Text

Insp Repts 50-445/90-11 & 50-446/90-11 on 900315-19.No Violations Noted.Major Areas Inspected:Review of Sequence of Events Re Inadvertent Single Train Safety Injection Event on 900312
	ML20034A307
Person / Time
Site:	Comanche Peak
Issue date:	04/05/1990
From:	Chamberlain D; NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV)
To:	;
Shared Package
ML20034A305	List: IR 05000445/1990011; ML20034A304;
References
	50-445-90-11, 50-446-90-11, NUDOCS 9004230020
	Download: ML20034A307 (28)
	v • d • e

-

...

.

-.

. -.....

-

. - -.

_-

-

.

.-

.,..

.

'

!

?

.

l

!

U. S. NUCLEAR REGULATORY COMMISSION-

[

i OFFICE'OF NUCLEAR REACTOR REGULATION

!

l i

NRC Inspection Report:

50-445/90-11 Un'it 1 Operating License:

NPF-28 I

50-446/90-11 Unit 2 Construction Permitt f

CPPR-127 Expires:

August'1, 1992 j

Dockets: 50-445 i

50-446

!

Licensee:

TU Electric

.i Skyway Tower

400 North Olive Street Lock Box 81 i

Dallas, Texas 75201 Facility Name:

Comanche Peak Steam Electric Station (CPSES), Units 1

[

and 2

!

.

Inspection Att Comanche Peak Site, Glen Rose, Texas Inspection Conducted:

March 15 through March 19, 1990-

I

!

'

Team Leader:

M

+'5'90 D. D. C%amberlain, Chief, Project Section B Date

!

Division of Reactor Projects, Region IV I

'

t Team Members:

M. Fields, Project Manager, NRR l

I. Ahmed, Senior Electrical Engineer,-NRR-

!

S. Butler, Resident Inspector, Region IV B. Elliot, Senior Materials Engineer, NRR

!

D. Graves, Operator Licensing Examiner, Region IV

C. Liang, Senior Reactor Systems Engineer, NRR

T. Szymanski, Technical Assistant,

Operations Licensing Branch, NRR t

i

>

.

t

,

9004230020g00410%[

{

PDR ADOCK

O i

+

'I

. - -

-- -

-

.

. ~... -.

...

-.

..

-

_ _,.

.

..

.

..

.. :

. !.

.

_ _ _ _ _ _ _ _ _

_. __ _

_ _ _ _ _ _ _

__.

. *,,

.

2-

.

,

- -

1.0 General Backcround Information The NRC has established a policy to provide for the timely, thorough, and systematic inspection of significant operational events at nuclear power plants.

This includes the use of an Augmented. Inspection Team (AIT) to determine the causes, conditions, and circumstances relevant to an event and to communicate its findings, safety concerns, and recommendations to NRC management.

An AIT was sent to Comanche Peak Steam Electric Station'(CPSES) Unit 1 on March 15, 1990, to review an inadvertent single train safety injection event which occurred on March 12, 1990.

A description of the event.and the AIT tasks is provided below.

As an aid to the reader, L

Section 6.0 of this report provides a list of acronyms used in the report.

'

1.1 Description of Event on Monday, March 12, 1990, at 2:01 p.m.

(CST), the Comanche Peak Steam Electric Station (CPSES), Unit 1, experienced an inadvertent actuation of Train A safety injection with the.

j unit in operational MODE 4.

The licensee had recently completed initial fuel ~ loading and the reactor had not been I

taken critical.- A detailed overview and time sequence for the event is provided in Section 2.1 of this report.

The AIT was dispatched to CPSES on March 15, 1990, to gather facts regarding licensee actions and plant response to the event.

1.2 AIT Tasks The AIT dispatched to CPSES was composed of a team leader from NRC Region IV, a CPSES Project Manager from the Office of Nuclear Reactor Regulation (NRR), the resident inspector from Waterford, an operator licensing examiner from Region IV, and four technical specialists from NRR. -The AIT tasks were specified in.a memorandum from the NRR Associate Director for Special Projects to the team leader.

These tasks included:

"1.

Using the information developed by CPPD Site. Inspectors, conduct a thorough review of the sequence of events associated with the inadvertent single train injection at Comanche Peak Unit 1 on March 12, 1990, and the subsequent NRC notification.

2.

Review the expected consequences of the event had it occurred at full power.

What would have been the cooldown rate and flows associated with inadvertent L

actuation of Safety Injection Train A?

3.

Review the cause of the safety injection signal and the reason Train B did not initiate.

.

A

...

. _. -

-_

....

. _ -

- _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ - _ - _ _ _ _ _

' '..

.

a

.

i

-

-3-

.

,

i i

4.

Review the plant systems and equipment response to the j

j event.

j i

5.

Review the operators' response to the event, including

human factors and procedural deficiencies (e.g., did they

meet the criteria for starting the RCP).

6.

Review the' cold overpressure mitigation system setpoints

!

with regard to unnecessary challenges of the PORVs.

s 7.

Review the thoroughness of the licensee's investigation

!

of the event.

>

8.

Provide a Preliminary Notification upon initiation of the

inspection and an update on the conclusion of the

'

inspection.

9.

Prepare a special inspection report documenting the

'

results of the above activities within 30 days of the.

start of the inspection."

,

Although the AIT concentrated efforts on the event-of concern, all aspects surrounding the event and plant response were

,

reviewed for any other safety concerns.. Key elements of the

,

AIT charter were to develop a thorough technical understanding of plant and operator response to the event, to review the-expected consequences of the event-had it occurred at full power, and to review the licensee's investigation of the

,

event.

The primary focus of the AIT was on fact finding; any potential enforcement matters will be the subject of

subsequent inspection effort.

"

2.0 AIT Inspection

,

2.1 overview and Sequence of Events-i

2.1.1 overview on Monday, March 12, 1990, at 2:01 p.m., the CPSES, Unit 1,

'

experienced an inadvertent actuation of the Engineered Safety Features Systems (SI).

The unit was in MODE 4 after heating

up following initial core loading.

operatorswerestabilizingplantconditgonswithreactor coolant system (RCS) temperature at 250 F, RCS pressure at 380 psig and steam generator levels above normal operating levels in preparation for performance'of startup test EGT-TP-341A "RCS Temperature Sensor Verifigation."

Since RCS

-

temperature could not be maintained at 250 F using the steam

generator (SG) atmospheric dump valves with all four reactor coolant pumps running, the Train B residual heat removal (RHR)

'1 i

b

i

.-..

<

!

-4-l

,

!

System was placed back in service to control temperature as

!

required by the test.

,

For reasons unknown at the time, Train A SI actuated and the operators responded using Emergency Procedure EOP-0.0, i

,

" Reactor Trip or Safety Injection."

The Train A SI~ actuation l

was later determined.to be caused by the failure of a blocking

!

diode in the Solid State Protection System which allowed a

containment-Ventilation Isolation Signal to actuate the Train'A SI equipment.

By using applicable steps in EOP-0.0,

.

the operators were able to assess plant status and secure i

unnecessary equipment.

.,

The operators verified that the appropriate

"A" train

!

equipment which was in service had started or shifted to its i

'

safety configuration.

It was noted that both condensate pumps

that were running had tripped.

This was later attributed to

>

'

the loss of a nonsafety-related inverter that was shed during-

-

the SI sequence.

The inverter's loads were being fed from the l

backup power supply rather than the normal source of power and

the inverter was not able to shift to the battery as it

!

L normally would have.

s Auxiliary feedwater flow was initiated to the No. 1 and 2 SGs

and had to be secured-manually.

The level in the No. 1 SG

'

i increased to above the P14 (Hi-Hi SG level turbine trip)

setpoint before flow could be terminated.

Approximately 7 minutes into the events, all four reactor

i coolant pumps were stopped due to fluctuating differential

'

pressure (dp) across the pump No. 1 seals.

The dp was fluctuating due to isolation of the seal return line from the

SI and pressure dropped below the 200 psid, required for running of the pumps.

