ML17311B333

LER 95-013-00:on 951201,AFW Sys Was Outside Design Basis of Plant.Caused by Design Error.Performed Assessment to Demonstrate That Existing Condition Does Not Pose Addl Safety concerns.W/951231 Ltr

ML17311B333
Person / Time
Site:	Palo Verde
Issue date:	12/31/1995
From:	Grabo B, James M. Levine ARIZONA PUBLIC SERVICE CO. (FORMERLY ARIZONA NUCLEAR
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
192-00955-JML-B, 192-955-JML-B, LER-95-013, LER-95-13, NUDOCS 9601160059
Download: ML17311B333 (16)

Text

~CATEGORY j.REGULATO Y INFORMATION DISTRIBUTION STEM (RIDS)ACCESSION NBR:9601160059 DOC.DATE: 95/12/31 NOTARIZED:

NO DOCKET¹FACIL:STN-50-528 Palo Verde Nuclear Station, Unit 1, Arizona Publi 05000528 AUTH.NAME AUTHOR AFFILIATION GRABO,B.A.

Arizona Public Service Co.(formerly Arizona Nuclear Power LEVINE,J.M.

Arizona Public Service Co.(formerly Arizona Nuclear Power RECIP.NAME RECIPIENT AFFILIATION

SUBJECT:

LER 95-013-00:on 951201,AFW sys was outside design basis of.plant.Caused by design error.Performed assessment to demonstrate that existing condition does not pose addi safety concerns.W/951231 ltr.DISTRIBUTION CODE: IE22T COPIES RECEIVED:LTR

)ENCI i SIZE: TITLE: 50.73/50.9 Licensee Event Report (LER), Incident Rpt, etc.05000528 NOTES:STANDARDIZED PLANT RECIPIENT ID CODE/NAME PD4-2 PD INTERNAL: ACRS AEOD/SPD/RRAB NRR/DE/ECGB NRR/DE/EMEB NRR/DRCH/HICB NRR/DRCH/HQMB NRR/DSSA/SPLB RES/DSIR/EIB EXTERNAL: L ST LOBBY WARD NOAC MURPHYPG.A NRC PDR COPIES RECIPIENT LTTR ENCI ID CODE/NAME 1 1 HOLIAN, B 1 GD~B B 1 FILE CENTER 1~~BB 1 NRR/DRCH/HHFB 1 NRR/DRCH/HOLB NRR/DRPM/PECB 1 NRR/DSSA/SRXB 1 RGN4 FILE 01 1 1 LITCO BRYCEPJ H 1 1 NOAC POOREPW.1 1 NUDOCS FULL TXT COPIES LTTR ENCL 1 1 2 2 1 1 1 1 1 1 1 1 1 1 1 1 1 1 2 2 1 1 1 1 NOTE TO ALL"RIDS" RECIPIENTS:

PLEASE HELP US TO REDUCE WASTE!CONTACT THE DOCUMENT CONTROL DESK, ROOM OWFN SD-5(EXT.415-2083)TO ELIMINATE YOUR NAME FROM DISTRIBUTION LISTS FOR DOCUMENTS YOU DON'T NEED!FULL TEXT CONVERSION REQUIRED TOTAL NUMBER OF COPIES REQUIRED: LTTR 26 ENCL 26 4k~1 JAMES M.LEVINE VICE PRESIDENT NUCLEAR PRODUCTION Arizona Public Service Company PALO VERDE NUCLEAR GENERATING STATION P.O.BOX 52034~PHOENIX.ARIZONA 850?2-=i3 192-00955-JML/BAG/DLK December 31, 1995 U.S.Nuclear Regulatory Commission ATTN: Document Control Desk Mail Station-P1-37 Washington, DC 20555-0001

Subject:

Palo Verde Nuclear Generating Station (PVNGS)Units 1, 2, and 3 Docket Nos.STN 50-528, 50-529, 50-530 License Nos.NPF41, NPF-51, NPF-74 Licensee Event Report.95-013-00 Attached please find, Licensee Event Report (LER)95-013 prepared and submitted pursuant to 10 CFR 50.73.This LER reports a condition where an intermediate sized steam line break accident scenario was discovered that could result in the loss of both steam generators as an available heat sink to remove decay heat under limited accident conditions.

