05000275/LER-2002-001
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 2752002001R00 - NRC Website | |
I. Plant Conditions
Units 1 and 2 have operated in various modes and at various power levels with nonconservative steam generator (SG) low-low level reactor protection setpoints.
II. Description of Problem
A. B Background The Diablo Canyon Power Plant (DCPP) steam generators (SGs) incorporate a mid-deck plate at the top of the primary separator assembly.
The mid-deck plate is located between the upper and lower instrumentation sensing taps used for SG narrow range (NR) water level measurements (see Figure 1). When some of the steam in the SG flows through the separator downcomer instead of the separator orifice, this steam with some entrained mcisture flows upwards through the flow area in the mid-deck plate. This steam flow through the mid-deck plate results in a measurable pressure drop at higher steam flows. This pressure drop adversely affects SG level uncertainty calculations as a bias and was not included in the process measurement accuracy (PMA) term for reactor trip or engineered safeguards actuation system (ESFAS) setpoints.
The three SG NR level channels per SG are part of the reactor protection system (RPS). Two out of three SG channels are required to trip the reactor and start the auxiliary feedwater pumps in the event of a steam or feed line break at power. The mid-deck plate differential pressure (dP) adversely affects the SG NR instrumentation by biasing the output high at high steam flow conditions, effectively delaying the point at which the low- low level measurement is reduced below the actuation setpoint. The SG NR high level trip setpoint is made more conservative by this mid-deck plate bias and does not create a significant possibility of inadvertent actuation during previously evaluated operational transients.
DCPP revised the SG NR low-low level trip setpoint in accordance with License Amendment 34 for Unit 1 and 33 for Unit 2 dated March 27, 1989.
The Nuclear Steam Supply System (NSSS) vendor, Westinghouse, provided the analysis to reduce the low-low trip setpoint in WCAP-11784, "Calculation of Steam Generator Level Low and Low-Low Trip Setpoints With Use of a Rosemount 1154 Transmitter." The setpoint was reduced from 15 to 7.2 percent NR on May 10, 1989, for Unit 1 and on April 12, 1989, for Unit 2. The mid-deck plate dP was not factored into the setpoint at this time.
Technical Specification (TS) 3.3.1, "Reactor Trip System (RTS) Instrumentation," Table 3.3-1, Function 14.a, requires three NR level LICENSEE EVENT REPORT (LER) TEXT CONTINUATION LER NUMBER (6) 5 7 5 2002 0 0 1 0 0 0 FACILITY NAME (1) Diablo Canyon Unit 1 0 DOCKET NUMBER (2) 0 2 channels per SG with a nominal trip setpoint of 7.2 percent. TS 3.3.2, "Engineered Safety Features Actuation System (ESFAS) Instrumentation," Table 3.3. 2-1, Function 6.d, requires three NR level channels per SG with a nominal trip setpoint of 7.2 percent. TS 3.0, "Limiting Condition for Operation (LCO) Applicability," LCO 3.0.3 states, in part, "When an LCO is not met and the associated ACTIONS are not met, ..., the unit shall be placed in a MODE or other specified condition in which the LCO is not applicable.
B. � Event Description On April 12, 1989, with Unit 2 at 100 percent power PG&E changed SG NR low-low level trip setpoint from 15 percent to 7.2 percent.
May 10, 1989, with Unit 1 at 100 percent power, PG&E changed SG NR low-low level trip setpoint from 15 percent to 7.2 percent.
On February 9, 2002, at 0336 PST, solenoid valve SV-540B [SJ][CSV] failed resulting in plant operators initiating a manual reactor trip at submitted in PG&E letter DCL-02-037, dated April 10, 2002.
On February 9, 2002, at 2130 PST, the Plant Staff Review Committee (PSRC) approved the Unit 2 restart with an identified anomaly in that they believed the SG wide range (WR) level indications did not behave as predicted. The WR level indication dropped below 20 percent prior to the first SG NR reactor trip initiate indication activating. The difference between the WR and the NR level channel indicators was identified to be larger than previously observed during operator simulator training.
The PSRC concluded the NR reactor trip channels and WR indication were acceptable for continued operation, based on the following considerations:
(1) There was consistent indication in the three NR level protection channels.
(2) One (of three) SG NR reactor trip initiate bistables activated, which indicated that one of the other two would soon have tripped the reactor, had it not been manually tripped.
(3) The safety function of the WR level channels is to provide indication after a reactor-trip condition for post accident assessment.