The SI signal and SI sequence were reset by procedure and

"

running equipment was secured.

Injection flow was terminated within 13 minutes after injecting approximately:8000 gallons

_

i of water from the refueling water storage tank (RWST).

Pressurizer level was 93%.

E6rmal charging-and letdown were i

reestablished and pressurizer level restored to' normal.

-

,

A Notification of Unusual Event (UE) was declared and

.

notification to state and local officials and the NRC was

[

made.

Normal seal injection and return for the reactor coolant pumps

(RCPs) was restored and all SG atmospheric dump valves (ADVs)

,

were opened to equalize temperatures between the' primary and

,

i secondary side of the steam generators in preparation for restart of the reactor coolant pumps.

When the No. 4 RCP was.

!

,

restarted at 3 56 p.m., RCS pressure increased to the setpoint

!

I I

y.-

<

Qi

,

~, -.. _.

,. -

....

.

., ~,,.

-,

--m

,-

, -, ~ -.

...

., -..,

..

.-

.

.-

_

-

.. -

.-

-

- -

_ _ _ _ - - _ _ - - _ _ _ _ _ _

j

. ;.

.

i l-5--

{

,

.

\\

of one cf the low temperatures over pressure. reliefs and the

!

,

valve (PCV455A) opened for approximately 7 seconds.

The valve

then resented end plant conditions stabilized.

A slight

-

pressure drop was experienced when the No. 1 RCP was restarted

,

at.4:27 p.m.

The Unusual Event was germinated at 4: 25 p.m.

when the plant was stabilized at 185 F and 350 psig.

!

'

\\

i An event evaluation team was formed by the licensee to ensure

.

that the event was properly. understood and the cause and l

associated problems were corrected prior to continuing with

.

plant startup.

i 2.1.2 Detailed Sequence of Events

!

i

.

The licensee provided the AIT with a written sequence of events that was compiled from data obtained from the following sources:

.

the Unit log,

-

personnel interviews,

-

'

the P2500 computer system,

-

'

the ERF (Emergency Response Facility) computer

-

system,

,

.

RM-11 (Digital Radiation Monitoring System printout)

-

The sequence of events listing below was compiled from tne

-

licensee's sequence of events after verification by the inspectors by personnel interviews, and review of logs and

-

other computer data.

Some amplification and clarification is

l provided.

Time of events is from a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months clock.

~

/

.

]

Initial Conditions:

Unit 1 was in MODE 4, with four RCPs running and Train B RHR in service cogtrolling RCS temperature.

RCS temperature was 250 F and pressure was 380 psig.

The main steam system was isolated from the SGs and the condensate system was in long cycle cleanup.

March 12, 1990

,

1401 Train A SI Actuation, operators verified actuation based on indication on the control and permissive indicator panel of "SI ACT" and equipment starting.

I i

The First Out annunciator pane) was not available since

'

I it was disabled to allow work on the Sequence of Events L

Recorder.

The operators entered EOP-0.0A and verified that equipment had started properly.

It was noted that both operating condensate pumps had tripped which was unexpected.

>

1402 P-14 was actuated on Hi-Hi level in No. 1 SG due to

.

overfeeding with auxiliary feedwater system (AFW).

Operators took manual control of the flow control.

i l

- _. _.

.

, -

.

..,

_

_.

__

.

..

_

___

. _ _ _ _ _ - - _ - _

'

..

e

.

-6-

.

,

valves (FCVs) to No. 2 and the No. 1 SG and closed the valves.

1405 shift supervisor was notified of SI actuation.

He was in technical support center (TSC) giving shift turnover to the oncoming shift.

1408 operators secured all four RCPs due to fluctuating No. 1 seal dp.

Differential pressure was-varying from 170 to 220 psid due to seal return being isolated by SI and the cycling of the seal leakoff relief valve.

Minimum seal dp required for pump operation is 200 psid per procedure.

1409 Entered ECS-1.1A SI termination procedure.

1410 Reset SI and SI sequencer per EOS 1.1A 1412 Secured No. 1 motor driven auxiliary feedwater pump (MDAFWP-1), level was still going up in No. 1 SG even though the FCV was shut.

1414 Secured high pressure injection (HPI) flow from No. 1 centrifugal charging pump (CCP-01), had to secure pump per the " response not obtained"'(RNO) column of the emergency procedure because FCV 1-8801A did not indicate full shut.

operators resta;ted CCr 01 for eeni linjection and normal charging.

1416 Secured RHRP-01.

Secured No. 1 and 3 containment spray pumps (CSPs).

1420 Declared UE per EPP-201.

Operators reestablished the normal letdown flow path (RHR' letdown continued throughout the event) and charging was-reduced to bring pressurizer level from 93% back to normal operating level (NOL) of 25%.

1424 Secured emergency diesel generator-(EDG) 01, 1432 Throttled component cooling water (CCW) to Train B RHR heat exchanger (Hx) to limit cooldown of RCS.

Train B RHR remained in service throughout event.

1435 Notified county and state government agencies of UE.

1446 Notified NRC via emergency notification system (ENS) of UE.

1455 Unit i declared in MODE 5 based on core exit

thermocouple (CET) gf 188 F, the hot. leg RTDs still indicated above 200 F.

.

e

.. _.

-

- - -

_.

. - _ _

- -.

.---

... _.

_

.,..

.

-

.

-

,

1538 opened all SG atmospheric relief galves (ARVs) to ensure secondary of SGs within 50 F-of primary.in preparation for restarting RCPs.

The SG pressures dropped from approximately 5-6 psig to O psig.

1546 Closed all SG ARVs.

1555 Starged RCP 1-04, the RCS temperatures equalized at

>200 F as water circulated, the pressurizer' level

!

increased from approximately 23%-to 25% and pressure i

increased from 383 psig to 417 psig and power operated

>

relief valve (PORV) PCV-455A opened for 7 seconds.-

,

1625 Terminated UE.

,

!

1627 Started RCP-01, the operators expected another pressure increase but pressure actually decreased approximately j

20 psig.

.

t i

1628 Placed Train A solid' state. protection system (SSPS)

switch in the MODE 5/6 position.

-

1629 Plant stabilized at 185 F, 350 psig.

!

\\

'

i 1630 Notification of offsite agencies of event termination.

1633 Placed Train B SSPS switch in the MODE 5/6 position.

,

'

1636 Notified NRC via ENS of event' termination.

2.2 Plant Systems and Equipment Response

'

Review of the event revealed that in general, plant systems

'

and equipment that was in service responded as designed to the inadvertent actuation signal.

It was determined that some equipment did not operate properly or was unavailable because

'

of being out of service.

The more significant potential

"

equipment problems are listed here and are discussed in more detail below.

-Blocking Diode failure in SSPS was event initiator.

-No first out annunciators and sequence of events (SOE)

!

recorder.

-AFW malfunction of FCVs to No. 1 and 2 SGs, a possible design

'

deficiency with valve control circuits.

-P14 (Hi-Hi level in 1-01 SG) due to overfeeding did not generate turbine trip and "B" main feed pump (MFP) trip.

.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. _ _. _,. -

--

,. -..

-.y

.-,

%

,.. -.....

,m

.

.,.

-

--

_ _ _ _ _ _

_-

l

...,.

.

'

-8-

.

,

-IV1C2 BOP inverter lost due to load shedding during event and the condensate pumps tripped.

-FCV l-8801A didn't indicate full closed when shut by EOS 1.1-Emergency Response Facility (ERF) data printer did not appear to collect data-for first 4 seconds of event.

-P2500 alarm feature had numerous parameters turned off because they were.out of limits for the existing plant conditions which made the information unavailable to the operators during the event.

-Breakers 1 CR and 2 BR cn IEB3-1 were not verified to have tripped on load shed.

-CR Recorders (Hagans) provided limited information for post event evaluations due to lack of time marks, poor inking, etc.

