05000390/LER-2010-001
| Telephone Number (Indude Area Code) | |
| Event date: | 05-21-2010 |
|---|---|
| Report date: | 07-20-2010 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv), System Actuation |
| 3902010001R00 - NRC Website | |
A. Event
On May 21, 2010 at 1936 EDT hours with Watts Bar Nuclear Plant (WBN), Unit 1 at 100% rated thermal power the reactor tripped automatically in response to a turbine trip signal generated by closure of the Main Turbine Throttle/Stop Valves [E1151 Code TA]. According to the Sequence of Events record from the Integrated Computer System (ICS) [EllS Code ID], the Solid State Protection System (SSPS) [EllS Code JC] generated an alarm at 19:36:47 indicating that Main Turbine Throttle/Stop Valves 1 and 3 had closed. Two seconds later at 19:36:49 the SSPS generated a second alarm indicating that Main Turbine Throttle/Stop Valves 2 and 4 had closed. With the reactor operating above interlock setpoint P9 and all Main Turbine Throttle/Stop Valves closed, a Reactor Trip signal was generated by the SSPS. Immediately following reactor trip, the Steam Dump Control System [EllS Code J] automatically opened the condenser bypass valves [El IS Code SB] to remove stored energy and residual heat from the Reactor Coolant System (RCS) [El IS Code AB]. During plant cooldown to no-load equilibrium conditions, a main feedwater isolation signal was generated by the SSPS due to Reactor Trip coincident with low RCS TAVG. The purpose of this signal is to prevent a potential RCS overcooling transient following a turbine trip. The closure of the main feedwater isolation valves [EllS Code SJ] generated a Main Feed Pump Turbine (MFPT) [EllS Code JK] trip signal which then resulted in the automatic startup of the Auxiliary Feedwater (AFW) System [EllS Code BA]. All systems performed their required safety functions in response to this event.
This event was documented in TVA's Corrective Action Program as Problem Evaluation Report (PER) 231080.
B. Inoperable Structures, Components, or Systems that Contributed to the Event.
The most probable cause was determined to be an intermittent failure of a circuit card in the Westinghouse Mark IV Analog Electro-Hydraulic (AEH) turbine control system [El IS Code IT] that caused the servo control valves for all four Main Turbine Throttle/Stop Valves to close their respective valves.
C. Dates and Approximate Times of Major Occurrences Date� Time� Event (EDT) May 21, 2010 �19:36:47�SSPS Alarm - Main Turbine Throttle/Stop Valves 1 & 3 closed May 21, 2010 �19:36:49�SSPS Alarm - Main Turbine Throttle/Stop Valves 2 & 4 closed May 21, 2010 �19:36:49�SSPS Alarm - Reactor Trip From Turbine Trip Above P9 May 21, 2010 �19:37:07�SSPS Alarm - Main Feedwater Isolation May 21, 2010 �19:37:07�AFW Auto Start
D. Other Systems or Secondary Functions Affected
Discharge Valve 1-PCV-3-132 located downstream of Motor Driven Pump (MDP) 1B-B in the AFW system failed to open following pump start-up. The PCV is a safety-grade air-operated valve designed to create sufficient backpressure to prevent pump run-out whenever Steam Generator (SG) pressure is low (i.e., during plant cooldown or in the event of a faulted SG). PER 231297 and Work Order 08-812356-01 were issued to investigate this problem. The most likely cause was determined to be an intermittent failure of the I/P converter in the control circuit for this valve. Corrective action was to replace and calibrate the new I/P converter (1-PM-3-0132) associated with 1-PCV-3-132. The I/P converter is designed to throttle the PCV closed until the pump differential pressure corresponds to an acceptable operating point on the pump curve.
E. Method of Discovery
Self-revealing. The reactor tripped automatically in response to a turbine trip signal generated by closure of the Main Turbine Throttle/Stop Valves.
F. Operator Actions
Following Reactor/Turbine trip, the operators entered the following procedures to stabilize the plant at Hot Standby Conditions:
E-0 - Reactor Trip or Safety Injection ES 0.1 - Reactor Trip Response GO-5 - Unit Shutdown from 30% Power to Hot Standby A01-17 - Turbine Trip
G. Safety System Responses
The Reactor Protection System actuated a reactor trip in response to a turbine trip signal generated by closure of the Main Turbine Throttle/Stop Valves. Main Feedwater Isolation was initiated in response to a Reactor Trip coincident with low Reactor Coolant System TAVG. The AFW System automatically started on trip of all MFPTs due to Main Feedwater isolation. No safety injection signals were initiated. All safety systems responded as required, although failure of the discharge valve for the 1B-B AFW pump reduced margin.
III. CAUSE OF EVENT
The most probable cause was determined to be an intermittent failure of a circuit card in the Westinghouse Mark IV Analog Electro-Hydraulic (AEH) turbine control system that caused the servo control valves for all four Main Turbine Throttle Valves to close their respective valves. This conclusion is based on a thorough Root Cause investigation and a series of tests (i.e., Kepner-Tregoe Analysis).
