05000296/LER-2009-001, Regarding Reactor Scram Due to Loss of Condensate Booster Pumps

Regarding Reactor Scram Due to Loss of Condensate Booster Pumps

ML093010127
Person / Time
Site:	Browns Ferry
Issue date:	10/23/2009
From:	West R Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
LER 09-001-00
Download: ML093010127 (8)

LER-2009-001, Regarding Reactor Scram Due to Loss of Condensate Booster Pumps

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)
2962009001R00 - NRC Website

text

Tennessee Valley Authority, Post Office Box 2000, Decatur, Alabama 35609-2000 October 23, 2009 10 CFR 50.73 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D. C. 20555-0001 Browns Ferry Nuclear Plant Unit 3 Facility Operating License No. DPR-68 NRC Docket No. 50-296

Subject:

Licensee Event Report 50-29612009-001 The enclosed Licensee Event Report (LER) provides details of a manual reactor scram following the loss of condensate booster pumps. TVA is reporting this in accordance with 10 CFR 50.73(a)(2)(iv)(A), as an event that resulted in a manual or automatic actuation of the systems listed in paragraph 10 CFR 50.73(a)(2)(iv)(B) (i.e, Reactor Protection System including reactor scram or trip).

There are no new regulatory commitments contained in this letter. Should you have any questions concerning this submittal, please contact F. R. Godwin, Site Licensing and Industry Affairs Manager, at (256) 729-2636.

espectfully, R. G. West Vice President cc: See page 2

U.S. Nuclear Regulatory Commission Page 2 October 23, 2009 Enclosure cc (Enclosure):

NRC Regional Administrator - Region II NRC Senior Resident Inspector - Browns Ferry Nuclear Plant

NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 3150-0104 EXPIRES 08/31/2010 (9-2007)

, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

3. PAGE Browns Ferry Nuclear Plant Unit 3 05000296 1 of 6

4. TITLE: Reactor Scram Due to Loss of Condensate Booster Pumps

5. EVENT DATE

6. LER NUMBER

7. REPORT DATE

8. OTHER FACILITIES INVOLVED SEQUENTIAL REV MONTH DAY YEAR FACILITY NAME DOCKET NUMBER MONTH DAY YEAR YEAR SUE R

ENO.

None N/A FACILITY NAME DOCKET NUMBER 08 24 2009 2009 001 00 10 xx 2009 None N/A

9. OPERATING MODE

11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR§: (Check all that apply) ol 20.2201(b)

[l 20.2203(a)(3)(i)

El 50.73(a)(2)(i)(C)

[I 50.73(a)(2)(vii)

El 20.2201(d)

[3 20.2203(a)(3)(ii)

El 50.73(a)(2)(ii)(A)

[I 50.73(a)(2)(viii)(A)

El 20.2203(a)(1)

[I 20.2203(a)(4)

El 50.73(a)(2)(ii)(B)

El 50.73(a)(2)(viii)(B)

E] 20.2203(a)(2)(i)

[] 50.36(c)(1)(i)(A)

El 50.73(a)(2)(iii)

El 50.73(a)(2)(ix)(A)

10. POWER LEVEL El 20.2203(a)(2)(ii) 0" 50.36(c)(1)(ii)(A)

[

50.73(a)(2)(iv)(A)

-] 50.73(a)(2)(x)

[] 20.2203(a)(2)(iii)

El 50.36(c)(2)

El 50.73(a)(2)(v)(A)

[1 73.71(a)(4)

El 20.2203(a)(2)(iv)

El 50.46(a)(3)(ii)

El 50.73(a)(2)(v)(B)

[3 73.71(a)(5) 100 El 20.2203(a)(2)(v)

[I 50.73(a)(2)(i)(A)

El 50.73(a)(2)(v)(C)

El OTHER El 20.2203(a)(2)(vi)

El 50.73(a)(2)(i)(B)

El 50.73(a)(2)0v)(D) specfnAbtractb..

InNRC

12. LICENSEE CONTACT FOR THIS LER NAME TELEPHONE NUMBER (Include Area Code)

Deborah Bentzinger, Licensing Engineer 256-729-7533CAUSE SYSTEM COMPONENT MANU-REPORTABLE

CAUSE

SYSTEM COMPONENT MANU-REPORTABLE FACTURER TO EPIX FACTURER TO EPIX E

SF PMC A160 Y

14. SUPPLEMENTAL REPORT EXPECTED

15. EXPECTED MONTH DAY YEAR SUBMISSION El YES (If yes, complete 15. EXPECTED SUBMISSION DATE)

[

NO DATE N/A N/A N/A ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced typewritten lines)

At 1850 Central Standard Time (CST), on August 24, 2009, Unit 3 operators inserted a manual scram due to lowering reactor vessel water level. Prior to the manual scram, Condensate Booster Pump 3A tripped on low suction pressure followed by a trip of Condensate Booster Pump 3B. The Reactor Feedwater Pump Turbine (RFPT) suction header experienced low suction pressure, but feedwater pump 3A did not trip as expected.

