ML051460187
| ML051460187 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 04/17/2005 |
| From: | - No Known Affiliation |
| To: | NRC/FSME |
| References | |
| FOIA/PA-2005-0207 | |
| Download: ML051460187 (3) | |
Text
Millstone FAQs - 'A' Train Solid State Protection System Safety
) Injection Actuation signal resulting in a reactor trip.
- 1. Did a main steam safety valve (MSSV) stick open? Was there an excessive cooldown?
Based upon an engineering evaluation the MSSV operated as expected given the temperatures and pressures encountered during the event. No MSSV stuck open. The reactor coolant system temperatures and pressures were as expected for the plant conditions. No excessive cooldown was encountered. -
- 2. Was there a radiological release?
There was not a radiological release above normal operating limits. The water from the charging valves packing leaks was from the RCS and the refueling water storage tank and contained little if any gaseous activity. No indications were seen on the control room indicators.
- 3. Did the pressurizer safety valves lift?
Engineering concluded that the pressurizer safety valves did not lift based upon the pressures in the system below the lift setpoint and the expected response of the system to the opening of the pressurizer power operated relief valves (PORVs) as designed.
. v
- 4. Was there an unisolable steam leak?
No, the steam leakage was from a SG safety valve thatfclosed as designed when the system pressure decreased.
- 5. Did the operators respond appropriately?
Initial review of the event indicates that the operators responded appropriately to the transient. The operators followed their procedures and terminated the transient within the bounds of the design analysis. A team will investigate operator performance in more detail to extract lessons learned.
- 6. Was the training and were the procedures adequate and adequately implemented?
The training and procedures were adequate and appropriately implemented based upon initial review. The ERT has identified items that will improve the simulator response and several procedural enhancements as is expected with an event that we have not experienced before.
7.. Did plant systems operate as designed?
Most systems operated as designed. The steam driven auxiliary feedwater pump started and immediately shutdown, but the two redundant motor driven auxiliary pumps did function as designed. Packing leaks occurred on two charging line valves. Following the plant cooldown the pressurizer PORVs leaked by when shut and were isolated. We
Millstone FAQs - 'A' Train Solid State Protection System Safety Injection Actuation signal resulting in a reactor trip.
were unable to sample "A" & "D" S/G for activity due to issues with the blowdown control valves. The cause of these issues is under investigation.
- 8. Was anyone injured or contaminated?
No one was injured and one minor shoe contamination was reported.
- 9. Do you understand the cause of the trip?
There were no actual plant conditions that warranted a safety injection or reactor trip. The root cause investigation has not been completed at this time, yet we have evidence that a fault in a solid state logic card caused the safety injection and subsequent trip.
- 10. Do you understand why there was a half signal to SI/MSI?
Yes! The design of the solid state protection system includes a common manual actuation switch and redundant trains of protection. The fault in the solid state logic card occurred such that the multiplexed data lines for this Universal Logic Board were not affected, thus only train "A" safety injection and main steam isolation actuation occurred. The operators subsequently actuated train "B" as required by procedure.
- 11. Is this event similar to Three Mile Island?
No! During this event core temperatures were'normal, reactor coolant system pressures and temperatures were normal, and no loss of coolant accident occurred. In addition, operator responses were guided by symptom based emergency operating procedures designed to prevent TMI type accidents. Improvements in plant design, training, and operation since 1979 create many additional barriers to prevent major events.
- 12. If the valves closed properly, why was there so much steam?
When the main steam isolation valves close, the energy still needs to be removed from the system. The safety valves provide this function as part of the station design. The amount of steam is dependent on power history and conditions prior to the steamline isolation. Even small amount of steam transitioning from -1000 psi to atmospheric pressure appears to be a large amount.
- 13. Hasn't this happened before at Millstone? (Unit 2 Notice of Unusual Event, March 7, 2003)
Millstone unit 2 & 3 are different designs Combustion Engineering and Westinghouse respectively. Although they are both pressurized water reactors the protection and control systems have many differences. Also system differences such as the fact that the charging pumps are of a different design cause different system responses.
See FAQ 14 for niore information.
- 14. How is this event different?
Millstone FAQs -. 'A' Train Solid State Protection System Safety Injection Actuation signal resulting in a reactor trip.
The cause of the event is different in that one was a solid state device versus a relay and the mechanism of the fault for each was different.
The charging system reliefs failed on unit 2 and packing failed on unit 3. Pressure did not rise on unit 3 to the levels experienced on unit 2.
Two steam valves on unit 2 did not divert steam, yet the similar valves on unit 3 performed as designed.
- 15. In 2003, the unexpected lifting of charging system safety valves at Unit 2 triggered a notice of Unusual Event? Was this event similar? Were the charging system safety valves replaced at Unit 2? If not, why?
Charging systems have relief valves that open and close at a set pressure versus safety valves that have different characteristics. The fact that the charging systems are of different design creates obvious differences making the events dissimilar. The charging relief valves were totally redesigned on unit 2 as well as a number of system changes including pulsation dampers and rerouting piping from the reliefs to the sump.
- 16. Failure of the turbine driven auxiliary feedwater pump at Unit 2 was the subject of NRC scrutiny in 2001. Does the same condition exist on Unit 3? If so, why wasn't it fixed at the same time? What is the difference between the two?
The investigation into the cause of the turbine driven auxiliary feedwater pump at Unit 3 is not completed at this time.
- 17. What other safety systems were involved in Sunday's plant trip? Have these systems been the subject of NRC scrutiny in the past?
As part of the all RCEs we analyze the operating experience associated with the systems involved. That review has not been completed at this time.
- 18. Do these sudden trips cause damage to the plant? If so, what kind of damage would they cause?
No! The plant is designed to sustain a load rejection at full power.