Attachment C

CRDR 2715659 SWMS Attached Media for Unit 3 Trip

Note: Whenever possible an ADOBE .pdf should be created from electronic filesdirectly. If only hardcopy is available, then documents can be scanned for theserecords.

The Investigation Director or designee shall arrange for the following StandardEvaluations and include in SWMS Attached Media for the CRDR

Item Attachment NameV 1 C Plant Transient Review AssessmentV 2 C Safety Limit Review EvaluationV 3 C Plant Performance EvaluationV 4 C Plant Protection System Response Evaluation/ 5 C Control Systemn Response Evaluation/ 6 C Nuclear Safety Assessment

Note that items 1, 3, and 4 are included in the STA letter.

Digitally signed by: McDowell,.James P(Z98774)Date: 06/22/2004 14:26:,Reason: I have reviewe this ocumrent and verifiedincluded signatures.Location: PVNGS 7ii

~iqI

i, -�i -�-' 'AM

-Lm,'---`,A-Ar5

DATE:

Memo#TO:Sta. #Ext. #

FROM:Sta. #Ext. #

June 22, 2004 Company Correspondence294-01901-DWVJim McDowell79975668

Don Vogt78335926

Digitally signed byF Oakes. David A(Z99350)Date: 06/=004 10.1022Reason: I am approving Wis document for Don VogtLocation: PVNGS ;,* --.

SUBJECT: Unit 3 June 14, 2004 Loss of Off-Site Power, Main Generator Trip, Reactor Tripon VOPT

The Shift Technical Advisors have conducted a Plant Performance Evaluation of the Unit 36/14/2004 Loss of Off-Site Power and subsequent Reactor Trip.

The Plant Performance Evaluation is an overall evaluation of how the plant responded to theLoss of Off-Site Power and Reactor Trip. The STAs perform this evaluation of the plant'sresponse within two distinct areas. The Safety Function Impact is an analysis of thetransient's impact on each of the PVNGS Safety Functions. The General Plant Performanceis an assessment and description of equipment malfunctions, abnormal alarms and/or eventsobserved during the course of the event.

The evaluations are performed utilizing information from ERFDADS plots, control boardstrip chart recorders, alarm typer outputs (PMS), operating procedures, and personnelstatements. The summary of these evaluations is provided as attachments.

AttachmentsEvent Summary/General Plant ResponsePlant Performance Evaluation/ Transient Response

cc: D. Smith 7602 D. CarnesD. Mauldin 7605 C. SeamanM. Winsor 7669 F. RiedelP. Kirker 7398 M. GrigsbyP. Wiley 7848 J. HesserEmail: Shift Technical Advisors (7833)

79977636789472987002

T. RadtkeM. SheaP. BorchertM. McGheeJ. T. Taylor

72947299790471987848

CRDR#2715659UNIT 3 REACTOR TRIP - LOSS OF FORCED CIRCULATION

June 14, 2004

Event Summarv

At 07:41 on June 14, 2004, U3 was at 99% and essentially steady state conditions. A small(-6 gpm) dilution was in progress, as Xenon equilibrium had not yet been reached due torecovery from the June 7, 2004 trip. Grid instability (see Significant CRDR 2716184)caused a U3 turbine trip, Reactor trip and Generator trip. RCP speeds increased toapproximately 108% nominal values. The sudden RCS flow increase resulted in a powerexcursion, resulting in Reactor trip on PPS-VOPT. A SBCS anomaly caused a secondarypressure decrease resulting in MSIS. After performing SPTAs, the Control RoomSupervisor diagnosed this event as an Excessive Steam Demand (ESD) and entered EOP40EP-9EO05. After verifying that the SFSC and exit criteria were met, the CRS re-diagnosed the event as a Loss of Offsite Power/Loss of Forced Circulation and enteredEOP 40EP-9EO07. The Shift Manager/Emergency Coordinator declared a Notice ofUnusual Event (NUE) based on Emergency Action Level (EAL)s 2-1 and 8-2.

PLANT PERFORMANCE EVALUATION

I. SAFETY FUNCTION IMPACT

A. Reactivity Control -RCP speeds increased to approximately 108.2% nominal speed.The subsequent RCS flow increase resulted in a power excursion causing the PPSVOPT. All CEA fully inserted when required by the PPS VOPT trip.

B. Maintenance of Vital Auxiliaries - Each train of Class IE (4160v) power sufferedLOV and was subsequently powered from its respective Diesel Generator untiloffsite power could be recovered. During the attempt to restore offsite power,3ENANS05D failed to close on demand from the control room. After beingexercised in the test position, it was successfully closed.