2.2.1 SSPS Blockino Diode Failure Failure of the blocking diode in the SSPS was the event initiator and will be covered in detail in Section 2.3.

2.2.2 First Out Annunciators and Sequence of Event Recorder Prior to the event, the First out annunciator panel was disabled when the Sequence of Event recorder was taken out of service for maintenance.

Considering the plant conditions at the time of the event and the cause of the SI initiation, the lack of First Out indications did not appear to be significant for this event.

The licensee recognized that under different circumstances, the lack of these features could have been significant and plan to provide additional guidance on removing this equipment from service including provisions for ensuring it is available during plant startup.

2.2.3 Auxiliary Feedwater Malfunction The licensee had previously modified the AFW system.FCV control circuitry to have the valves shift to Auto when an i

actuation signal is received and to stroke closed.- once the associated pump had started and come up to speed, the valves would open while maintaining pump discharge pressure above a minimum value to protect the pump from runout.

During the event, the FCV response times were different. causing significantly more feedwater flow to SG 1.

Even after the valves were shut, it appeared that level in SG 1 continued to increase until the MDAFWP-1 was stopped.

The licensee performed subsequent testing of the AFW design feature using Procedure EGT-TP-90A-9 and essentially duplicated the improper operation of the valves to SGs 1 and 2.

The licensee also had

,

-

l HI l

l

.

-

.. _ -. -

-

.-.

.

.-. --

..

.. _ _ _ _ _ _ - _ _ - _ _

-

..,.

.

,

J l

l

'8-

.

,

concerns about being able to meet minimum flow requirements i

for the system with the modification in place that apparently

was not considered during the initial design or identified j

t during modification testing.

The licensee planned to evaluate

!

the AFW design prior to proceeding with plant startup.

The i

automatic feature for the FCV's was removed prior to the plant i

g

!

entering MODE 4.

The need for additional modification to

!

' ensure system operability will be evaluated prior to entering

!

t MODE 3 when the system is required by Technical specifications

!

(TS).

!

i 2.2.4 P-14 Accarent Malfunction

!

i During the event, it appeared that the P-14 signal generated when SG 1 was overfed by AFW didn't generate a turbine trip j

and a trip for the "B" MFP as designed..It was later i

determined that the system functioned properly.

The turbine

-

trip system was deenergized to allow opening of the turbine

,

i control valves as part of condensate cleanup and the

"B" MFP l

control system was deenergized for work being performed by the

instrumentation and control (I&C) department.

This equipment

,

is normally out of service for the existing plant conditions.

+

.

[

2.2.5 IVIC2 BOP Inverter i

The IV1C2 had been out of service since December 1989.

Its l

loads were being supplied from the backup power source which

is lost when. alternating current (AC) power is lost.

The

';

nonsafety-related inverter supplies power to secondary control and instrumentation, control board annunciation and indication.

During load shedding following the SI actuation, the backup power was lost and annunciation and some indication was lost on the secondary portion of the control board.

In

!

addition, power was lost to the pressure switches for MFP oil pressure.

This signal caused the condensate pumps to' trip as

'

designed.

The licensee is evaluating the availability of BOP i

inverters and operation with them out of service.

Procedures i

are being prepared to aid the operators when these inverters are lost.

,

j 2.2.6 FCV 1-8801A

>

When reccvering from the inadvertent SI, FCV 1-8801A did not appear to fully close when shut by the operators even though flow went to zero.

The valve is one of the high pressure injection isolation valves and it was previously known'that

the valve may not close fully with a high differential c

,

pressure across it.

This fact is covered by the " response not

obtained" (RNO) column of the emergency procedures which

.

instructs the o charging pump (perators to momentarily stop the centrifugal

CCP) to reduce the dp across the valve and

'

allow it to shut.

.

t, I

-..

- -. _ _ -

- -

-

.

-

.-

-

.

- -

.-- :

.

--

-

- -

.-.-.

- ---

..

-

..,.

-.

.

- r

.,.

i i-10-a

-

,

!

2.2.7 Emeroency Response Facility Data Printer l

'

Initially it appeared that the ERF data printer did not

!

receive data for the first four seconds of the event.

After

-

!

further review it was found that the data was available and

!

'

recovered.

'

!

2.2.8 P2500 Alarms

.

After the event, it was determined that numerous computer f

generated alarms were turned off because they were out of l

limits for the existing plant conditionc.

It was later

-

i

'

determined that even though the alarms were not generated, the

!

data was retrievable.

The practice of taking P2500 alarms out

'

of scan is covered-by administrative procedures, but the

!

licensee plans on providing additional guidance so that j

personnel check to ensure that necessary alarms are available

during plant startup and operation.

/,

2.2.9 IEB 3-1 Breakers Did Not Load Shed

- I i

'

During the recovery from the event it wasn't clear that breakers 1 CR and 2 BR on switchboard IEB3-1 tripped during i

the load shedding.from the SI actuation.

These breakers were

!

later verified to operate properly during a special-I (

performance of a portion of the Load Shedding preoperational test.

2.2.10 Control Board Recorders

'

During review of the ODA-108 Post Trip Review package, the inspector determined that the Hagan recorder charts included

.

in the package for parameters such as RHR heat exchanger inlet

.'

and outlet temperature and seal injection and return. flow offered little useful information due to the lack of time marks, paper scale and failure of some of the pens to ink.

New Yokogawa recorders installed for wide range hot and' cold

.

leg temperature and wide range pressure appeared to work properly and were more useful in event analysis.

'

2.3 Review of Safety Injection Initiation safety injection initiation at CPSES is provided by the standard Westinghouse SSPS.

The.SSPS consists of digital logics and mester and slave relays to' initiate various

>

'

engineered safety feature functions including SI-and containment ventilation isolation (CVI). Figure 1 provides a

,

-

schematic showing redundant Channel-A SI and CVI initiation logic for CPSES.

All logic components are included in the

<

standard Westinghouse SSPS except the " output relays" (MODE 5/6) switch, which is a modification at.CPSES.

.

,

--

, ---

.%-..

,,,,, -,,

,_

_

,,..

.. _,..,, _,

,,,.

,,,,,,,. _

.

,

,y

_

-- - _ _ - _ _ -. _..

- -. - - -. _.

-.-.

-

1'

SSPS - SI AND CVI INITIATION

-

.

l

+4 V DC

'

i

!

SI MASTER RELAYS i

!

i MANUAL SIINITIATION

,

i AUTOMATIC I

l

'

m SI ACTUATION

C l'

"

!

,

r l

K

'

.

CR-4 (FAILED DIODE)

l

o O MODES 1 I

I MODE's, THRU 4

" OUTPUT RELAYS"

'

!

5&6 O

SWRCH

!

,

!

.

!

MANUAL CVI I

i CONTAINMENT INITIATION.

,

p RADIOACTIViTYDETECTOR

,

o e

,

L (Contact Closed on High

T to PIG) Radioactivity or Loss of Power AUTOMATIC

,

CVIINITIATION i

CVI MASTER RELAY

-

.

SI-Safety injection

+48 V DC

-

CVI - Containment Ventilation isolation PIG - Particulate lodine Gaseous System -

,

.

S

'

.

..

.._______..___._._..._._,......,...-._,.,_,_...,.,.-_........-_._,.-.;

_

_.._

__

_

__. _

. -_ _

.

_

..

_. _

_ _

_. _

. :

e o,

!

-

.

I

,

The design function of the CR-4 diode is to allow a SI signal

!

to initiate CVI and to block a CVI signal from initiating SI.

!

With the MODE 5/6 switch closed in MODES 1 through 4

!

(representing circuit design without the modification) the

CR-4 diode will conduct (forward biased) to energize CVI

master relays when a manual or automatic SI actuation is

initiated.

In this circuit configuration, the CR-4 diode

[

should not conduct (reverse biased) and thus would not

-

energize the SI master relays when a manual or automatic CVI l

actuation is initiated.

!

This circuit configuration (switch closed) is necessary to meet the plant TS during MODES 1 through 4.

