05000275/LER-2010-002
| Diablo Canyon | |
| Event date: | 03-09-2010 |
|---|---|
| Report date: | 09-24-2010 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| Initial Reporting | |
| ENS 45754 | 10 CFR 50.72(b)(3)(ii)(B), Unanalyzed Condition |
| 2752010002R02 - NRC Website | |
I. Plant Conditions
At the time of discovery, Units 1 and 2 were in Mode 1 (Power Operation) at approximately 100 percent reactor power with normal grid voltage.
II. Description of Problem
A. Background
Offsite power for Diablo Canyon Power Plant (DCPP) is available from two 230 kV transmission circuits and three 500-kV transmission circuits [FK]. The 230 kV transmission circuits provide the immediately available offsite power source.
Shunt capacitors [CAP] in the 230-kV switchyard, and automatic load tap changers (LTCs)[TTC] on the 230-kV/12-kV standby startup transformers [XFMR], help assure adequate station voltage under a wide range of station loads and transmission system conditions. Operating Procedure OP J-2:VIII, "Guidelines for Reliable Transmission Service for DCPP," contains the administrative controls to enable operability determinations for offsite power.
Each unit has three 4kV vital buses [EA]. The 4kV vital buses are normally powered from auxiliary power transformers from the main generator [EL].
Normally operating safety-related loads powered by the 4kV vital buses include two of three available component cooling water (CCW)[BI] pumps and one of two available auxiliary saltwater (ASW)[BS] pumps. In addition, the charging function [CB], while normally supplied by a nonsafety-related pump is occasionally 'provided by one of two safety-related pumps. Pump motors have overcurrent relays [51] to protect them from damage due to heating (i.e., from sustained degraded voltage operation).
To protect the safety-related loads, the 4kV vital buses are provided with loss of voltage and low/degraded undervoltage [27] protection that initiates transfer to the onsite emergency diesel generators (EDGXEK]. The EDGs provide emergency power to mitigate an accident and safely shutdown the unit when offsite power is unavailable.
The first level undervoltage relays (FLURs) provide loss of voltage and low voltage protection for each 4kV vital bus. These relays have inverse time characteristics that actuate more quickly in response to more severe degraded voltage conditions, with less than or equal to a 4 second delay upon complete voltage failure.
The second level undervoltage relays (SLURs) provide undervoltage protection to preclude continuous ESF equipment operation at less than rated voltage.
LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) The SLURs actuate at greater than or equal to 3785 volts. Both of the SLURs on a bus must actuate to initiate EDG start and load shed timers for the associated bus. If voltage remains below the reset voltage for 10 seconds, the associated EDG will receive a start signal. If voltage remains below the reset voltage for 20 seconds, loads are shed from the bus and the bus is separated from offsite power in preparation for load sequencing onto the EDG. If voltage recovers prior to these time limits, the SLURs reset. The FLURs and SLURs are designed to protect safety-related loads from damage on loss or degradation of 4kV vital bus voltage.
TS 3.3.5 "Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation" SR 3.3.5.3 specifies the FLUR and SLUR setpoints and time delays.
Surveillance Test Procedure (STP) M-75 "4kV Vital Bus Undervoltage Relay Calibration" ensures the relays meet the setpoint and time delay values specified in TS SR 3.3.5.3.
The following TS systems were impacted by this event:
- TS 3.5.2, "Emergency Core Cooling Systems (ECCS) [BQ] — Operating," permits operation with one or more trains inoperable up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
- TS 3.7.7, "Vital Component Cooling Water (CCW) System," permits operation with one CCW loop inoperable up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
- TS 3.7.8, "Auxiliary Saltwater (ASW) System," permits operation with one ASW train inoperable up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
B. Event Description
On March 9, 2010, PG&E analyzed the consequences of accidents with subsequent degraded grid voltage for a nonconforming condition, low and/or degraded voltage time delay not reflected in accident analyses. As a result, PG&E discovered both units could operate in an unanalyzed condition. The postulated condition was a sustained degraded grid voltage condition of 4kV voltage remaining below the SLUR setpoint and slightly above the FLUR setpoint, resulting in the vital buses experiencing the degraded voltage condition until the SLUR time delays are completed. This condition could have resulted in multiple safety-related pump motors tripping their overcurrent relays [51]. As a result, these pumps may not have been immediately available to mitigate a postulated accident as credited in accident analyses.
On March 9, 2010, at 20:39 (PST), PG&E reported this as an unanalyzed condition (8-hour report) to the NRC in accordance with 50.72(b)(3)(ii)(B) (reference EN45754).
LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PG&E implemented interim compensatory measures via Shift Orders to prevent auto transfer to startup of one vital 4kV bus per unit. As a result, offsite startup power was considered inoperable in both Units 1 and 2.
On March 9, 2010, at 21:58 (PST for Unit 1, 21:57 for Unit 2), in response to the above interim compensatory measures, operators declared startup power inoperable and entered 72-hour TS 3.8.1, Action A.2 for one inoperable offsite, power source.
Unit 2 CCW pump 2-2 was removed from service for maintenance at the time the interim compensatory measures were taken. The interim compensatory measure only ensured CCW pump 2-1 would be transferred directly to the diesel power supply, leaving CCW pump 2-3 vulnerable to overcurrent trip as described above. With potentially only one CCW pump available following a reactor trip with sustained degraded voltage on the startup power source, entry into limiting condition of operation (LCO) 3.0.3 was required but not recognized.