C. Heat Removal- Reactor Coolant System temperature (Tc) decreased toapproximately 540F during the event. Heat Removal was initially controlled by allSBCS valves Quick Opening and coast down of the RCP's. The subsequent loss ofthe CW pumps and degrading vacuum then caused a condenser lock out of theSBCS. Heat Removal was manually controlled via the ADV's and by AF pump 'B'.Steam Generators reached minimum levels of approximately 52% WR in both S/Gs.Steam Generator pressures reached a maximum of approximately 1170 psia in eachSG. SG pressures momentarily dropped below the MSIS setpoint.

D. Pressure and Inventory Control - Maximum RCS pressure reached during the eventwas approximately 2270 psia. The minimum RCS pressure was approximately 1990psia. The minimum pressurizer level reached was approxmately 26%. The decrease

CRDR#2715659UNIT 3 REACTOR TRIP -LOSS OF FORCED CIRCULATION

June 14,2004

in pressure is primarily due to RCS cooldown caused by the SBCS anomalyfollowing the turbine trip. Letdown was lost during the event and pressurizer levelincreased to approximately 72 %. The Crew initiated a controlled cool-down usingADVs and AF pump 'B' in accordance with the LOFC/LOOP EOP to controlpressurizer level.

E. Containment Integrity - No impact during this event.

F. Containment Atmospheric Control - Containment temperature reached a maximumof approximately 116F following the loss of WC and Containment HVAC due tonon-class power loss. No impact during this event.

II. GENERAL PLANT PERFORMANCE

The initiator for this event was a grid disturbance. The SBCS valves initially quick-opened concurrent with the turbine trip. Subsequent SBCS anomalies were noted asSG pressure dropped below the MSIS setpoint. After the MSIS, SG pressures andlevels were controlled manually by the Operators using ADVs and AF pump "B".

The following equipment performance problems were noted:

* SIP 319 pressure alarm annunciated several times, requiring depressurization.RCE-V217 performance needs evaluation. This condition renders LPSI 'B'INOPERABLE per the applicable ARP. (WM 2715743)

* RCP 2A seal staging pressure needs review (this is a carryover from anomaliesobserved at power)

. RCP 2B lift oil pump tripped on thermal overloads. Did not reset. (WM2715739)

* SBCS anomalies were observed (WM 2715740)* Difficulties were encountered with breaker NAN-SO5D. (WM 2715746, CRDR

2716019)* EWA-PSV47 (SDCHX "A") lifted during cross-tie from EW to NC. The PSV

later reseated when normal system parameters were established. (WM 2715744,CRDR 2716573)

* A steam leak was observed at SGN-V928 (WM 2715741)* NCN-UVO104 (WC 'B' chiller outlet valve) handwheel clutch is broken (WM

2715742)* FWIV-132 accumulator pressure low - appears to be the "M" 4-way valve (NM

2715722)* NKN-M45 hard ground - several days prior to the trip.* Need to evaluate plant impact due to RCP operation at -108.2% nominal speed

CRDR#2715659UNIT 3 REACTOR TRIP - LOSS OF FORCED CIRCULATION

June 14, 2004

* Need to evaluate plant impact due to turbine-generator operation at -110%nominal speed

* CEA#60 rod bottom light flickered for awhile after Rx trip before fullyilluminating.

PLANT PROTECTION SYSTEMIENGINEERED SAFETY FEATURESACTUATION SYSTEM EVALUATION

I. PLANT PROTECTION SYSTEM EVALUATION

The RPS trip matrix is completed when the second channel for a parameter trips. VOPTChannel A (the second RPS VOPT channel trip) was received at 07:41:17.586 and thelast CEDM UV (#2) trip alarm was received at 07:41:17.661, yielding a response time of0.075 seconds. The UFSAR Table 7.2-4AA time requirement for VOPT is 0.45 seconds.This event's response time of 0.075 seconds is well within its acceptance criterion.

II. ENGINEERED SAFETY FEATURES ACTUATION SYSTEM (NSSS &BOP-ESFAS) EVALUATION

MSIS automatically actuated on low SG pressure due to the SBCS anomalies. TheUFSAR Table 7.3-lB ESF response times for MSIS from SG pressure-low tovalve closure are: 5.6 seconds (MSIVs) and 10.6 seconds (FWIVs). All MSIVsclosed within 3 seconds. All DCFWIVs closed within 6 seconds and all EconFWIVs closed within 7 seconds.