In accordance with 10 CFR 50.73(d), a copy of this LER is being forwarded to the Regional Administrator, NRC Region IV.If you have any questions, please contact Burton A.Grabo, Section Leader, Nuclear Regulatory Affairs, at (602)393-6492.Sincerely, JML/BAG/DLK Attachment (all with attachment) cc: L.J.Callan K.E.Perkins K.E.Johnston INPO Records Center 960ii60059 95i23i PDR ADOCK 05000528 S PDR zg>p

LICENSEE EVENT REPORT (LER)ACIUTY NAME (1)Palo Verde Unit 1 DOCKET NUMBER (2)PAGE (3)0 5 0 0 0 5 2 8 1OFO'6 TLE (4)Accident Condition Identified Puts Auxiliary Feedwater Beyond Component Level Design Basis EVENT DATE 5 LER NUMBER 6 REPORT DATE 7 OTHER FACIUTIES INVOLVED 6 MONTH 1 2 DAY YEAR YEAR 0 1 9 5 9 5 SEQUENTIAL NUMBER 0 1 3 REVISION NUMBER 0 0 MONTH DAY YEAR 1 2 3 1 9 5 FACIUIY NAMES Palo Verde Unit 2 Palo Verde Unit 3 KET NUMBERS 0 5 0 0 0 5 2 9 0 5 0 0 0 5'3 0 OPE RATING HIS REPORT IS SUBMITTED PURSUANT TO THE RED UIREMENTs 0F 10 cFR 4: (chedt one or more of the fosowng)(11)MODE (6)POWER LEVEL(10)9 9 20.402(b)20.405(aX1Xi) 20.405(sX1X i)20.405(aXIXB) 20.405(sXI Xiv)20.405(aXI Xv)20.405(c)50.36(cX I)50.36(cX2) 50.73(aX2XI) 50.73(aX2Xn) 50.73(aX2XB)

LICENSEE CONTACT FOR THIS LER (12)50.73(aX2XN) 50,73(aX2Xv) 50.73(aX2Xvi) 50.73(aX2XvtnXA)

M.73(sX2XvntXB) 50.73(aX2Xx) 73.71(b)73.71(c)OTHER (Spectfy in Abstract below snd in Text, NRC Form Burton A.Grabo, Section Leader, Nuclear.Regulatory Affairs ELEPHONE NUMBER EA CODE 6 0 2 3'9 3-6 4 92 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT (13)CAUSE SYSTEM COMPONENT MANUFAC TURER REPORTABLE TT)NPRDS SYSTEM COMPONENT MANU FAC TURER REPORTABLE

', TO NPRDS SUPPLEMENTAL REPORT EXPECTED (14)YES (E yes, complete EXPECTED SUBMISSION DATE)X NO BS TRACT (Uma to 1400 spaces, Le., spproxnnately fsteen sny~typewntten Ines)(16)EXPECTED SUBMISSION DATE (15)MONTH DAY.YEAR On December 1, 1995, at approximately 1245 MST, Palo Verde Units 1, 2, and 3 were in Mode 1 (POWER OPERATlON) operating at approximately 99, 100, and 42 percent power, respectively, when the Auxiliary Feedwater (AFW)system was found to be unable to perform a component-level design basis function to.automatically provide water to the Steam Generator (SG)upon.an Auxiliary Feedwater Actuation Signal (AFAS).This condition is valid for a limited range of Main Steam Line Break sizes with a Loss of Power (LOP), single failure on the motor driven AFW pump, and below-normal SG level leading to a very low probability event-approximately 4E-12.Emergency Operating Procedures (EOP)and operator actions are fully capable of mitigating the event with the reset of the turbine overspeed and/or start of the non-seismic motor driven AFW pump from the control room..This low probability event was not ful'ly appreciated during the original design, leading to this LER.A design change will be installed to correct the design deficiency.

As interim corrective action, an assessment was performed to demonstrate that the existing condition does not pose a safety concern while permanent corrective actions are being developed and implemented.

Existing EOPs and operator training preclude a complete loss of AFW under accident conditions and the heat removal capabilities of the SGs are met.

0 I' LICENSEE EVENT REPORT (LER)TEXT CONTINUATION

'GILITY NAME Palo Verde Unit 1 ,DOCKETNUMBER LER NUMBER'f EAR';";;:;SEQUENTIAL,;., EVISIO NUMBER,"w, NUMBER PAGE EXT 1.REPORTING REQUIREMENTS:

0 5 0 0 0 5 2 8 9'5-0 1 3 0 0 0 2 of 0 6 This LER 528/95-013-00 is being written to report a'ondition outside the design basis of the plant.Specifically, at approximately 1245 MST on December 1, 1995, Palo Verde Units 1, 2, and 3 were in Mode 1 (POWER OPERATION) operating at approximately 99, 100, and 42 percent power, respectively, when the Auxiliary Feedwater (AFW)(BA)system was found to be unable to-perform a component-level design basis function to automatically provide water to the Steam Generator (SG)(AB)upon an Auxiliary Feedwater Actuation Signal (AFAS).This condition is valid for a limited range of Main Steam Line Break (MSLB)sizes with a Loss of Power (LOP), single failure on the motor driven AFW pump (BA), and below-normal SG level leading to a very low probability event-approximately 4E-12.2.EVENT DESCRIPTIONI On December 1, 1995, engineering personnel (utility, non licensed)completed an evaluation of a previously identified nonconforming condition and found that the AFW system was outside the design basis of the plant.Section 10.4.9.3 of the PVNGS Updated Final Safety Analysis Report.(UFSAR)states in part,"The AFS[Auxiliary Feedwater System]is designed to maintain adequate water level in the steam generators under the following operating modes and accident conditions:...3.