However, in i

,

MODES 5 and 6, there is a high likelihood of an inadvertent SI

!

actuation due to increased plant maintenance activities and t

associated abnormal lineups of systems.

This causes an

unnecessary challenge to the blocking function of the CR-4 l

relays, which should be avoided.

To prevent this type of inadvertent safeguard actuation, the I

licensee installed a MODE 5/6 switch to allow disabling those

safeguard features not required by the plant.TS when the plant

is in MODE 5 or 6. - The standard SSPS design did not provide

'

for disabling a portion of the relays; either-all must be

.

disabled when in the test mode or all must be operable.

The I

plant TS require Boron Dilution Mitigation System instrumentation to be operable in MODES 5 and 6 and CVI i

instrumentation operable in all modes.

The MODE 5/6 switch

'

allows these two systems to be operative while all other l

safeguards actuation logic in the redundant trains can be

'

tested by disabling one train at a time.

Additionally, an unwarranted challenge to the blocking function of CR-4 diodes can be avoided.

The containment radioactivity is monitored by the Particulate Iodine Gaseous (PIG) System, which provides an enargizing signal to the Containment Radioactivity Detector (CRD) in both trains of CVI when high radioactivity is detected in the containment or when the PIG monitor is-deenergized.

When there is no abnormal radioactivity in the containment the CRD is in the deenergized state and thereby does not initiate a

CVI actuation signal.

Since the power is removed from the PIG

monitor every week for filter change purposes, this results in

'

the energization of the CRD and thus challenges the blocking

'

function of the CR-4 diode.

Installation of the MODE 5/6 switch eliminates the weekly challenge to CR-4 diode in MODES 5 and 6 when the switch is kept open.

The team's evaluation of CPSES-design documents and test t

procedures for SSPS and Westinghouse documents on the diode reliability provide some evidence that the failure of blocking i

diode CR-4 in Train A SSPS logic driver card was a random i

sr

-

~

g

,

-,

--

-

--w-

,

v.+

-,

,,--,w

.-,,---r a

+

-~

--w

-,-*

-.

.

. - - -

.

..

.

-

.

..

'

.-

.

-12-

,

failure.

There is no evidence to believe that the-off and on I

switching of the MODE 5/6 switch, in accordance with the SSPS f

operating procedure in MODES 5 and 6, had caused weakening of I

the diode.

If the operation of the switch is considered as'

i the incipient cause of the diode failure, then both train i

blocking diodes _should have failed (and both trains of SI i

should have been initiated).

The switch operations-are l

similar for both trains, and both trains of CRD are energized when the PIG monitor is deenergized.

The team does not consider the periodic testing and normal operation of the SSPS to_be responsible for the diode failure.

The SSPS is in use I

at other Westinghouse power plants and no failures of this diode to perform its intended blocking function were identified by Westinghouse in support of the licensee's investigation.

The licensee performed a study to determine if the subject diode is used elsewhere in the SSPS for blocking signals from one safeguard system to the other.

Their evaluation showed'

that blocking of the CVI signals from causing SI initiation in

.

both trains was the only blocking function of these two diodes

'

in the SSPS.

2.4.

Operator Response

'

Based on the AIT team review, the operators'-response throughout the event was timely and appropriate.

The

,

operators entered EOP-0.0, " Reactor _ Trip or Safety Injection,"

,

immediately after determining that the event was a single train safety injection, and performed the applicable steps.

With the event occurring in MODE 4, and the Emergency Response Guidelines written for events occurring in MODES 1, 2, and 3, not all steps were applicable.

Many of the steps are i

verifications of automatic actions or indications.

These

!

verifications were performed promptly and effectively even though the actual indications did not correspond to what would

,

have occurred had a full safety injection occurred.

The operators took manual control of auxiliary feedvater flow approximately 2 minutes after initiation of the event because of the observed mismatch in_ flows to the steam generators.

Auxiliary feedwater flow to the No. 1 steam generator was

'

,

approximately 200 gallons per minute while the No. 2 steam generator was approximately 50 gallons per minute.

Auxiliary feedwater flow was terminated to the steam generators upon recognition of the high water level conditions in the steam generators.

'

The reactor coolant pumps were tripped when the No. 1 seal differential pressures began fluctuating between 180 psid and 200 psid.

The system operating procedure for the reactor coolant pumps, SOP-108, contains, a precaution that the reactor

>

-.

!

-

.-....-

.

.-

-_

-

.-

--

-

.'

v <

.

,

l-13-

.

,

i coolant pumps should not be operated with less than 200 paid l

across the No. 1 seal.

The operators were aware of this f

precaution and tripped the reactor coolant pumps accordingly.

The operators transitioned from EOP-0.0, " Reactor Trip or

!

Safety Injection," to EOS-1.lA, " Safety Injection

!

Termination," properly.

s The operators indicated to' the AIT that they felt very

[

comfortable with the Emergency Operating Procedures, even

!

during this event, and had been well prepared by the training

i department for dealing with abnormal system responses as a

result of their simulator training.

i The observations listed 'iere noted regarding operator

'

involvement prior to the tvent, subsequent operator actions

,

and perceptions.

These are discussed in more detail below.

l Several control room operators did not know the

{

.

containment radiation monitor filter change was in

'

progress.

}

'

The 50 F differential temperature limit between the steam

!

.

generator and cold leg was not believed to be applicable

by some operators unless the plant was solid.

!

Use of " Lessons Learned Information Forms"

\\

.

recommendations as operational or procedural guidance was i

a potentially uncontrolled practice.

i 2.4.1 Control Room Knowledge of the Radiation Monitor Filter Chance The Unit 2 supervisor had authorized the work to perform the filter change on the containment radiation monitor.

Both Unit

,

Supervisors and the Shift Supervisor were aware of the work to

-

be performed.

The reactor operator and the balance of plant operator were not informed that the work was going to be performed.

Consequently, they were not aware of the annunciator or containment ventilation isolation that would be

-

received as a result of deenergizing the radiation monitor.

The containment ventilation valves were already shut prior to authorizing the work so no change in valve position would have

'

occurred.

2.4.2 Steam Generator to RCS Cold Leo Differential Temperature Limit

,

The operators restarted a reactor coolant pump in accordance

.

I with Step 27 of EOS-1.lA, " Safety Injection Termination,"

Technical Specifications 3.4.1.3 and 3.4.1.4.1 state that a

,

reactor coolant pump should not be started in MODES 4 or 5 unless the secogdary water temperature of each steam generator is less than 50 F above each of the reactor coolant system

i I

.

.__

-

.

_ _

.

._

_

_ - _ _

_

_ _ - _. _

._

.

...

. e.

I

!

.

t

,

cold leg temperatures.

The control room operators were not sure if this limit applied in the plant-conditions present at

the time, or if it was only applicable when the reactor

coolant system was in a solid water condition.

They were

aware of the limit, and complied with it using the best

'

available indications.

Nothing in the TS or its bases

!

indicates that it is applicable only when operating solid.

i The operators' uncertainty apparently stems from their i

knowledge of the analysis for the specification which assumes

'

a solid water condition in the reactor coolant system.

The

licensee is still analyzing the data recorced after starting

the reactor coolant pump to determine if more than 50 degrees

. !

differential temperature existed during the pump start.

This

!

would have been unknown to the. operators due to the stagnant

!

or no flow condition of the reactor coolant system-at the time

of the pump start.- Step 27 of EOS-1-1A states to start a reactor coolant pump in accordance with Attachment 2 of that procedure.

This attachment does not list the 50 degree

. !

differential temperature limit as a prerequisite for starting the reactor coolant pump.

2.4.3 Use of Lessons Learned Recommendations t

The Emergency Response Guidelines'(ERGS) state that they are

!

applicaele for events initiating in MODES 1, 2, or 3.

If used in other modes, a step by step evaluation must be performed to

,

determine if the required action is applicable.for the current plant conditions.

This event occurred while in MODE 4.