Feedwater pump 3B tripped as expected. The condensate flow path through the demineralizers is the only path with sufficient capacity to provide an adequate source of feedwater to the reactor vessel at 100 percent power.

Loss of the flowpath through the condensate demineralizers caused lowering reactor water level which resulted in a control room operator inserting a manual reactor scram. Reactor vessel water level decreased to -47 inches and was recovered by High Pressure Coolant Injection (HPCI) system and Reactor Core Isolation Cooling (RCIC) system initiation. The communication adapter for Condensate Demineralizer Programmable Logic Controller Remote Chassis 10 (which is associated with condensate demineralizervessel 3H) was found with status lights indicating a communications failure had occurred, This failure caused an apparent loss of communication with the remote chassis associated with the other condensate demineralizer vessels. The root cause of this event was determined to be less than adequate functional testing of the condensate demineralizer system valve lock-up devices. TVA is developing a more robust testing methodology and frequency (preventative maintenance work orders) for ensuring the condensate demineralizers effluent lockup devices work properly.

NRC FORM 366 (6-2004)

I. PLANT CONDITION(S)

Prior to the event, Units 1, 2, and 3 were operating in Mode 1 at 100 percent thermal power (approximately 3458 megawatts thermal). Units 1 and 2 were unaffected by the event.

II. DESCRIPTION OF EVENT

A. Event:

Prior to the manual scram on August 24, 2009, Unit 3 was at 100% power within normal operating parameters. All nine (A-J) condensate demineralizers [SF] were in service. All programmable logic controller controlled valves, including the A (inlet), E (effluent), V (vent), U (drain) and Us (slow drain) valves, were mechanically locked in the open position (pinned) for H and J condensate demineralizer vessels due to earlier maintenance activities. The A, E, V and U valves for the remaining seven condensate demineralizer vessels had been un-pinned. The remote communication adapter and the remote chassis associated with the H condensate demineralizer vessel were replaced due to re-occurring failures of the 120 VAC digital output card. No other abnormal conditions existed for Unit 3 related to power operation on this day. Following the maintenance on August 24, 2009, day shift, A through G condensate demineralizer vessels were unpinned (i.e., returned to normal controls) and H and J condensate demineralizer vessels remained pinned in their desired positions.

At approximately six hours after performing maintenance on Programmable Logic Controller Remote Chassis 10 associated with 3H condensate demineralizer, all 10 of the Unit 3 remote communication chassis failed. This condition resulted in de-energizing all of the 120 VAC solenoid valves on each condensate demineralizer vessel. The condensate demineralizer vessel effluent valves (E valves) closed on all condensate demineralizer vessels except for condensate demineralizer vessels 3C, 3F, 3H and 3J. The E valves for condensate demineralizer vessels 3H and 3J had been pinned. The lock-up solenoids for the E valves associated with condensate demineralizers 3C and 3F prevented the closure of their respective E valves when the lock-up solenoid valves engaged. The condensate demineralizer system differential pressure logic actuated to provide an open signal to the bypass valve, but the condensate demineralizer bypass valve did not open due to a failed coil on the open air solenoid valve.

Condensate booster pump 3A tripped on low suction pressure followed by a trip of condensate booster pump 3B, as designed. The Reactor Feedwater Pump Turbine (RFPT) suction header experienced low suction pressure, but feedwater pump 3A did not trip as expected. Feedwater pump 3B tripped as expected. A control room operator inserted a manual reactor scram due to lowering reactor water level. Reactor vessel water level decreased to -47 inches and was recovered by High Pressure Coolant Injection (HPCI) system [BJ] and Reactor Core Isolation Cooling (RCIC) system [BN] initiation. TVA's initial investigation found the communication adapter for Programmable Logic Controller Remote Chassis 10 (which is associated with condensate demineralizer vessel 3H) with status lights indicating a communications failure had occurred, which caused an apparent loss of communication with the remote chassis associated with the other condensate demineralizer vessels.

During the event, all automatic safety system functions resulting from the scram occurred as expected. All control rods inserted. As a result of low reactor vessel water level, the following Primary Containment Isolation System (PCIS) isolations [JM] were received: Group 2 Residual Heat Removal (RHR) System [80] Shutdown Cooling, Group 3 Reactor Water Cleanup (RWCU)

System [CE], Group 6 Ventilation [VA], and Group 8 Traversing Incore Probe (TIP) [IG]; along with

the automatic start of the Control Room Emergency Ventilation (CREV) [VI] System and the three Standby Gas Treatment (SGT) [BH] System trains. In addition, HPCI and RCIC systems automatically initiated as a result of the decrease in reactor vessel water level.

