05000445/LER-2010-002

LER-2010-002, Loss of Automatic Initiation of Auxiliary Feedwater Upon Loss of Main Feedwater

Comanche Peak Nuclear Power Plant
Event date:	01-20-2010
Report date:	06-23-2010
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability
4452010002R01 - NRC Website

A. REPORTABLE EVENT CLASSIFICATION

10CFR50.73(a)(2)(1)(B) "Any operation or condition which was prohibited by the plant's Technical Specifications" and 10CFR50.73(a)(2)(vii) "Any event where a single cause or condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to: (B) Remove residual heat"

B. PLANT CONDITION PRIOR TO EVENT

was in Mode 1 operating at 100% power.

C. STATUS OF STRUCTURES, SYSTEMS, OR COMPONENTS THAT WERE

INOPERABLE AT THE START OF THE EVENT AND THAT CONTRIBUTED TO 'THE

EVENT

There were no inoperable structures, systems, or components that contributed to the event.

TIMES

CPNPP TS 3.3.2, Function 6.g, requires two Main Feedwater pump (MFWP) trip channels for each automatic Auxiliary Feedwater Pump (AFW) initiation circuit. TS 3.3.2 also requires a manual initiation circuit, which was not affected by this event. Per TS 3.3.2, Condition J, if one required MFWP trip channel is inoperable, the inoperable trip channel must be placed in the trip condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> or the plant must be placed in MODE 3 within the following 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

was in Mode 1 operating at 100% power. At 1827 hours0.0211 days <br />0.508 hours <br />0.00302 weeks <br />6.951735e-4 months <br />, during review of Oconee INPO 0E30225 ("Main Feedwater Pump Reset design feature provides incorrect Main Feedwater Pump status"), a System Engineer (Utility, Non-Licensed) discovered parallels between the Oconee design and the CPNPP design. Further investigation determined that CPNPP operating procedures allowed for one MFWP [El IS: (SJ)(P)] to be reset (i.e., hydraulic oil pressure present) but not aligned to be a source of MFW.

During low-power plant operations, such as start-up or when Unit 1 was recently operated at a lower power level while a single Main Transformer was in service, only one MFWP is creating forward MFW flow. The other MFWP is in a "reset" condition, with the Steam Stop Valves [El IS: (SJ)(SHV)] open. This condition utilizes hydraulic trip fluid to keep the � Stop Valves open, which appears to be an "operating" MFWP to the hydraulic pressure switches [EllS: (SJ)(HCU)(PS)]. In the event that the operating MFWP receives a "trip" signal, all of the MFW flow would cease, but since the off-line MFWP is in the "reset" condition, the 2/2 "Loss of Main Feedwater" logic would not be satisfied, and an AFW auto-start signal [El IS: (BA)(MSTR)] would not be initiated. It was determined that in this condition, the MFWP trip channel would be inoperable per TS 3.3.2, Condition J. CPNPP believes that this condition has existed since 1990, when Unit 1 was initially licensed.

Therefore, the required actions of TS 3.3.2, Condition J, may not have been complied with since 1990 at any time that CPNPP Units 1 and 2 were operating at low power with only one MFWP providing MFW flow.

PROCEDURAL PERSONNEL ERROR

During review of an Oconee INPO OE report, a System Engineer (Utility, Non-licensed) discovered parallels between the Oconee design and the CPNPP design. Further investigation determined that the required'completion times for TS 3.3.2, Condition J, may not have been completed in the past within the times specified in the TS.

A. CAUSE OF EACH COMPONENT OR SYSTEM FAILURE

Not applicable - No component failures were identified during this event.

B. FAILURE MODE, MECHANISM, AND EFFECTS OF EACH FAILED COMPONENT

Not applicable - No component failures were identified during this event.

COMPONENTS WITH MULTIPLE FUNCTIONS

Not applicable - No component failures were identified during this event.

D. FAILED COMPONENT INFORMATION

Not applicable - No component failures were identified during this event.

A. SAFETY SYSTEM RESPONSES THAT OCCURRED

Not applicable - No safety system responses occurred as a result of this event.

B. DURATION OF SAFETY SYSTEM TRAIN INOPERABILITY

The required actions of TS 3.3.2, Condition J, may not have been complied with since 1990 at any time that CPNPP Units 1 and 2 were operating at low power with only one MFWP providing MFW flow.

C. SAFETY CONSEQUENCES AND IMPLICATIONS OF THE EVENT

The applicable safety function is decay heat removal via the AFW system. The motor­ driven AFW pumps are designed to start automatically in the event of a low-low water level in any steam generator, upon actuation of a Safety Injection or AMSAC, after restoration of bus power following a loss of offsite power, or upon trip of both MFWPs. In the safety analyses presented in FSAR Chapter 15, the only credited signal is the start of the motor-driven AFW pumps upon generation of a low-low water level signal in any steam generator. Even though the TS required automatic initiation circuit of the motor­ driven AFW pumps upon trip of both MFW pumps may not have been operable since 1990 at any time that CPNPP Units 1 and 2 were operating at low power with only one MFWP providing MFW flow, the AFW pumps remained operable. The automatic start of the motor-driven AFW pumps upon trip of both MFWPs is an anticipatory trip based on the loss of normal decay heat removal; this trip function is not credited in the FSAR Chapter 15 accident analyses. Automatic actuation of the Motor Driven AFW pumps was still possible via steam generator low-low water level protection circuits (which, at CPNPP, are credited within the safety analyses), via AMSAC (which starts Turbine Driven and Motor Driven AFW pumps), upon actuation of a Safety Injection signal, and by a blackout signal after restoration of bus power following a loss of offsite power. AFW initiation was also available via manual actuation by control room operators as required by TS 3.3.2.

Since the motor-driven AFW pumps were, at all times when required, fully capable of automatically responding as designed in response to the accidents for which they are credited in the plant's accident analyses, the capability of the AFW system to perform the safety function for which it is designed was never compromised. Therefore, based on the availability of the motor driven AFW pump start signal credited in the safety analyses, the unavailability of the anticipatory start signal has no impact on the conclusions of the accident analyses.

IV. CAUSE OF THE EVENT

The cause analysis of this event determined that the plant design and original operating philosophy was not compatible with the NRC's clarification of the intent of TS 3.3.2, Table 3.3.2.1, Function 6.g and Condition J during single FWPT operation. In addition, no OE or other formal notification was made to licensees that the interpretation of TS 3.3.2 had been clarified.

V. CORRECTIVE ACTIONS

Corrective actions include the completion of procedure changes on Unit 1 to ensure compliance with TS. Since Unit 2 has been operating at 100% power with both MFWPs in service since discovery of this condition, corresponding changes to the Unit 2 procedures will be completed prior to removing one MFWP from service during the next shutdown of Unit 2 or prior to startup of Unit 2 from any event which results in an unplanned trip of Unit 2. An Operations Shift Order has been issued to advise operating staff of the condition and to note that the Unit 2 procedures will need to be updated/revised prior to a restart of Unit 2 should a trip or shutdown occur and a restart is required. This shift order item will remain in effect until the Unit 2 procedures are updated.

VI. PREVIOUS SIMILAR EVENTS

There have been no previous similar reportable events at CPNPP in the last three years.