Lessons Learned Information Form No. SR-90-54 included a i

recommendation that states:

"Use EOP-0.0, " Reactor Trip or Safety Injection," for all automatic or manual reactor trips

.

or safety injections from any condition, there are some steps

,

that are applicable."

These Lessons Learned Forms'are placed in a binder in the control room and routed to all operators to read and initial.

Once all operators have initialed as having

!

read the form, it is placed in a separate Lessons Learned file.

Any operator subsequently licensed or assigned to the

,

control room after the form is filed would not have derived any benefit from that recommendation without its incorporation into some other higher order document such as the ERGS or administrative procedure regarding the use of procedures, specifically the ERGS.

2.5 cold Overpressure Mitication System Response and Evaluation of Reactor Vessel Intecrity

,

i Prior to the event, the plant was in MODg 4 with RCS pressure i

of 380 psig, cold leg temperature of 250 F, and a bubble

'

established in the pressurizer.

The emergency core cooling system (ECCS) alignment at the time of the inadvertent safet?

injection signal (SIS) was as follows:

.

-

,

L

- --

-n-+

-

D.

,. -,, -

..,

, -.,, -. - ~,. -,,

-, -

,- -

,.,

nr

_ _ _ _ - - _ - _

..

'

,s c-15-

,

.

One of the two CCPs was locked out per Technical

.

Specification 3/4.5.3.

Both intermediate head safety injection pumps were locked

.

out.

All four accumulator paths were isolated.

.

RHR* Pump B was operating with the alignment to take

.

suction from the hot leg and discharge into the cold leg.

RHR Pump A was in standby with suction aligned to the hot

.

leg.

The ECCS alignment was in accordance with the appropriate TS limitationsandisintendedto1pitoverpressureeventswhen the RCS temperature is below 350 F.

The Cold Overpressure Mitigation System (COMS) prevents overpressurization of the RCS by opening the PORVs.

The pressure setpoints.of the two PORVs utilized by the COMS are governed by several factors.

The upper limit on the PORV pressure setpoint'is governed by Figure 3.4-4 of the TS, which specifies the maximum allowable PORV opening pressure for a given RCS temperature.

To prevent possible damage to the. reactor coolant pump seals due to pressure undershoot when the.COMS is actuated, the PORV pressure setpoints are staggered.

The PORV pressure setpoints are further lowered to prevent exceeding the TS limits due to instrument error.

These factors have resulted in a lower PORV-pressure setpoint of 425 psig and an upper PORV setpoint of 500 psig when the RCS temperature is less than approximately c

240 F.

This is substantially less than the upper' limit of 560 psig for this temperature range specified in Figure 3.4-4 of the plant TS.

The licensee has determined that the integrity of the reactor coolant pump seals is more important than the decrease in operational flexibility at these RCS, pressure and temperature conditions, and the increased probability of opening a PORV.

The events leading up to the opening of a PORV for several seconds have been discussed earlier in this report.

The restart of the reactor coolant pump at 3:56 p.m. (CST) local time with the secondary side hotter than the primary side caused the RCS pressure to increase to approximately 417 psig in about one minute.

At this time, the COMS opened PORV 1PCV-455A for approximately 7 seconds and the RCS~ pressure peaked at 420 psig.

The licensee determined that this opening pressure was within the allowed setpoint tolerance.

The RCS pressure-temperature limits for the Unit 1 reactor vessel,

,

which are based on the amount of neutron irradiation.

embrittlement projected for these materials'after.16 effective full power years of operation.

Since this plant has not operated yet, the pressure-temperature limits are very

,

.

-I

.

.-

-.-

.

.-.

..

-

._.

.*

O l

-16-

-

.

'

I l'l conservative.

The inadvertent centrifugal charging pump

injection into the RCS event and the lifting of the PORV event

'

did not result in pressures or temperatures that violated the plant's TS limits. -Therefore, these events did not adversely j

affect reactor vessel integrity.

j

,

2.6 Review of Pressurizer Cooldown Event

.

As a result of the inadvertent coolant injection into the RCS, i

the regeter coolant temperature in the pressurizer was reduced

!

by 180 F.and the rgactor coolant temperature in the surge line-

>

!

was reduced by 200 F.

The low'Be pressurizer and surge line

>

,

temperatures were 250 F and 230 F, respectively.

Coolant ~

injection into the reactor vessel causes a surge of water into

i the pressurizer.

Since the reactor coolant in the pressurizer

and surge line are stratified, the surge of water caused the t

,

change in recorded temperatures.

'

The pressurizer is fabricated from SA-533 plates, SA-508

\\

forgings, and weld metal.

The surge line is fabricated from

SA-376 stainless steel and weld metal.

The surge line and t

pressurizer materials have sufficient toughness at all the i

,

temperatures observed during the event to ensure system-

~

i integrity.

>

The temperature-drop in the pressurizer and surge line,

!

however, could have exceeded the limits in.the plant's fatigue

,

evaluation for safety injection events.

The licensee has

'

indicated that they will review the fatigue evaluation to-

determine whether this transient exceeded the fatigue design

,

!

parameters.

Since the fatigue evaluation assumes 60 safety l

injection events over the life of the plant, the event that occurred on March 12 will only affect the plant's calculated fatigue usage factor and should not affect the integrity of

.

the pressurizer and the surge line.

,

2.7 Expected Consequences if Event Occurred at Full Power

>

2.7.1 Expected Plant Response if Event Occurred at 100% Power

.

When the containment radiation monitor is deenergized, a

'

signal would be fed through the logic to initiate a Train A

!

safety injection with no direct reactor trip being generated.

A main feedwater isolation would occur resulting in a reduced i

rate of heat transfer from primary to secondary causing an

'

increase in RCS pressure.

The safety injection will cause a slight reduction in reactor powes: prior to a reactor trip as a

result of the high boron concentration in the injected water.

The reactor will trip on a low-low steam generator water level signal.

Also, the other motor-driven auxiliary feedwater pump

,

and the turbine-driven auxiliary feedwater pump will start.

,

The event is essentially a loss of feedwater event which is

.

I J

-

.

-

.-

-

. -.

..-. -.

-

-. - -. -

--.. - -

.

-

_

'

.." w l

.

,

!

-17-

'

,

i

well within the bounds of the FSAR analysis.

The fact that l

one train of safoty injection initiated actually lessens the

!

severity of the event by reducing reactor power initially and l

the continued addition of relatively cold water to the reactor

coolant system.

l 2.7.2 Expected Safety Iniection Flow and Cooldown Rate i

!

When the reactor is operated at full power with RCS pressure

!

above 2200 psig, all pumps that serve emergency core cooling i

function to meet the TS operability requirements are on-standby for automatic actuation upon receipt of a SIS.

The ECCS at Comanche Peak consists of two high head CCPs, two intermediate head safety injection pumps, and two low head RHR

'

pumps.

If this event had occurred at full power,-only the

CCPs would have been capable of injecting flow into the reactor vessel at full operating pressure.

Based.on the characteristic flow curve of the CCPs, the expected injection-I flow rate into the reactor vessel from the spurious actuation-

.

of one CCP against full operating RCS pressure is less than

,

'

200 gpm.

This expected CCP flow rate is considerably lower

,

'

than the CCP flow rate that occurred during the-March 12, 1990, event when the RCS pressure was less than 350 psig.

The licensee performed a best estimate analysis to predict the

!

expected consequences of a spurious actuation of Train A CCP

,

during full power operation, which is described below.. During

.

tha postulated event, the main feedwater isolation valves will

close as a result of the safety injection signal.

A reactor

'

trip may occur following a turbine trip due to the trip of the condensate pumps or the reactor may trip due to low-low steam generator water level caused by isolation of main feedwater to

.

>

the steam generators.

In such cases, the loss of main

'

feedwater will dominate the transient and will cause the RCS to heat up during the initial-transient and therefore increase l

j the pressure in the primary system.

