05000298/LER-2007-006
| Cooper Nuclear Station | |
| Event date: | 11-0-2007 |
|---|---|
| Report date: | 0-1-1008 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident |
| 2982007006R00 - NRC Website | |
PLANT STATUS
Cooper Nuclear Station (CNS) was in Mode 1 at 100 percent, steady state power at the time of this event.
BACKGROUND
The standby alternating current (AC) power system [EllS:EK] consists of two independent on-site diesel generators (DG) [EIIS:DG] adequate for maintaining the safe shutdown of the reactor following abnormal operational transients and postulated accidents in the event of failure of off-site power. Each DG unit has a fuel oil day tank [EIIS:DC]. Each day tank can be supplied from the two main fuel storage tanks which are cross-tied [EllS:DC]. Both main fuel storage tanks combined are capable of providing sufficient fuel for seven days of operation of one DG unit under postulated accident conditions. Each fuel oil day tank provides enough fuel to allow a minimum of five hours of full load operation of the DG unit.
The two diesel fuel oil storage tank suctions are cross-tied. Each of the two diesel fuel oil storage tanks is provided with its own transfer pump [EIIS:P] and piping connections to its respective fuel oil day tank. The fill system discharges are also cross-tied prior to the day tanks, and a float admission valve [EIIS:SHV] on the inlet will prevent overfilling the day tank in the division opposite the fill demand signal. A second valve, which is solenoid operated [EIIS:LSV], will close if the level continues to rise. This solenoid is controlled by a high level control switch [EIIS:LS].
EVENT DESCRIPTION
On September 11, 2007, the plant was in Mode 1, in day two of a seven-day shutdown action statement of Limiting Condition for Operation (LCO) 3.8.1. DG 2 was inoperable and unavailable due to planned maintenance. At 12:46, while operators were refilling the DG 2 fuel oil day tank for system restoration, the control room received a high-high level alarm on the DG 1 fuel oil day tank. There were indications from the field that the DG 1 fuel oil day tank inlet high level float shutoff valve and the solenoid shutoff valve were leaking by. Acceptance criteria of a surveillance procedure (SP) were applied which checks closure of the DG 1 fuel oil day tank solenoid shutoff valve. Based on the acceptance criteria not being met, as indicated by the rising day tank level, DG 1 was determined unable to meet Technical Specification (TS) Surveillance Requirement 3.8.1.6. DG 1 was declared inoperable, per the SP, at 14:49. LCO 3.8.1, Condition E, was entered for two DGs inoperable with Required Action El to restore one DG to operable status within two hours.
� At 15:09, the DG 1 maintenance lockout switch was tagged in the OFF position for replacement of the DG 1 fuel oil day tank solenoid shutoff valve. This rendered the second DG, DG 1, inoperable and unavailable. At 16:45, maintenance work was complete and safety tags cleared, making DG 1 available. However, post work testing had determined the replacement work was ineffective. At 16:49 hours, CNS entered LCO 3.8.1, Condition F (Be in Mode 3 in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and Mode 4 in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />) upon reaching the two hour completion time to restore one DG to operable status.
Subsequently, at 19:19, the fuel oil day tank inlet cross-tie valve was caution tagged in the closed position to separate the two DG fuel oil transfer subsystems. By splitting the subsystems, the day tank overfill protection of each day tank was provided by the individual day tank level switches which operate and secure the respective fuel oil transfer pump. DG 1 was declared operable at 21:29 and LCO 3.8.1 Conditions E and F were exited.
BASIS FOR REPORT
This is reportable under 10 CFR 50.73(a)(2)(v)(D) as a condition which could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.
SAFETY SIGNIFICANCE
This event is a safety system functional failure for on-site emergency AC power. The concurrent unavailability of both DGs occurred for 96 minutes. Due to the short duration, this condition is not risk significant. The impact on core damage probability was determined to be below levels established for risk significance; that is, less than 1E-06.
CAUSE
The SP applied to the DG 1 fuel oil day tank solenoid shutoff valve was inadequate in that it contained a requirement to declare DG 1 inoperable following failure to meet acceptance criteria when other options for maintaining operability of the DG system were available. Specifically, other system operating procedures allowed splitting out the DG fuel oil subsystems by closing the fuel oil day tank inlet cross-tie valve and ensuring the fuel oil pump switches are in AUTO, thus preventing one DG fill evolution from potentially impacting the other DG.
CORRECTIVE ACTION
The SP was revised to provide an alternate action if the day tank inlet high level float shutoff valve and the solenoid shutoff valve fail to close. The new revision was implemented on September 12, 2007, and provides instruction to maintain the fuel oil day tank inlet cross-tie valve in the closed position, thereby making the close function of the solenoid shutoff valve unnecessary. Additional DG fuel oil system surveillances were similarly revised and made effective on September 20, 2007.
PREVIOUS EVENTS
The following previous event was related to a DG diesel fuel oil transfer system failure, but had a different root cause:
transfer pump in-service flow test on November 5, 2004, resulted in a condition prohibited by TS. The SP in effect at that time allowed quarterly exercising of the two normally closed manual cross connects between the fuel storage tanks by placing the fuel transfer pump switches to the OFF position and then validating cross-connect valve operation. On December 30, 2004 operators recognized that steps to place the transfer pump switches to OFF required declaring both DGs inoperable. The procedure was revised and the surveillance was subsequently performed. Three prior surveillances performed in 2004 were evaluated and there was no loss of safety function. However, for the surveillance performed in November 2004, the TS "immediate" action limit for Mode 4 was exceeded which resulted in a condition prohibited by TS. The root cause was that the SP was inadequate in that it did not provide a caution that performing procedure steps would render both DGs inoperable.
