPT tripped 09:57:07 Load Rejection Signal Generated 09:57:07 1A CFPT tripped 09:57:07 1A CA Pump Starts 09:57:07 Turbine trip 09:57:07 Reactor trip (Turbine Trip above P-8) 09:57:07 Unit 1 CF Pump Suction Pressure Low Alarm 09:57:07 1A HWP Auto-starts on Load Rejection Signal (All 3 HWPs Running) 09:57:07 1C CBP Auto-starts on Load Rejection Signal 09:57:08 1CM-420 opened on Load Rejection Signal 09:57:21 1B CBP Restarts on Load Rejection Signal 09:57:22 1A CBP Restarts on Load Rejection Signal 09:59:27 Unit 1 TDCA Pump Starts (1SA-49AB Opens)
REPORTABILITY DETERMINATION
The Unit 1 automatic reactor trip and CA pump start were valid actuations and initially reported, as required, under 50.72 (b)(2)(iv)(B), "Any event or condition that results in actuation of the Reactor Protection System (RPS) when the reactor is critical except when the actuation results from and is part of a pre-planned sequence during testing or reactor operation." The event was also initially reported under 10 CFR 50.72 (b) (3) (iv) (A) and this LER will satisfy the corresponding reporting criteria 10 CFR 50.73 (a)(2)(iv)(A), "Any event or condition that resulted in manual or automatic actuation of any of the systems listed in paragraph (a)(2)(iv)(B)." The applicable 10 CFR 50.73 (a)(2)(iv)(B) systems include the Reactor Protection System (RPS) and the Auxiliary Feedwater System (CA).
CAUSAL FACTORS
The transient was initiated due to an inadvertent trip of the HDT pump. The HDT pump was inadvertently tripped by an operator investigating the cause for an indicating light bulb out that is part of the HDT pump start/stop pushbutton switch. Although the HDT panel was procedurally identified as having Transient/Trip potential, procedure guidance did not explicitly prohibit intrusive investigation at or near applicable components and applicable components were not uniquely identified. This developed into a practice whereby operators investigated the cause for the extinguished light bulbs first and consulted the procedure later to determine if the bulb could be replaced.
A "C" HDT pump trip is expected to cause a secondary system pressure transient (perturbation) but typically does not result in a unit reactor trip. The unit 1 reactor trip was ultimately caused by the CBPs tripping on an emergency low suction pressure signal. Investigation determined actual CBP suction pressure did not reach the emergency low trip set point (60 psig) and the CBP suction pressure switches (PS) had actuated prematurely.
Analysis of data indicated significant air voids in the common impulse fine and vertical impulse line shared by all PSs (1CMPS5552, 1CMPS5553 and 1CMPS5554) in instrument loop (1CMLP5550). Significant air voiding was caused by inadequate venting of CBP suction PSs. The CBP suction header pressure switches were vented prior to filling the CM system and starting a HWP; therefore, the only pressure in the instrument fine was due to static head. The static head in the instrument fine provided approximately 5 psig at the pressure switches when they were vented. Venting when the system is fully pressurized improves air removal. It was determined that process tubing configuration contributed to inadequate venting. The tubing from the process tap was vertically routed instrument loop and then routed in a sinusoidal wave pattern to each pressure switch. This resulted in three local high points for potential air entrainment and resulted in the instrument lines being much more susceptible to air remaining in the line (especially when vented at static head pressures versus system pressurized).
Finally, it was determined that sluggish response of the Generator Load Rejection Bypass Control Valve (1CM- 420) contributed to the pressure transient. 1CM-420 is designed to ensure that the CF Pumps have sufficient suction pressure by ensuring that the CBPs have sufficient suction pressure. This is accomplished by bypassing flow from the Hotvvell Pump [HWP] discharge directly to the CBP suction. 1CM-420 did not open as expected on low CBP suction pressure. This valve should have begun to modulate open when CBP suction pressure reached 100 psig decreasing but did not. It was determined that 1CM-420 failure to modulate open in time was due to inadequate tuning of the controller (1CMPR4200) and equipment malfunction associated with the valve positioner (1CMVP4200).
CORRECTIVE ACTIONS
Immediate:
1. Instrument lines and PSs associated with CBP Suction Header instrument loop were replaced, flushed, calibrated and functionally verified.
2. Components of 1CM-420 were replaced, calibrated and functionally verified.
Subsequent:
1. Action was taken to limit operator interactions with light bulbs having transient/trip potential and added unique identification of these components.
2. The slope of the shared impulse line of the unit 1 CBP suction header PSs was corrected.
Planned:
1. Guidance will be developed to ensure CM system is in service prior to venting CBP suction header PSs.
2. The method for testing and verifying 1CM-420 for proper operation (i.e., within the operating pressure band) will be incorporated into applicable operating and surveillance guidance.
3. Operator guidance will be revised to prevent hands-on verification of light bulbs associated with equipment/components having transient/trip potential.
SAFETY ANALYSIS
The risk significance of this reactor trip event due to a loss of Main Feedwater has been evaluated both quantitatively and qualitatively. The quantitative portion of the analysis considers the following:
- A loss of main feedwater initiating event
- Actual plant configuration and maintenance activities at the time of the trip Core Damage Frequency (CDF) is the bounding risk metric because there is nothing inherent in a loss of Main Feedwater that is unique to a large early release.
Qualitatively, there are two dominant core damage accident sequences of importance. The first type involves the loss of Main Feedwater initiator, failure of operators to restart Main Feedwater, failures of the Turbine-Driven Auxiliary Feedwater Pump and the 1A Motor-Driven Auxiliary Feedwater Pump, the 1B Motor-Driven Auxiliary Feedwater Pump is out of service to support maintenance, and a failure of the operators to initiate feed and bleed cooling.
The second sequence type involves the loss of Main Feedwater initiator followed by an Anticipated Transient Without Scram (ATWS), a failure of the Reactor Protection System and a failure of the operators to manually initiate emergency boration for ATWS mitigation. The end state for this sequence is actually stable, but since the reactor is never fully shut down, core damage is conservatively assumed to occur.
This event had a low risk impact due to the redundant mitigating components that were available such as the Turbine-Driven Auxiliary Feedwater Pump and one Motor-Driven Auxiliary Feedwater Pump for feeding the Steam Generators. A favorable moderator temperature coefficient contributed to the low risk impact by making several ATWS sequences less important. Additionally, main feedwater pumps were available following the reactor trip and the 1B motor-driven Auxiliary Feedwater Pump could have been restored if it had been needed.
Therefore, this event is considered to have a low risk impact and no significance with respect to the health and safety of the public.
ADDITIONAL INFORMATION
A search of the McGuire Problem Identification Process (PIP) database was conducted to determine if this event was recurring. The search identified PIP M-11-00389 which documented LER 369-11-02.
feed water (CF) to the Unit 1 Steam Generators. The root cause for the CF pump trip is the use of equipment for a purpose it was not designed. Transferring steam supplies to the 1B CFPT uses a gate valve (1HM-95) which is not designed for throttling. Actions will be taken to discontinue the use of 1HM-95 as a throttle valve and utilize the new CFPT governor steam supply controls for governor modulation.
Based on the information reviewed, this is not considered a recurring event.