Since the CCP injection would reduce the heatup effect due to loss of main feedwater, the postulated loss of main feedwater event analyzed in FSAR i

Chapter 15.2.7 would bound the effects of an inadvertent injection of Train A CCP at full power.

For a postulated spurious actuation of both trains of CCP during full' power, the scenario of events would be slightly different and a

.

reactor trip may occur on low pressurizer level.

However, this event would be bounded by the postulated inadvertent safety injection at full power event that is analyzed in FSAR

'

Chapter 15.5.1.

2.8 Use of the Simulator to Recreate the Event

!

Attempts were made to recreate the event under actual plant

'i conditions at the time of the event and again at 100% power

with an operating crew available to respond in each case, i

<

-.

.

..

.

..

.

..

--. _ ~

-

.-

-

.

-.

_

-

L.."

s

.

-18-

.

i While exact simulation was not possible, it did provide meaningful insights into plant and operator response.

l

2.8.1 Simulation of Actual Event conditions I

i Initial conditions were established that very nearly matched

'

the plant conditions present during the event.

The simulator I

computer model is not detailed enough to allow the simulation I

of the actual diode failure in the containment ventilation isolation logic.

The event was' simulated by placing the

Train B equipment that would be actuated on a full safety i

injection in the pull-to-lock or disabled position and a spurious safety injection signal inserted.

A crew of licensed

,

operators was observed responding to the event.

While several

!

equipment response differences occurred as a result of the

inability to exactly mods 1 the actual event, the operators'

i

responses in the simulator were very similar to those taken in i

the control room during the actual event.

Upon entering j

i EOP-0.0, " Reactor Trip or Safety Injection," the operators in j

the simulator transitioned to EOS-1.lA, "SI Termination," and l

terminated the safety injection within 2 minutes of the time l

of the operators' response to the actual event.

'

2.8.2 Simulation of the Event at 100% Power

'

Initial' conditions were established that simulated 100% power

'

operation.

Again the Train B equipment was disabled to the

'

extent possible and a safety injection signal was actuated.

The direct reactor trip signal from the safety injection

'

signal was not disabled causing the reactor and main turbine

'

i to trip immediately upon insertion of the safety injection.

l The main turbine and main feedwater pumps also tripped immediately upon insertion of the safety injection signal.

The auxiliary feedwater control valve malfunction that

'

occurred during the actual event was not modeled during the simulation causing the No. 1 and No. 2 steam generators to receive approximately equal feed flow, which did not occur during the actual event.

The reactor coolant pumps were not required to be tripped during this simulation because the

,

No. I seal differential pressures never approached 200 psid.

{

Response of the operators was again appropriate.

2.9 Licensee Investigation of the Event Immediately following the inadvertent safety injection event on March 12, 1990, the licensee issued operations Notification and Evaluation (ONE) Form FX 90-1211.

The ONE form is

initiated to report potential adverse conditions and to provide for the administration, screening for operability and reportability, identification of corrective action type, resolution, and closure of the potential adverse condition.

t Licensee Procedure No. STA-422, " Processing of Operations

]

j

-

-.

.

_

.

. --

-,

_

.--

.,,.

.,,

,.

.

1 :

".

,.

I-19-

.

..

Notification and Evaluation (ONE) Forms" provides the requirements for initiating ONE forms.

The management assessment for this ONE form determined that an evaluation team would be required because a coordinated effort was needed to evaluate the incident and to recommend necessary corrective actions.

Within one hour of the event, the plant manager had assigned an evaluation team leader and action was initiated to.

develop a charter for the team.

The initial charter for the team was to assure completion of certain activities prior'to reentry of the plant into MODE 4.-

These actions were~ approved during a special Station Operations Review Committee (SORC)~

meeting conducted at 8:30 a.m. (CST) on March 13,.1990.

The licensee evaluation conducted their-activities in accordance with Procedure STA-423, " Evaluation Team," which' included

-

provision for interface with the NRC Augmented Inspection Team.

.

A SORC meeting conducted at 1:53 p.m. (CST) on March 13, 1990, documented the review and acceptance of the evaluation team charter with comments to be added in the final evaluation team report.

A SORC meeting conducted at 9:40 a.m.

(CST) on March 14, 1990, included a presentation by the evaluationLteam leader of an update on the evaluation team activities.

This included a statement that all actions required for entry.into MODE 4 had been completed.

The AIT arrived on site the morning of March 15, 1990, and an entrance meeting was conducted with licensee management _at 7:45 a.m.

(CST).

Following the entrance, the licensee presented a status of their review of the event which included a sequence of events, evaluation team charter, and a status of completion of actions by the evaluation team.

The licensee also indicated that the cause of the event had been determined to be a shorted blocking diode in the SI system-logic.

This

is discussed in Section 2.3 of this. report.

The AIT then conducted an independent review of the events and licensee investigation of the event.

No significant observations were made by the AIT_that had not been or were not planned to be evaluated by the licensee's team.

The licensee identified the following actions to be addressed prior to entering MODE 4.

Complete initial post trip review.

-

Complete rework on the failed diode and testing to verify

-

that the diode circuitry blocks safety injection

actuation when the initiating events were recreated.

.

_ _ _ _ _ _ _ _ _ _ _ _ _. _..

- - - - -

~

.

-.

-. -

.

-

.

bo

..

,

-20 -

l

.

..

,

'

Verify that required P-2500 alarms were' turned on.

-

>

'

l Verify that the Sequence of Events Recorder was in

!

-

service to ensure operation of the."First Out i

Annunciation."

!

.

Verify that the Gaitronics "All Station Page was j

-

'.

functional.

.

j Complete initial' evaluation of the pressurizer heatup.

,

-

,

Preclude the deenergizing of the containment radiation

-

monitor for filter replacements until an appropriate

methodology has been determined.

I The licensee's evaluation team had.not completed their review.

of all aspects of the event at the conclusion of the augmented inspection, but a review of planned actions by the AIT determined that.a thorough evaluation was being conducted by

the licensee.

A final report by the licensee's evaluation team was to be issued by April 1, 1990.

Two potentially j

significant items to be addressed by the licensee included the

,

I design of the auxiliary feedwater flow control system and the

design process problem where the MODE 5/6 switch was not

included or referenced on some affected drawings.

All of the

!

,

l other items had been initially evaluated by the licensee and

'

planned actions appeared appropriate.

2.9.1 Safety Review Committee /Ouality Assurance Department

'

Involvement in Investication The licensee has included the quality control (QC) process in

the analysis of this event by placing a QC inspector.on the site evaluation team and by including the Quality Program 1'

manager in the SORC oversight process of the site team's progress and recommendations.

The QC team member-was in the l

,

control room within minutes of the event occurrence and played an active role in the development of the test procedure that verified the cause of the event and will be responsible that the tasks performed and reports written conform to the' proper plant procedures.

The SORC involvement included approval of the team charter and approval of necessary corrective actions

prior to continued plant startup.

2.10 Discussion on Potential for Reoccurrence of This Event i

The licensee has taken two actions to reduce the potential for reoccurrence of this event.

The first action was a revision to the SSPS surveillance procedures to include testing the

'

blocking diode in each train that normally prevents the CVI.

e signal from reaching the safety injection relays.

Each SSPS train will be tested at least every 62 days on a staggered

- -

. -.

.-.

. -

-. -

.. -.

--

.

.-

..-

...

__

_ _ _ _ _

.

__

_

.

~

l

v

.

.-

.

'21-

-

,

test basis, providing a frequent check of the blocking

!

i capability of the diode.

,

b The second action taken by the. licensee was to change the procedure for checking / changing the filter elements in the containment PIG monitor.

The procedure requires deenergization of the PIG monitor, which causes a CVI signal, i

,

!

and, therefore, challenges the isolation function of each SSPS

!

blocking diode.

The PIG monitor filter replacement procedure (RPI-312) has been modified to require.the removal of. fuse 1

!

,

in Auxiliary Relay Rack 1 (1-CR-03) and Fuse 5 in Auxiliary.