TVA is submitting this report in accordance with 10 CFR 50.73(a)(2)(iv)(A). An event that resulted in a manual or automatic actuation of the systems listed in paragraph 10 CFR 50.73(a)(2)(iv)(B)

(i.e., reactor protection system including reactor scram or trip).

B. Inoperable Structures, Components, or Systems that Contributed to the Event:

None.

C. Dates and Anoroximate Times of Maior Occurrences:

August 24, 2009 1848:15 hours CST Condensate Demineralizer Remote Communication Chassis Failure Condensate Booster Pump 3A trip on low suction pressure August 24, 2009 1848:49 hours CST August 24, 2009 1849:12 hours CST Condensate Booster Pump 3B trip on low suction pressure August 24, 2009 1849:19 hours CST Feedwater Pump 3B trip on low suction pressure August 24, 2009 1849:22 hours CST Manual Reactor Scram on Unit 3 August 24, 2009 2338 hours0.0271 days <br />0.649 hours <br />0.00387 weeks <br />8.89609e-4 months <br /> CST TVA made a four hour non-emergency report per 10 CFR 50.72(b)(2)(iv)(B) and an eight hour non-emergency report per 10 CFR 50.72(b)(3)(iv)(A).

D. Other Systems or Secondary Functions Affected

None.

E. Method of Discovery

Operations received Condensate Booster Pumps 3A and 3B trip alarms along with reactor water level lowering.

F. Operator Actions

Manual scram initiated due to lowering reactor vessel water level.

G Safety System Responses During the event, all automatic functions resulting from the scram occurred as expected except for the feedwater pump 3A failure to trip. All control rods inserted. As a result of low reactor vessel water level, the following PCIS isolations [JM] were received: Group 2 RHR System [BO] Shutdown Cooling, Group 3 RWCU [CE], Group 6 Ventilation [VA], and Group 8 TIP [IG]; along with the automatic start of the CREV [VI] System and the three SGT [BH] System trains. Reactor vessel water level lowered to -47 inches. Reactor vessel water level was recovered by HPCI and RCIC system automatic initiation and operation and subsequently, maintained by the feedwater system.

All control rods inserted and reactor pressure was controlled by the main turbine bypass valves, and no Main Steam Relief Valves (MSRVs) were opened as a result of the transient.

All plant systems responded to the event as expected except for the condensate demineralizer bypass valve failure to open, feedwater pump 3A failure to trip on an apparent low suction pressure, and reactor core isolation cooling (RCIC) flow fluctuations.

Ill. CAUSE OF THE EVENT A. Immediate Cause The immediate cause of the event was the failure of all ten of the Unit 3 condensate demineralizer remote communication chassis.

B. Root Cause The root cause was determined to be the less than adequate functional testing of the condensate demineralizer system valve lock-up devices.

C. Contributing Factors None.

IV. ANALYSIS OF THE EVENT

The condensate demineralizer filter system is designed to remove impurities from the condensate system to maintain high quality water to supply the reactor. The condensate demineralizer system is controlled by a dual Allen Bradley 5 programmable logic controller (PLC) system with 10 remote communication chassis, one to control each of the nine condensate demineralizer vessels and one system control chassis. The dual PLC arrangement allows a fully redundant control system for the condensate demineralizer with two communication loops. Chassis-to-chassis communications are on one communication loop. The second communication loop provides communication access for the Human Machine Interface (HMI) stations. The condensate demineralizer control system provides automatic control for the Vessel Backwashing and Precoat sequences to maintain optimum filter/resin performance inside each condensate demineralizer vessel.

There are two subcomponents of the lockup system, the lockup solenoid A and lockout solenoid B.

Solenoid A is a normally energized solenoid that will de-energize on loss of communication to PLC remote I/O chassis or loss of power. De-energizing solenoid A will remove the control pilot air from the snap acting relay pilot by blocking system air and venting the pilot air, allowing the snap relay to actuate. Lockout solenoid B is a normally energized solenoid that will de-energize on loss of communication to its PLC remote I/O chassis or on a loss of system power. De-energizing solenoid B will remove the control air from the valve positioner by blocking control air from the flow modifier and venting control air from the positioner.

The condensate flow path through the demineralizers is the only path with sufficient capacity to provide an adequate source of feedwater to the reactor vessel at 100 percent power. The condensate demineralizer bypass valve capacity of 30 percent may have been adequate to supplement the four condensate demineralizer vessels that did not isolate during this event. However, the condensate demineralizer bypass valve failed to open due to a failed coil on the open air solenoid valve. Thus, there was no other equipment which could have provided sufficient feedwater during this event.