(4) The WR channel is calibrated for steady-state (cold) conditions and may not respond accurately during a significant transient.
(5) The WR and NR channels returned to normal indication following the
OF
FACILITY NAME (1) LICENSEE EVENT REPORT (LER) TEXT CONTINUATION DOCKET NUMBER (2) � LER NUMBER (6) 0 0 transient.
Diablo Canyon Unit 1 0 5 0 0 0 2 7 5 2002 1 0 0 4 The PSRC directed that the level indication anomaly be investigated in accordance with Inter-Departmental Administrative Procedure 0M7.1D5, "Issues Needing Validation to Determine Impact on Operability," to resolve the SG 2-4 level indication differences recorded during the transient.
On February 10, 2002, Unit 2 entered Mode 1, following replacement of the failed solenoid valve.
On February 12, 2002, utility plant engineers provided the February 9, 2002, Unit 2 transient response data to the NSSS vendor, Westinghouse, for review and analysis of the SG level indication data in an effort to determine the cause of the discrepancy between the SG NR and WR indication.
On February 14, 2002, utility plant engineers conducted a teleconference with Westinghouse licensing, analysis, and process engineering personnel to review the evaluation of the SG level instrumentation responses.
Westinghouse engineering staff informed PG&E that the observed level difference was due to a mid-deck-plate differential pressure that occurs during high steam flow conditions.
On February 14, 2002, at 1620 PST, following discussions with Westinghouse, with Units 1 and 2 in Mode 1 (Power Operation) at 100 percent power, the SG NR low-low level reactor protection channel setpoints were determined to be nonconservative and, therefore, inoperable. Plant operators entered LCO 3.0.3 shutdown requirements and began a required plant shutdown.
On February 14, 2002, at 1730 PST a 4-hour non-emergency report was made in accordance with 10 CFR 50.72(b)(2)(i) and 50.72(b)(3)(v)(A).
On February 14, 2002, at 2045 PST, following utility engineering review of the vendor information supporting the mid-deck plant differential pressure errors, PG&E and Westinghouse determined that the error was within the allowable channel accuracy at reactor powers less than 60 percent. Plant operators verified that Unit 2 power was below 60 percent power, and declared the SG NR level instrumentation operable and exited the LCO 3.0.3 required action.
power was below 60 percent, declared the SG NR level instrumentation operable, and exited LCO 3.0.3 required action.
LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) OF 2002 Diablo Canyon Unit 1 2 0 5 0 10 5 0 1 0 5 7 0 0 0 0 On February 15, 2002, following review of vendor data and incorporation of appropriate conservatisms, PG&E issued and implemented a design change increasing the SG NR low-low level setpoint from 7.2 to 15 percent.
On February 15, 2002, at 1332 PST, following implementation of the SG NR low-low setpoint of 15 percent, Unit 2 began increasing power to return to normal plant operation.
On February 15, 2002, at 1522 PST, following implementation of the SG NR low-low setpoint of 15 percent, Unit 1 began increasing power to return to normal plant operation.
C. Inoperable Structures, Systems, or Components that Contributed to the Event The SG NR low-low level RPS setpoint was determined to be nonconservative for operation at power levels greater than 60 percent.
D. Other Systems or Secondary Functions Affected
The mid-deck plate dP adversely affects the SG NR instrumentation by biasing the output high at high steam flow conditions, effectively delaying the reactor trip and start of auxiliary feedwater pumps. The SG level input to the ATWS Mitigation System Actuation Circuitry (AMSAC) would also cause a delay in actuation of AMSAC.
E. Method of Discovery
The event was identified during a PSRC assigned investigative action identified following the Unit 2 manual reactor trip due to loss of feedwater to a SG on February 9, 2002, as documented in LER 2-2002-002.
F � Operator Actions Operators reduced reactor power in accordance with LCO 3.0.3 to less than 60 percent following identification of the nonconservative SG level indication condition.
G. � Safety System Responses None.
LICENSEE EVENT REPORT (LER) TEXT CONTINUATION OF 2002 Diablo Canyon Unit 1 0 1 0 2 0 0 5 0 6 0 0 5 7 0 III. � Cause of the Problem
A. Immediate Cause
The immediate cause of the nonconservative SG level instrumentation was the identification of a previously unaccounted PMA term for the dP across the SG mid-deck-plate.
B. Root Cause
The cause of this event was that Westinghouse failed to identify to PG&E the mid-deck plate differential pressure effect on reactor trip and ESFAS setpoints.