The transfer to startup was prevented for the running CCW pump 2-3 at 08:58 on March 10, 2010. The time from 21:57, March 9 until 08:58, March 10 exceeds the LCO 3.0.3 required time'of 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> to place the unit in Mode 3.
In order to exit the TS Action, PG&E implemented a temporary modification (compensatory measure) that raised the FLUR setpoints on the vital buses of both Units 1 and 2, thus allowing transfer of loads to EDGs prior to tripping on overcurrent.
On March 12, 2010, at 13:17 (PST for Unit 1, 13:18 for Unit 2), following adjustment of FLUR setpoints, completion of STP M-75, and elimination of the previously established compensatory measures, operators exited the 72-hour TS action for an inoperable offsite startup power supply.
C. Status of Inoperable Structures, Systems, or Components that Contributed to the Event None
D. Other Systems or Secondary Functions Affected
See section IV, Assessment of Safety Consequences.
LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) Diablo Canyon Unit 1 0 5 0 0 0 2 7 5 2010 0 0 2 0 2 5 OF
E. Method of Discovery
During a Component Design Basis Inspection (CDBI), NRC inspectors asked PG&E to evaluate various postulated sustained degraded 4kV voltage scenarios.
As a result of the evaluation, this issue was identified.
F. Operator Actions
Interim compensatory measures were implemented to protect safety-related pump motors from postulated degraded voltage. Operators declared startup power inoperable and complied with 72-hour TS 3.8.1, Action A.2 until the FLUR setpoints could be raised on the vital buses to higher values.
G. Safety System Responses
None III.� Cause of the Problem
A. Immediate Cause
The immediate cause of the unanalyzed condition was that PG&E had not considered these postulated worst case degraded voltage conditions credible, given administrative controls, and automatic LTCs. Therefore PG&E had not analyzed or designed for it. As a result, TS SR 3.3.5.3 values are nonconservative.
B. Cause
The most probable apparent cause of the DCPP undervoltage relay settings not satisfying all licensing design criteria was misinterpretation of the licensing design criteria by PG&E in the 1970's (i.e. non-conservative assumptions).
IV.� Assessment of Safety Consequences The postulated sustained degraded voltage of less than 70 percent for up to 20 seconds could cause normally operating safety-related motors (two CCW pump motors and one ASW pump motor) to trip on overcurrent. The condition was considered reportable because accident analyses assumed normally running safety-related loads would automatically transfer to an EDG. Therefore this event is considered unanalyzed.
LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) Further analysis concluded the sustained degraded voltage condition subsequent to a bus transfer to startup power could result in an auto-start and overcurrent trip of the standby ASW pump.
The sustained degraded voltage condition subsequent to a safety injection actuation signal (SIAS) could also result in overcurrent trip of standby pumps being sequenced onto the 4 kV buses. Specifically, standby charging, safety injection (SI)[13Q], and residual heat removal (RHR)[BP] motors could trip on overcurrent.
The sustained degraded voltage condition subsequent to a SIAS would also result in delays in actuation of some motor operated valves (MOVs). The MOVs could stall or open/close more slowly than with normal voltage. However, the MOV motors would not trip, and the valves would re-position to their appropriate accident position upon restoration of voltage. The affect of the delay is enveloped by the affect of the loss of safety-related pumps.
The worst case scenario described above is not considered safety significant because it would require simultaneous occurrence of the following highly improbable events: (1) an accident resulting in an SIAS; (2) the offsite power system voltage degrades after the standby loads are sequenced onto startup power; (3) startup power voltage degrades to approximately 62 to 70 percent; (4) the shunt capacitors in the switchyard and the automatic LTC on the startup transformer fail to actuate to recover voltage; (5) degradation of the offsite power system to approximately 62 to 70 percent is sustained for 20 seconds. Evaluation of the offsite power circuits has shown that the startup power supply has adequate capacity to maintain voltage, including considerations for the loss of the main generator supply to the grid. Evaluation has also shown that accident loadings on the bus will not result in a sustained degraded voltage condition when the "immediately available" startup power source functions as designed. Furthermore, the individual motor overcurrent relays would protect the pump motors from damage and operators would be expected to restart the motors. The DCPP 4kV motor overcurrent relays can be reset by Operators using controls in the DCPP Control Room.
DCPP has over ten years experience with automatic load tap changers on the startup transformers, and has never observed a sustained degraded voltage condition similar to what is being postulated. A probabilistic risk assessment analyses conducted for this scenario demonstrated that this event was not risk significant.
Based on the foregoing, this event did not adversely affect the health and safety of the public.
LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) V.�Corrective Actions
A. Immediate Corrective Actions
PG&E implemented compensatory measures by changing the FLUR setpoints on the vital buses of both Units 1 and 2, thus protecting safety-related motors from tripping on overcurrent during postulated sustained degraded voltage conditions. Specifically, the FLUR delay time was shortened such that load shedding and bus transfer would be initiated prior to overcurrent tripping of the individual loads.
B. Corrective Actions to Prevent Recurrence
PG&E will submit a license amendment request to establish conservative TS SR 3.3.5.3 undervoltage relays settings. Upon approval, the TS Bases, and Final Safety Analysis Report will be updated to more clearly describe how the licensing and design basis requirements are interpreted and implemented.
In addition, PG&E has separately committed to perform a licensing basis verification project. This project would address the potential extent of condition.
VI.�Additional Information
A. Failed Components
None
B. Previous Similar Events
None.
C. Industry Reports NRC Event Notification EN45754