All of the Unit 3 remote communication chassis failed, which resulted in de-energizing all the 120 VAC solenoid valves on each condensate demineralizer vessel. The condensate demineralizer vessel effluent valves (E valves) closed on all condensate demineralizer vessels except for condensate

demineralizer vessels C, F, H and J. The E valves for condensate demineralizer vessels H and J had been pinned. The lockup solenoids for the E valves associated with condensate demineralizer vessels C and F prevented the closure of their respective E valves when the lock-up solenoid valves engaged.

Condensate booster pump 3A tripped on low suction pressure followed by condensate booster pump 3B. The 3A feed pump did not trip on low suction pressure as would be expected. The feed pump suction header pressure (as indicated on the integrated computer system) dropped to less than the 150 psig trip setpoint but the 3A feed pump did not trip. The 3B feed pump tripped. A control room operator inserted a manual reactor scram. Reactor water level decreased to -47 inches and was recovered by HPCI and RCIC initiation.

The 3A feed pump is designed to trip after a 20-second time delay, the 3B feed pump after a 40-second time delay and the 3C feed pump after a 60-second time delay. Each feed pump has its own low suction pressure switch. TVA verified proper calibration of the low suction trip pressure switch for the 3A feed pump. High pressure steam was isolated to the 3A feed pump prior to and during this event. As a result, the 3A feed pump speed actually decreased during the analyzed event, while the 3B and 3C feed pump speeds increased. Based on the suction header design, it appears that this reduction in speed (and thus flow) on the 3A feed pump resulted in the 3A feed pump having a slightly higher suction pressure than the low suction pressure trip set-point. A work order was performed to confirm pressure switch instrument calibration.

The RCIC system flow oscillations did not impact the ability of RCIC to provide injection flow to the vessel for the short duration that it was required. The cause of these flow oscillations is still being investigated. The RCIC system governor was replaced during a subsequent outage.

ECCS equipment response following the reactor scram was in accordance with plant design for loss of feedwater. The short term lowering of the reactor vessel water level was recovered by automatic HPCI and RCIC initiation and operation. Following the initial transient, reactor vessel water level was controlled by the feedwater system. The operation of other systems post scram (e.g., containment isolation, startup of the SGT and CREV systems, isolation of normal reactor building ventilation, Reactor Water Cleanup (RWCU) isolation operated as expected. The main condenser continued to function as the heat sink following the reactor scram.

V. ASSESSMENT OF SAFETY CONSEQUENCES

The safety consequences of this event were not significant. This transient is bounded by the analysis present in the UFSAR. When the reactor vessel water level reached the Level 2 setpoint, RCIC and HPCI initiated, returning reactor vessel water level to normal level. In addition, the feedwater system was used to maintain reactor vessel water level and the main condenser continued to serve as the heat sink.

PCIS groups 2, 3, 6, and 8 isolations were as expected. No main steam relief valves actuated. The turbine bypass valves [JI] maintained reactor pressure. The main condenser remained available for heat rejection. Reactor water level was recovered by RCIC and HPCI and maintained by reactor feedwater [SJ] and condensate [SG] systems.

All plant systems responded to the event as expected except for the condensate demineralizer bypass valve failure to open, feedwater pump 3A failure to trip on an apparent low suction pressure, and reactor core isolation cooling (RCIC) flow fluctuations. All personnel actions were according to established procedural guidance. TVA concludes that the health and safety of the public was not impacted by this event.

VI. CORRECTIVE ACTIONS

A.

Immediate Corrective Actions

Immediate corrective actions included pinning in place the A, E, U, Us and V valves associated with all nine Unit 3 Condensate Demineralizer vessels using 3-OI-2A, Condensate Demineralizer System, Revision 43. The OPEN solenoid on 3 -FCV-2-130 (demineralizer bypass valve) was replaced and the bypass valve was made functional. The A, E, U, Us and V valves associated with all 10 Condensate Demineralizers for Units 1 and 2 were also pinned in place.

B.

Corrective Actions to Prevent Recurrence - The corrective actions are being managed by BFNs Corrective Action Program.

The corrective actions to prevent recurrence include developing a more robust testing methodology and frequency (preventative maintenance work orders) for ensuring the condensate demineralizers effluent lockup devices work properly and ensure the work orders are completed on all three units.

VII.

ADDITIONAL INFORMATION

A.

Failed Components The failed component was the communication adapter for Condensate Demineralizer Programmable Logic Controller Remote Chassis 10 (which is associated with condensate demineralizer vessel 3H). It was found with status lights indicating a communications failure had occurred, which caused an apparent loss of communication with the remote chassis associated with the other condensate demineralizer vessels.

B.

Previous LERs on Similar Events None.

C.

Additional Information

Corrective action document PER 200203.

D.

Safety System Functional Failure Consideration:

This event is not a safety system functional failure in accordance with NEI 99-02.

E.

Scram with Complications Consideration:

This event was not a complicated scram according to NEI 99-02.

VIII.

COMMITMENTS

None.