Relay Rack 2 (1-CR-04), before the PIG monitor skid is

deenergized.

The removal of these two fuses before the. PIG i

monitor is deenergized will prevent the CVI signal from being i

generated.. The PIG monitor-shall be considered inoperable as

'

soon as the first of these fuses are pulled and.the containment purge isolation valves will be maintained. closed.

-

until the PIG monitor-is returned to operation.

This procedure change will reduce the frequency of challenges

to the blocking function of-the two diodes in question by a factor of 4, leaving the monthly test of the containment

<

radiation isolation signal as the only challenge to the-

!

diode's blocking function.

The licensee is currently i

evaluating possible modifications to this system to further

.

!

reduce or eliminate the potential for a radiation isolation signal causing an inadvertent SI signal.

,

l 3.0 Findinos of Fact

'

!

j The AIT members reached the following findings of fact:

'

An inadvertent actuation of Train A safety injection

.

occurred at CPSES Unit 1 on March 12, 1990, with the unit in operational MODE 4.

Plant conditions ag the time of event were RCS

.

temperature at 250 F, RCS pressure at 380 psig and steam generator levels above normal operating levels in preparation for performance of a startup test.

,

'

.

The licensee had completed initial core loading but the

.

'

unit had not been taken critical.

Sequence of Events recorder was out of service-when the

.

event occurred which also disabled the,"First Out" annunciators.

)

Several P2500 alarm points were turned off. prior to.the

"

.

event because they were out of limits for the existing

. plant conditions.

'

,

e

-.

.

-

-mm

..

,. _ _ - - -.

.

..

_ _ _,

,

,.,,,. _

,

%.

..._,-.e.,

,

..,,_

. _,.,

'l

.,. ~ :.

'

..

-22-l.

.

A balance of plant inverter.(IV1C2) was out of service at

.

the time of the event.

Its loads were being supplied from the backup power source'which is lost when AC power is lost.

Control room recorders were found to lack time markings

.

and. exhibited poor inking capabilities.

All four RCPs were running at the time of the event.

.

The condensate system was running.in long. cycle cleanup

.

at the' time of the event.

Operators responded to the event using Emergency

.

Procedure EOP-0.0, " Reactor Trip or Safety Injection."

Operators verified that all appropriate Train A safety.

.

equipment which was in service had started or shifted to the safety configuration following the event.

An unexpected trip of both condensate pumps occurred

.

following the event.

The auxiliary feedwater system was initiated by the event

.

and was secured by the operators.

The level in No. l~SG reached the Hi-Hi trip setpoint before flow was terminated.

Operators secured all 4 RCPs following the event because

.

of fluctuating No. 1 seal differential pressure.

Licensee declared a UE per their emergency response

.

procedures following the safety injection.

Operators reset the SI signal and SI sequence per

.

procedure and running equipment was secured.

i Safety injection flow was terminated within 13 minutes of'

.

the event after injecting approximately 8000 gallons of water from the refueling water storage tank.

Pressurizer level peaked at about 93 percent.

.

Operators reestablished normal charging and letdown and

.

pressurizer level was restored to normal.

State and local officials and NRC were notified of the UE

.

as required.

ONE Form FX 90-1211 was initiated by the licensee to

.

document the event and to cause a corrective action

,

investigation of the event.

'

,

=.

-.

,

-

-

-23-

,

The unit was declared to be in MODE 5 about 53 minutes

,

after the eveng based on core exit thermocouples indicating 188 F.

Within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of the event, the plant manager had

.

determined that an evaluation team would be assembled to review this event.

OperatorsopenedallSGatmosphericreliefvagvesto

.

ensure the secondary of the SGs was within 50 F of the primary temperature in preparation for restarting RCPs.

Operators started RCP 1-04 and a low temperature

.

overpressure protection relief valve opened for_about-7 seconds because of an increase in RCS pressure.

The 2 low temperature overpressure protection relief

.

valves setpoints are staggered with the lowest set at 425 psig with RCS temperature less than approximately c

240 F.

'

Licensee terminated the UE about 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and 23 minutes'

.

after the event.

Operators started RCP 1-01 and RCS pressure decreased

.

about 20 psig.

State and local officials and NRC was notified of the

.

termination of the UE.

SORC approved a charter for the licensee's evaluation

.

team which included actions to complete prior to reentry into MODE 4 and follow on action.

The licensee had not completed investigation of the event'

.

at the conclusion of the AIT, but several actions were complete or underway as a result of their investigation.

!

The licensee concluded that the event initiator was a

'

.

shorted diode in the SI logic circuitry which allowed a containment ventilation isolation signal to back feed and initiate a SI.

The containment ventilation isolation signal was

.

initiated when a containment radiation monitor was deenergized to allow a filter replacement.

The licensee concluded that the cause of the tripping of

.

the condensate pumps was a loss of control power when load shedding occurred with the BOP inverter out of service.

.

l

.

-

[

o g..

.

-24-s...

.

The licensee concluded that-if this event had occurred at

.

full power it-would' essentially be equivalent ~to a loss of feedwater event which is^ bounded by safety analysis.

_

The licensee concluded on the basis lof a letter:from

.

Westinghouse and their own-review that the pressurizer heatup rate during this event was not a concern.

.The licensee concluded that the auxiliary feedwater: flow.

.

control system response was.notfappropriate during this

,

event.

Further evaluation and-testing of the system was-being. conducted by the licensee.

The licensee concluded that a previous desi'gn

.-

modification which added the MODE 5/6. switch in the SI logic was not referenced or. incorporated in'all.

applicable design documents.

4.0 Conclusions The following conclusions were reached as a-result of-the AIT review of this event and licensee actions-i The AIT concluded that the licensee's investigation of

.

this event by an evaluation team was-prompt:and thorough.

The AIT concluded that items identified by the licensee

.

i to be completed prior-to' reentry into! MODE 4 and for-d further evaluation were appropriate.

'

The AIT concluded that operator response to the eventLand'

.

use of procedures was good.

One. area.noted where-training agd procedure improvements might be appropriate a-i was the 50 F differential temperature;(dt); requirement for starting RCPs.

In this instance, although the operator used the best available-information for determining the dt, the AIT could not conclude that the

limit.was not exceeded.

The AIT concluded that.this would be less of a problem when some' core decay heat is established after'a period of plant operation with

!

natural circulation conditions.

'

The AIT concluded that the licensee had developed a

.

thorough understanding of the sequence of events associated with the-inadvertent single train injection and plant and equipment response.

The AIT concluded that appropriate notifications were

.

made to the NRC regarding this event.

The AIT concurred with the licensee's conclusion that

.

this event at full power-would have been essentially

{

l l

_ _..

..-

....... - - - -

-

.

--

.-..

..

.

-

f F..

i-25-e.-

.

.,.

.

equivalent to a-loss of feedwcne went we.ch is' bounded-by safety analysis and plant decign.

,

The-AIT concluded that the coodlawn.ste and flows

.

expected from an inadvertent SI ac power would not be a Concern.

The AIT' concurred with1the licensee's conclusion that the-f l

.

initiating cause of.this event was a shorted diode ~in the

'

SI logic which allowed a containment ventilation isolation signal to back feed and initiate a-single train

,

SI.

The AIT conclude'd that the plant and available equipment-

.

responded >as expected.during the event with the exception of: equipment. identified in Section 2.2..

This equipment-t response was evaluated:by the licensee and had minimal impact on the plant and operator response-to the event.

The-~AIT concluded that the cold overpressure mitigation ~

.

system (COMS). responded as designed during this event..

The PORV setpoints were deemed appropriate to protect.-the RCS during low temperature conditions and to prevent

,

possible damage to the reactor: coolant pumps seals because of' pressure reduction when'the'c0MS is actuated.-

The AIT-concluded.that followup.-inspections should be

.

performed to review the. appropriateness of licensee ongoing actions from.their evaluation team findings..In

particular, this should include'the auxiliary feedwater flow control system problem, the failure to reference or incorporate the MODE 5/6 modification,on certain. design documents, and any follow on; actions planned by the i

licensee to further reduce the. potential-for. reoccurrence 1 of this event.