Manual and automatic turbine trips were considered and discarded as a potential cause because there was no evidence in the sequence of event recordings or the operator logs/interviews that either had occurred.
Examination of the Sequence of Events logs identified that Throttle valves 2 and 4 closed two seconds after Throttle valves 1 and 3, which is atypical. A normal trip results in the four Throttle valves all closing within a fraction of a second of each other. This indicated that this was not a normal Turbine Trip; but that the servo control valves (also called "Moog" valves) could have been inadvertently commanded by the turbine control system, a Westinghouse Mark IV Analog Electro-Hydraulic (AEH) system, to close the Throttle valves.
Turbine test trips confirmed that a Manual or Automatic Turbine Trip did not exhibit the two second time difference. Therefore, a malfunction of the AEH main turbine control system was considered. The test trips did not identify any failed components, which led to the conclusion that the malfunction was intermittent in nature.
External factors that could cause intermittent malfunction, such as welding by Unit 2 construction and solar activity, were evaluated, and were determined not to be likely causes.
Based on its evaluation, WA concluded that the most probable cause was that one of the circuit cards involved in the generation of the signal to the Throttle valve "Moog" valves experienced an intermittent failure. Those circuit cards are the Up/Down Counters, Input Expanders, HTL Gates, Mixing Amplifiers, and Analog Switches. The corrective action for that most probable cause was to replace each of those cards that were in the signal path that was in use at the time of the trip.
Consistent operation during post-maintenance testing supports the identified cause.
IV. ANALYSIS OF THE EVENT
The reactor protection system functioned properly in response to closure of the Main Turbine Throttle/Stop Valves. The reactor trip system initiated a turbine trip signal in response to the reactor trip, as designed. The steam dump and the pressurizer control systems functioned properly thereby minimizing RCS and SG [El IS Code SB] temperature and pressure transients. No pressurizer [El IS Code AB] or SG Power Operated Relief Valves (PORVs) or Safety Valves lifted during the transient. Main Feedwater isolation occurred as designed following plant cool down to prevent a potential RCS overcooling transient. The anticipatory AFW system auto-start on trip of all MFPTs following main feedwater isolation functioned as designed.
V. ASSESSMENT OF SAFETY CONSEQUENCES
The safety significance of this event (Reactor/Turbine Trip) is low because there was no loss of safety function.
This event is categorized in the WBN Updated Final Safety Analysis Report (UFSAR) Chapter 15 Accident Analyses as a Condition II event, a fault of moderate frequency. The event is specifically discussed in UFSAR subsection 15.2.7, Loss of External Electrical Load and/or Turbine Trip, which also encompasses loss of main feedwater flow with subsequent startup of the AFW System.
Although 1B-B AFW pump discharge valve, 1-PCV-3-132, failed to open during this event, the minimum AFW flow requirement of greater than 410 gpm specified in Emergency Operating Instruction, E-0, Reactor Trip or Safety Injection was satisfied. This flow requirement was initially provided by the 1A-A motor driven pump and the available turbine driven pump.
VI. CORRECTIVE ACTIONS
This event was documented within TVA's Corrective Action Program as PER 231080.
The existing AEH circuit cards that were in the signal path that was in use at the time of the trip were replaced and post-maintenance testing was performed to confirm functionality of the electro-hydraulic control system.
WBN maintained the plant below P-9 for an extended period (48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />) to provide bum-in time for the new cards to preclude a similar trip due to infant mortality of the new cards.
Failure of the AFW Pump 1B-B discharge valve was documented within TVA's Corrective Action Program as PER 231297. Based on the apparent cause identified in that PER, TVA installed a new UP converter for 1-PCV-3-132.
A. Failed Components
1. Logic card(s) located within Westinghouse Mark IV AEH control system 2. UP converter (1-PM-3-0132) associated with 1B-B AFW Pump Discharge Valve 1-PCV-3-132.
B. Previous Similar Events
A search of LERs and PERs documenting turbine trips at Watts Bar Unit 1 found no previous failures similar to that which occurred on 5/21/10. Although some circuit card failures within the Analog Electro-Hydraulic (AEH) control system were found, they were not similar in nature nor did they have the same effect on plant operations.
C. Additional Information:
None.
D. Safety System Functional Failure This event did not involve a safety system functional failure as defined in NEI 99-02, Revision 5.
E. Loss of Normal Heat Removal Consideration Main Feedwater isolation following reactor/turbine trip is a design feature used to preclude potential RCS overcooling transients. Loss of normal heat removal during this event was expected and was properly mitigated by the automatic startup of the AFW System including operator actions to stabilize the plant at Hot Standby Conditions.
VIII.COMMITMENTS None.