IV. � Assessment of Safety Consequences Westinghouse Model 51 SGs incorporate a mid-deck plate at the top of the primary separator assembly. Part of the steam flows through the separator downcomer instead of the separator orifice; this steam, with some entrained moisture, will eventually flow upwards through the flow area in the mid-deck plate. At higher steam flows this results in a measurable pressure drop. The pressure drop for DCPP SGs is 0.25 psi, or approximately 6 percent NR level, at full power steam flow. This previously unaccounted for PMA bias affects the SG NR level channel for the loss of normal feedwater Final Safety Analysis Report (FSAR) Update transient.
The SG NR water level low-low trip is actuated on coincidence of two-of-three low-low level signals in any SG. The FSAR Update analysis credits the SG NR low-low setpoint to trip the reactor and start the two motor driven and one steam driven auxiliary feedwater (AFW) pumps. The analysis shows that following a loss of normal feedwater, the AFW system is capable of removing the stored and residual heat, preventing either overpressurization or loss of water from the reactor coolant system (RCS), provided that the reactor is tripped. With the nonconservative setpoint in use, the SG low-low level protection actuation was delayed by approximately 30 seconds as recorded during the February 9, 2002, event (See LER 2-2002-002). The delay in initiating the required trip caused the affected SG mass to decrease below the expected level.
RCS temperature and pressurizer pressure channels provide additional reactor protection to ensure a reactor trip prior to any damage to the core or the RCS.
For the loss of normal feedwater with loss of off-site power event, RCS residual heat would cause thermal expansion after the trip and could subsequently discharge RCS liquid through the pressurizer relief valves. Additionally, each SG LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) OF 2002 Diablo Canyon Unit 1 0 5 0 5 7 2 0 0 was previously analyzed for one design basis occurrence of complete dryout therefore assuring component integrity.
Loss of Normal Feedwater A reactor trip due to a loss of normal feedwater is a previously analyzed Condition II event described in the FSAR Update, Section 15.2.8, "Loss of Normal Feedwater." A loss of normal feedwater (from pump failures, valve malfunctions, or loss of offsite AC power) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core. If an alternative supply of feedwater were not supplied to the plant, residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer would occur. Significant loss of water from the RCS could conceivably lead to core damage. If the plant is tripped before the SG heat transfer capability is reduced, the primary system variables never approach a departure from nucleate boiling (DNB) condition. The FSAR Update analysis shows that following a loss of normal feedwater, an AFW supply of a total of 410 gpm to two SGs is capable of removing the stored and residual heat thus preventing either overpressurization or loss of water from the RCS.
Major Secondary System Pipe Ruptures It has been determined that for a SG affected by a feedwater line break, steam flow through the feed ring out of the steam generator nozzle and eventually out the break, resulting in a reversal in sign of the mid-deck plate differential pressure effect (from: indicated higher than actual, to indicated lower than actual and therefore conservative) and is not relevant for this event.
A spectrum of steam line break sizes was analyzed for DCPP. The results show that for break sizes up to 0.53 square feet, a reactor trip is not generated. In this case, the event is similar to an excessive load increase event. The core reaches a new equilibrium condition at a higher power equivalent to the increased steam flow. For break sizes larger than 0.53 square feet, a reactor trip is generated within a few seconds of the break from low steam line pressure safety injection actuation signal. Therefore the steam line break protection and accident analysis is unaffected by the identified condition.
Excessive Heat Removal Due to Feedwater System Malfunctions Reductions in feedwater temperature or excessive feedwater additions are means of increasing core power above full power. Such transients are attenuated by the thermal capacity of the secondary plant and of the RCS. The overpower-overtemperature protection (neutron flux, overtemperature delta T, LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) OF 2002 5 Diablo Canyon Unit 1 0 0 5 7 0 0 0 0 8 0 1 0 2 and overpower delta T trips) prevents any power increase that could lead to a DNBR that is less than the DNBR limit. One example of excessive feedwater flow would be full opening of a feedwater control valve due to a feedwater control system malfunction or an operator error. At power, this excess flow causes a greater load demand on the RCS due to increased subcooling in the SG. With the plant at no-load conditions the addition of cold feedwater may cause a decrease in RCS temperature and thus a reactivity insertion due to the effects of the negative moderator coefficient of reactivity. Continuous excessive feedwater addition is prevented by the SG high-high (P-14) level trip. A review of the mid- deck plate effects on the preexisting high level setpoint of 75 percent verified that adequate margin exists to assure reactor protection and SG margin to overfill.