Followup inspections should also'be conducted to review licensee control and use of " Lessons Learned" documents.

The AIT concluded that on the-basis.of the standard

.

Westinghouse SI logic design that this event.could occur at'other Westinghouse facilities if a similar diode

,

failure were to occur.

-

,

I i

e

-... -

--

.

..

.

I

..

!

.

_.

-.

.

_

_ _.

.

e ji is.

n

..

j a

!

t

^ ;-

'

~26-

,

.q l

5.0 Person Contacted L

L. Agee, Reactor: Operator, TU Electric f

!:

C. Alexander, Reactor. Operator, UNJ Electric-

'

T. Bain,; Shift Supervisor,_TU~ Electric

.

i

.

J.

W. Beck,'Vice President,1 Nuclear Engineering, TU Electric =

K.

L. Bishop, Consultant

,

u M. R. Bl.evins, Manager of Nuclear Operations Support,

.

,

L TU Electric

!

T. Broughton, Unit Supervisor, TU-Electric.

i

.

,H.

D. Bruner, Senior.Vice President,'TU Electric

'

C.'G. Creamer, Manager, Unit ~1 Completions Engineering,_

TU Electric l (

,

G. Davis, Technical 1 Support Engineer, TU Electric'

E. L. Dyas, Training-Specialist,;TU Electric'

A i.

J. Ellard, Training' Simulation Supervisor, TU Electric.

S. L..Ellis, Manager of Performance and Test,LTU Electric

,

J. L. French, Independent' Advisory Group-R. Gibbs, Engineer, TU: Electric e

B.

Gill,-Quality Assurance, TU Electric'

l i

J.

Greene, Licensing Engineer, TU' Electric

W. G. Guldemond, Manager of" Site Licensing, TU Electric i

,

J. C. Hicks, Licensing Compliance Manager, TU' Electric

C.

B. Hogg, Chief Engineer, TU Electric'

i r

T. Jank, Shift Supervisor Assistant, TU Electric l'

S. Johnson, Engineer,~TU Electric

_

.

A. Jnsain, Director, Reactor Engineering, TU Electric i

J. J. Kelley, Plant Manager, TU Electric y

C,J.

Laughlin, Instrumentation: End' Control Manager,

'

TU Electric

'

M. Lucas, Electrical Engineering Supervisor, TU~ Electric

.

R. Martinez, Unit Supervisor, TU Electric

D. M.'McAfee, Manager, QA, TU-Electric

J._F. McMahon, Manager Nuclear Training, TU Electric

W. R. Morrison, System Engineering, TU-Electric'

E. F. Ottney, Project Manager, CASE.

D. Palmer, Plant _ Evaluation, TU Electric

+

S. S. Palmer, Project Manager, 1NJ Electric I

P. Raysircar, Deputy Manager, Project 1 Engineering, TU Electric

,

M. J. Riggs, Plant Evaluation Manager, Operations,

}R

'

TU Electric J. Salsman, Emergency Planning, TU Electric

.

[

A. B. Scott, Vice President, Nuclear Operations, TU Electric B. Smith, Unit Supervisor, TU Electric

P. B. Stevens, Manager of Operations Support Engineering

C.

L. Terry, Manager of Projects, TU Electric

-

0 _L.

Thero, Consultant, CASE R. Wheeler, Reactor Operator, TU Electric

-

l l

Denotes those persons who attended the exit interview on L

March 19, 1990.

The CPPD NRC staff also attended the exit interview.

t

.,i

-

..

.

. -.

.. -

_ -. -., -

.. -,.

,

-

_

-

--

_

_ - - -

U n

~

. *

:

,

.

v.

,-

'

,

'l L.

6.0 List of Acronyms

.

,

The following list of acronyms used in this report are j'

provided.as an aid to the reader.

AC Alternating Current

'

ADV Atmospheric Dump Valve AFW Auxiliary Feedwater System.

'

L AIT Augmented Inspection Team-ARV

' Atmospheric Relief Valve-

,

BOP Balance.of: Plant.

j CCP Centrifugal Charging Pump CCW Component Cooling Water

'

CET Core' Exit Thermocouple

,

i CPPD Comanche Peak Project' Division

..

COMS Cold Overpressure Mitigation System-(same as LTOP).

'

CPSES Comanche Peak: Steam Electric Station-

CR Control-Room

.

CRD Containment Radioactivity. Detector l

CSP Containment Spray Pump i

CNTS Containment Ventilation Isolation Signal

.

dp Differential Pressure

,

'

at Differential: Temperature, i

ECCS Emergency Care Cooling: System

,

i EDG Emergency Diesel Generator

!

l.

ENS Emergency Notification System-

!

'

EOP Emergency Operating, Procedure ERF Emergency. Response Facility l

ERG Emergency Response Guidelines

[

FCV Flow-Control-Valve 1-FSAR Final Safety Analysis Report-

,

HPI High Pressure Injection Ex Heat Exchanger IEC Instrumentation and! Control j

LTOP Low Temperature Overpressure Protection (same.as l

COMS)

MDAFRP Motor Driven Auxiliary Feedwater Pump MFP Main-Feed Pump NOL Normal' Operating Level NRC Nuclear. Regulatory Commission NER Nuclear Reactor-Regulation

,

!

,

ONE Operations-Notification and Evaluation-PCV

' Pressure Control Valve-PIG Particulate' Iodine Gaseous PORV Power Operated Relief Valve j

QC Quality Control

- '

RCP Reactor Coolant Pwnp RCS Reactor Coolant System i

,

RBR Residual Heat Removal System

~

RNO Response Not Obtained RTD Resistance Temperature Detectors

- i a

+

-

...~ -.

.

.~.6

,

....., -..,.. -. -,

-,

,..-

-

- -

,,

...p;.

.i

'

,

b

*

23-

!

',

.,

-

t RWST-.

Refueling Water, Storage Tank'

SG Steam Generator;.

. :

"

SI Safety Injection / Engineered' Safety Features

.

Actuation.

.

SIS Safety Injection Signal

!

SOE

. Sequence of. Events

.

..

{

SORC'

Station Operations' Review Committee

-

!

SSPS Solid State Protection System i

-

STA Shift Technical' Advisor

TS

. Technical Specifications

TSC

. Technical. Support Center.

.

"

,'

UE Unusual Event-d

't

.

!

'

..

!

'

,

t L

!

)

i I-

!-

e l

' l q

.

^l

t l:

is

,

t

.

m

-

,

.

.-

s v-

-

x w

w - =

e-e'

v t e Inspection Report - Comanche Peak - 1990011
80 \| 81 \| 82 \| 83 \| 84 \| 85 \| 86 \| 87 \| 88 \| 89 \| 90 \| 91 \| 92 \| 93 \| 94 \| 95 \| 96 \| 97 \| 98 \| 99 00 \| 01 \| 02 \| 03 \| 04 \| 05 \| 06 \| 07 \| 08 \| 09 \| 10 \| 11 \| 12 \| 13 \| 14 \| 15 \| 16 \| 17 \| 18 \| 19 \| 20 \| 21 \| 22 \| 23 \| 24 \| 25 \|
1990 Quarterly Integrated 1Q (0) 2Q (0) 3Q (0) 4Q (0) Assessments Mid Cycle End of Cycle 7(0) 9(0) 10(0) 11(0) 12(0) 13(0) 14(0) 15(0) 16(0) 18(0) 20(0) 21(0) 22(0) 23(0) 24(0) 25(0) 26(0) 28(0) 29(0) 30(0) 31(0) 32(0) 33(0) 34(0) 36(0) 37(0) 40(0) 41(0) 43(0) 47(0) Security Operator Exams Emergency Planning Other

IR 05000445/1990011

Text

Navigation menu

Search