05000323/LER-2003-006
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| 3232003006R00 - NRC Website | |
I. Plant Conditions
Unit 2 was in Mode 5 (Cold Shutdown).
II. Description of Problem
A. Background
In Mode 5, decay heat is normally removed by the residual heat removal (RHR) system. The auxiliary feedwater (AFW) [BA] system is not required to be operable in Mode 5. The AFW system is a safety-related system that serves as a backup supply of feedwater to the secondary side of the Steam Generators (SGs) [AB]. It maintains the heat sink function of the SGs whenever the main feedwater system is unavailable.
The AFW system consists of three auxiliary feedwater supply trains with pumps [P] driven by diverse power sources. One train includes a full-capacity steam turbine-driven pump, aligned to all four of the SGs. The other two trains consist of half-capacity motor-driven pumps, each supplying flow to two of the four SGs, with the capability to be aligned to any of the four SGs.
The normal suction source for the AFW pumps is the Condensate Storage Tank (CST). If the CST becomes unavailable for any reason, several additional sources of water can be aligned to the AFW system. The additional sources are described in plant operating procedures.
The engineered safety features actuation system (ESFAS) [JE] is designed with controls to automatically actuate the motor-driven pumps for the following signals:
1. Two-out-of-three low-low level signals (less than 15 percent) in any one SG 2. Trip of both main feedwater pumps 3. Safety injection signal 4. Transfer to diesel generators without safety injection signal 5. Anticipated transient without scram mitigating system actuation circuitry (AMSAC) signal The AFW system is designed with controls to automatically actuate turbine-driven pump 2-1 on signals indicating less than 15 percent level in LICENSEE EVENT REPORT (LER) TEXT CONTINUATION 5 FACILITY NAME (1) Diablo Canyon Unit 2 0 DOCKET NUMBER (2) 3 2003 LER NUMBER (6) 0 0 3 I OF 0 1 0 0 3 2 6 0 0 The purpose of the RHR system is to transfer decay (residual) heat and sensible heat under normal and emergency conditions from the reactor coolant system (RCS) (and the core) to the component cooling water (CCW) system, where it is transferred to the auxiliary salt water (ASW) system and then to the ultimate heat sink, the Pacific Ocean.
The RHR system consists of two parallel, redundant flow paths, each consisting of one RHR pump, one RHR heat exchanger, and one heat exchanger flow rate control valve. Each flow path is physically and electrically separated.
Technical Specification (TS) 3.4.7, "RCS Loops-Mode 5, Loops Filled," Limiting Condition for Operation 3.4.7, in part, states:
"One residual heat removal (RHR) loop shall be OPERABLE and in operation, and either:
1. One additional RHR loop shall be OPERABLE; or 2. The secondary side water level of at least two steam generators (SGs) shall be > 15 %.
Surveillance Test Procedure (STP) I-38-AB.3 provides instructions for solid state protection system (SSPS) Trains A and B return to service after testing/maintenance in modes 5, 6, or defueled. Devices included in this procedure collectively function to provide SSPS Trains A and B reactor trip and ESFAS coincidence logic and actuation.
B. E Event Description On April 8, 2003, with Unit 2 in Mode 5 (Cold Shutdown), the AFW system automatically actuated on a valid signal when the SSPS was placed in service while SG 2-1 level was below the AFW actuation setpoint. The AFW system actuation was unplanned.
SG 2-1 level had been lowered to below the SG feed ring for work on an AFW system check valve. Operations was performing testing on the AFW system using AFW Pump 2-2, and was going to restore SG 2-1 level to normal (approximately 33 percent narrow range level) during the test. In conjunction with the AFW system testing, the SSPS was being placed in service in preparation for an expected Mode 4 transition later in the shift.
When the SSPS was placed in service, the "SG 2-1 low-low level signal" made up the coincidence for starting the motor-driven AFW pumps. AFW Pump 2-2 was in operation, but AFW Pump 2-3 started in response to the LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) low-low SG level signal. AFW Pump 2-3 was aligned for recirculation flow, and did not feed forward on the automatic start. Operations then restored SG 2-1 level above the low-low level actuation setpoint and secured AFW Pump 2-3.
C. Inoperable Structures, Components, or Systems that Contributed to the Event None
D. Other Systems or Secondary Functions Affected
In addition to the AFW actuation, a SG blowdown isolation signal initiated but SG blowdown was not in service at the time.
E. Method of Discovery
The event was immediately apparent to utility licensed operators due to indication and alarms in the control room.
F. Operator Actions
Operations restored SG 2-1 level above the SG low-low level actuation setpoint and secured AFW Pump 2-3.
G. Safety System Responses
AFW pump 2-3 started and SG blowdown isolation signal activated.
III. � Cause of the Problem
A. Immediate Cause
AFW Pump 2-3 automatically started when the SSPS was placed in service with SG 2-1 water level below the SG low-low level actuation setpoint.
B. Root Cause
Knowledge Base Error:
Prior to allowing the SSPS to be restored to service, no member of the control room crew recognized that the SG low-low level LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) 0, 0 0 3 2 Diablo Canyon Unit 2 0 3 2003 -1 0 0 1 6 5 I OF 6 0 0 actuation signal would also generate an AFW pump start signal.
They noted the SG level bistables were actuated, but assumed they would only generate a reactor trip signal. With the reactor trip breakers open, no risk of equipment operation was perceived to exist.
IV. Assessment of Safety Consequences
TS 3.4.7 was satisfied because, at the time of the event, RHR pump 2-1 was in service, RHR pump 2-2 was operable but secured, and the indicated levels in SG 2-2 and SG 2-3 were above 15 percent. In addition, the SG 2-4 indicated level was above 15 percent. With only one SG level less than 15 percent, no turbine-driven AFW pump 2-1 actuation signal was generated.
Actuation of AFW pump 2-3 in Mode 5 had no safety consequences because it was not needed in Mode 5, and was aligned for recirculation, thus, did not feed forward.
The condition is not a Safety System Functional Failure.
Thus, the event is not considered risk significant and did not adversely affect the health and safety of the public.
V. � Corrective Actions
A. Immediate Corrective Actions
Operations restored SG 2-1 level above the SG low-low level actuation setpoint and secured AFW Pump 2-3.
B. Corrective Action to Prevent Recurrence An operations incident summary will be promulgated to provide operating experience on this event to all on-shift Operations personnel.
VI. � Additional Information A. � Failed Components None LICENSEE EVENT REPORT (LER) TEXT CONTINUATION 0 I5 0 FACILITY NAME (1) DOCKET NUMBER (2) 3 2003 LER NUMBER (6) 0 0 0 6 I OF o I o 0 3 2 6 6 B. � Previous Similar Events Component Cooling Water Pump Start Due to Personnel Error" reported an engineered safety feature (ESF) actuation signal initiated a trip of the auxiliary electrical power, separating vital Bus F from the offsite power, due to personnel error (cognitive) by a utility licensed operator and an inadequate procedure that did not include adequate precautions to prevent the inadvertent ESF actuation. The corrective action consisted of revising STP M-75.
Generators Started When Startup Power Was Lost Due to Personnel Error" reported Unit 2 Emergency Diesel Generators started upon an incorrect opening of a 230-kV disconnect switch due to personnel error by a utility licensed operator and insufficient switch labeling. The corrective actions consisted of operator counseling on correct self-verification techniques and installing switch color-coding signs.