Anticipated Transient Without Scram (ATWS) One SG NR level instrument per SG provides input to the AMSAC. If an ATWS event occurs, the AMSAC system trips the turbine, starts AFW, and isolates SG blowdown on coincidence of low-low SG water level in three out of four SGs.
AMSAC utilizes one SG water level NR signal from each loop with a setpoint of 5 percent. The AMSAC system is not safety related and not controlled by TS, but is controlled by an equipment control guideline (ECG). Actuation of the AMSAC system would have been delayed by the nonconservative mid-deck plate dP.
Operator Emergency Response There is no impact to the Emergency Response Guidelines (ERGs) since the ERGs are entered following a reactor trip or safety injection signal when the mid-deck plate pressure drop would be minimal.
Potential Core Damage Frequency Calculations DCPP performed a probability risk analysis calculation (file number PRA02-01, Revision 0) evaluating this condition for two cases:
Case 1: Calculated the conditional core damage probability (CCDP) and the conditional large early release probability (CLERP) for the February 9, 2002, Unit 2 reactor trip. These figures of merit are calculated to assess the significance of the event according to the requirements of NRC directive 8.3. The results were that the CCDP was approximately 4.87 E-7 and CLERP approximately 1.18 E-7.
Case 2: Calculated the annual core damage frequency (CDF) and large early release frequency (LERF) associated with the nonconservative SG NR low-low setpoint. These figures of merit are calculated to assess the LICENSEE EVENT REPORT (LER) TEXT CONTINUATION OF 2002 0 Diablo Canyon Unit 1 9 0 1 0 5 2 0 5 0 0 7 0 0 risk significance of operating the plant in an unanalyzed condition for a long period of time. The results were that the CDF was approximately 4.37 E-8 per year and LERF was approximately 6.54 E-9 per year.
Conclusion Based upon the review of the affected instrumentation functions, effect of the nonconservative SG NR level instrumentation bias, available protection systems, and risk assessment, PG&E believes that the condition did not present a significant safety hazard for the period of time the condition existed.
Therefore, the health and safety of the public were not adversely affected by this event.
V � Corrective Actions A. � Immediate Corrective Actions 1. Utility plant operators reduced reactor power to return the SG NR low-low level trip to an operable condition.
2. Utility plant engineers issued a plant design change to establish conservative SG low-low level setpoints.
B. � Corrective Actions to Prevent Recurrence 1. PG&E will review the cause analysis and proposed corrective actions for this event identified by Westinghouse's internal event prevention investigation currently in progress.
2. PG&E will conduct a follow-up audit of Westinghouse's potential issues process and corrective actions identified as a result of this event.
3. PG&E will submit a license amendment request to revise TS 3.3.1 and 3.3.2 setpoints to account for the mid-deck plate dP in the SG NR low-low level protection setpoints.
VI. � Additional Information A. � Failed Components None.
1. Main feedwater regulating valve FCV-540 failed closed and water level is dropped rapidly.
2. The reactor did not trip when the actual SG water level dropped below the 7.2% low-low level trip setpoint.
Indicated NR level at this time was approximately 7.5%.
Mid-deck plate V ormal Water Level Lo-Lo Trip Setpoint Analysis Level 3. Operator initiated manual reactor trip when indicated NR level is 7.5%. Water level in SG is well below the NR lower tap.
Narrow Range Level Indication LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) OF 2002 Diablo Canyon Unit 1 10 0 0 5 7 2 0 0 5 0 0 0 1 0 B. � Previous Similar Events A similar event was reported in Licensee Event Report 1-96-008-00, "Manual Reactor Trip on Loss of Normal Feedwater Due to Personnel Error," DCL-96-144, dated July 11, 1996. The loss of normal feedwater was caused by a loss of both main feedwater (MFW) pumps during recovery from a MFW and condensate system flow transient due to a load transient bypass (LTB) signal actuation. The root cause of this event was personnel error (cognitive) in that licensed plant operators failed to place the LTB control system in manual prior to reset of the protection system processor. Corrective actions included operations and maintenance training regarding removing equipment from service for maintenance and procedure revision regarding LTB recovery. These corrective actions would not have prevented this event, as the plant transient did not indicate a NR to WR level indication anomaly.
Figure 1 — Steam Generator Narrow Range Level Illustration