Reactor Coolant System (AB)cooldown using the intact steam generator following a main st'~am line break or main feedwater line break inside the containment (NH)with a loss-of-offsite, power and normal onsite power...." Section 15.0.3.2 of the PVNGS UFSAR specifies the range of initial principle process values that must be considered when performing accident analysis.From a design perspective, postulated accidents are required to be analyzed over the range of initial steam generator inventories of 40 percent to 88 percent Wide Range (WR)indication (LI).[Note-From an operational perspective, the AFW system ensures that the Reactor Coolant System can be cooled down to less than 350 degrees Fahrenheit from normal operating conditions (i.e., 45 percent to 55 percent Narrow Range (NR)indication (LI)which corresponds to 78.5 percent WR and 82 percent WR respectively) in the event of a total loss-of-offsite power.]A postulated accident was discovered that could cause an overspeed trip of the AFW pump turbine (BA)(TRB)following a second AFAS during an intermediate sized steam line break scenario.The postulated accident would result in a loss of both 0 0 LICENSEE EVENT REPORT (LER)TEXT CONTINUATION AGILITY NAME DOCKETNUMBER LER NUMBER PAGE Palo Verde Unit 1 YEAR 0,"":,: SEQUENTIAL NUMBER EVISIO., NUMBER 0 5 0 0 0.5 2 8 9 5 0 1 3 0 0 03of06 steam generators as an available heat sink to remove decay heat.The accident scenario reads as follows: The initial water inventory in both steam generators is assumed to be less than 163,479 pounds mass which corresponds to less than 39.2 percent NR (76 percent WR).The initial water inventory assumed for the postulated accident is below the normal band of 45 percent NR and includes instrument uncertainties plus added margin for additional conservatism.(Note-An initial water level in both steam generators of 76 percent WR or greater has been demonstrated through accident analysis to provide enough water to maintain the steam generator heat sink for 30 minutes without crediting operator action.The reportable condition is for an initial water level between 76 percent WR and 40 percent WR.)A intermediate steam line break, approximately 0.64 through 1.0 square feet, to trip the reactor (AC)is postulated.

This is substantially more than the flow area of one fully stuck open Main Steam Safety Valve (MSSV)(SB)(RV)or Atmospheric Dump Valve (SB).The break is of sufficient size to generate an AFAS from the affected steam generator before the Delta-P (pressure differential between steam generators) lockout (ZEL)signals are generated.

The Delta-p lockout is designed to lock out the AFAS from the affected steam generator to prevent feeding the fault.An AFAS is not ini"ially generated from the intact steam generator due to the higher inventory in the intact steam generator and the eventual Main Steam Zsolation Signal which reduces further inventory loss.A Loss of Power (LOP)is postulated as a consequence of the reactor trip which results in a loss of main feedwater (SJ).The non-seismic,"N" train AFW pump (BA)is not credited for the first thirty (30)minutes of the accident.The"N" train pump.must be manually loaded on the"A" train diesel generator (EK)following a LOP.The single active failure is postulated to be a failure of the"B" train AFW pump (the safety related electric driven AFW pump).The steam line break size is such that steam supply to the turbine driven AFW pump from the affected steam generator terminates due to

!I ,v LICENSEE EVENT REPORT (LER)TEXT CONTINUATION AGILITY NAME Palo Verde Unit 1 DOCKET NUMBER LER NUMBER SEQUENTIAL

'UMBER EVISIO NUMBER PAGE 0 5 0 0 0 5 2 8 9 5 0 1 3 0 0 0 4 of 0 6 TEXT dryout/loss of pressure resulting in the turbine governor valve (TRB)(65)being fully open, the turbine speed setpoint at a steady state speed setting of approximately 3560 rpm, and the actual speed of the turbine at or near 0 rpm.The intact steam generator will continue to gradually lose inventory through the MSSVs until a second AFAS is generated from the intact steam generator.

The second AFAS initiates steam flow from the intact steam generator to the idle turbine driven AFW pump.With the pump speed demand set at 3560 rpm verses the normal starting value of 900 rpm, the governor valve will not respond quickly enough to control speed.As a result, the.turbine driven AFW pump will ramp up and trip on overspeed.

The overspeed trip will prevent the only available AFW pump (the turbine drive pump)from automatically delivering flow to the intact steam generator.

The intact steam generator could steam dry and result in a loss of both steam generators as an available heat sink-to remove decay heat.An assessment was performed to demonstrate that the existing condition would not pose additional safety concerns while permanent corrective acti:ons are being developed and implemented.

The assessment considered the following items: The availability of redundant or backup equipment, The compensatory measures including limited administrative controls, The safety function and events protected against, The conservatism and margins, The probabili.ty of needing the safety function, and The PRA or Individual Plant Evaluation (IPE)results that determine how operating the facility in the manner proposed in the Justification for Continued Operation (JCO)will impact the core damage frequency.

The assessment concluded that success paths do exist that ensure the heat removal capabilities of the steam generating system are retained and that II 0 Y LICENSEE EVENT REPORT (LER)TEXT CONTINUATION AGILITY NAME Palo Verde Unit 1 DOCKET NUMBER LER NUMBER YEAR'~+, SEQUENTIAL NUMBER EVISIO NUMBER PAGE 0 5 0 0 0 5 2 8 9 5 0 1 3 0 0 05of06 the bounding analyses found in Chapter 15 on the UFSAR will not be changed.The success paths identified in the assessment require operator action;however, these actions are not required prior to 30 minutes into the event and administrative controls are sufficiently proceduralized to preclude a total loss of AFW.Based on the conclusions of the assessment and very low probability of occurrence (i.e., 4E-12), the existing condition does not result in a safety concern for the period of time needed to develop and implement permanent corrective actions.3.ASSESSMENT OF THE SAFETY CONSEQUENCES AND THE IMPLICATIONS OF THIS EVENT: The safety function of the AFW system is to ensure that the Reactor Coolant System (RCS)can be cooled down to less than 350 degrees Fahrenheit from normal operating conditions in the event of a total loss-of-offsite power.The conditions necessary for the postulated accident to result in a complete loss of steam generator inventory include an initial steam generator water level of less than 39.2 percent NR which is below the lower normal operating level of 45 percent NR.From an operational perspective, there were no safety consequences or implications as a result of this event-existing Emergency Operating Procedures (EOP)and operator training are sufficient to preclude a complete loss of AFW under accident conditions and the heat removal capabilities of the SGs are met.From a design perspective, the existing condition does not result in additional safety concerns based on the assessment and very low probability of occurrence (i.e., 4E-12).The condition did not result in any challenges to the fission product barriers or result in any releases of radioactive materials.

This condition did not adversely affect the safe operation of the plant or the health and safety of the public.4.CAUSE OF THE EVENT: An independent investigation of this event is being conducted in accordance with the APS Corrective Action Program.Based'n the results of the investigation, the cause of the condition was attributed to design error (SALP Cause Code BI Design Error).The postulated accident scenario was not considered during the initial plant design.No unusual characteristics of the work location (e.g., noise, heat, poor lighting)directly contributed to this event.There were no procedural errors involved.

0 II LICENSEE EVENT REPORT (LER)TEXT CONTINUATION AGILITY NAME DOCKETNUMBER LER NUMBER PAGE Palo Verde Unit 1 YEAR SMUENTIAL NUMBER EVISIO NUMSER 0 5 0 0.0 5 2 8 9 5, 0 1 3-'0 0 0 6 of 0 6 5.STRUCTURES, SYSTEMS, OR COMPONENT ZNFORMATZON:

No structures, systems, or components were inoperable at the start of the event that contributed to the event.No component or system failures were involved.No failures of components with multiple functions were involved.No failures that rendered a train of a safety system inoperable were involved.There were no component or system failures or procedural errors identified.

There were no safety system responses and none were necessary.

6.CORRECTZVE ACTION TO PREVENT RECURRENCE:

An assessment was performed to demonstrate that the existing condition does not pose additional safety concerns.The Plant Review Board (PRB)reviewed the event scenario and the assessment and determined that the postulated accident did not raise an Unreviewed Safety Question.Based on recommendations from the PRB, a JCO was prepared to support continued plant operation until permanent corrective action is implemented.

As permanent corrective action, a design change will be installed in each unit during the next outage of sufficient.

duration beginning with refueling outage 1R6 currently scheduled to start in November 1996..The design change will preclude the steam driven AFN pump from tripping on overspeed during an, intermediate steam line break accident.PREVZOUS SZMZLAR EVENTS: There have been no previous similar events reported pursuant to 10CFR50.73 in the last three years.

4l t