Each DG received its start signal after LOP in less than 2.4 seconds as required byUFSAR Table 7.3-1B. After receipt of start signal, DG 'A' restored PBA-S03 busvoltage to greater than 3740V in 5.5 seconds and frequency to greater than 58.8 Hzin 6.5 seconds. The diesel output breaker closed at 5.8 seconds. After receipt of startsignal, DG 'B' restored PBB-S04 bus voltage to greater than 3740V in 5.3 secondsand frequency to greater than 58.8 Hz in 6.3 seconds. The diesel output breakerclosed at 5.4 seconds. These times are well within the 40ST-9DGOI/DG02acceptance criteria of 10 seconds.

There were no other automatic ESFAS actuations required or initiated.

SEQUENCE OF EVENTS(Note: RONAN times below were "normalized" to the PMS times by adding 72.171 sec.,

ERFDADS times were "normalized" to PMS by subtracting 5.0 sec.)

CRDR#2715659UNIT 3 REACTOR TRIP - LOSS OF FORCED CIRCULATION

June 14, 2004

TIME ALARM/EVENT

07:40:52 UNIT OSCG OPERATED (MAYS42)07:40:52 4160V SWGR 3 BUS TRBL (PBYS1)07:40:53 UNIT 3 SWGR 5 BUS TRBL (NAYS 72)07:40:54 UNIT 3 SWGR 6 BUS TRBL (NAYS 75)07:40:56 GEN NEG SEQUENCE (MAYS 14)07:40:58 4160 SWGR 4 BUS TRBL (PBYS6)07:41:00 4160 SWGR 1 BUS TRBL (NBYS18)07:41:04 EXC VOLT REG MODE CHG (MBYS22)07:41:04 UNIT 3 GEN 525KV BKR 985 (MAZS 17)07:41:04.073 SWGR 3ENBNSO1 BUS UNDV07:41:08 NORM CHLR A INT PROT (WCYS4)07:41:14 4160 SWGR S03 BUS VOLT (PBYS1O)07:41:14 4160 SWGR S04 BUS VOLT (PBYSl 1)07:41:15 LOP/LS B (SAYS 10)07:41:15 DG START SIGNAL B (SAYS12)07:41:16:0 FAST CLSG OF IV'S CMD'D (MTYS83)07:41:16.441 NO ETSV PRESS TRIP (MTYS47)07:41:16.450 MECHANICAL OVERSPEED TRIP07:41:16.450 MECH OVERSPEED TRIP (MTYS16)07:41:16.454 NO ETV PRESS TRIP (MTYS1)07:41:16.461 ETS LO PRESS TRIP (MTYS7)07:41:16.547 MASTER TURB TRIP (MTYS21)07:41:16.547 MASTER TURBINE TRIP07:41:16 LOP/LS A (SAYS9)07:41:16 ESF BUS UNDV CH A-3 (SAYS21)07:41:16 ESF BUS UNDV CH B-1 (SAYS23)07:41:16 ESF BUS UNDV CH B-4 (SAYS26)07:41:16 DG START SIGNAL A (SAYS I1)07:41:17.195 SWGR 3ENANSO1 BUS UNDV07:41:17.491 REACTOR POWER CUTBACK07:41:17.526 VOPT CH B (SBTBOI)07:41:17.561 HI LPD CH B (SBTB03)07:41:17.562 LO DNBR CH B (SBTB04)07:41:17.586 VOPT CH A (SBTA01)07:41:17.628 CHI A TRIP CKT BKR POS07:41:17.633 LO DNBR CH C (SBTC04)07:41:17.635 RTSG 1 OPEN07:41:17.636 HI LPD CH C (SBTC03)07:41:17.637 RTSG 4 OPEN

STATUS SOURCE

ALRM

ALRMOPENTRIPTRIPLOLOACTDACTDYESTRIPTRIPTRIPTRIPTRIPTRIPTRIPACTDTRIPTRIPTRIPACTDTRIP

TRIPTRIPTRIPTRIPTRIPTRIPTRIPTRIPTRIP

TYPERTYPERTYPERTYPERTYPERTYPERTYPERTYPERTYPERRONANTYPERTYPERTYPERTYPERTYPEREVTSOEEVTSOERONANEVTSOEEVTSOEEVTSOEEVTSOERONANTYPERTYPERTPIERTYPERTYPERRONANRONANEVTSOEEVTSOEEVTSOEEVTSOEEVTSOE

'EVTSOERONANEVTSOERONAN

CRDR#2715659UNIT 3 REACTOR TRIP - LOSS OF FORCED CIRCULATION

June 14, 2004

07:41:17.63807:41:17.63907:41:17.64107:41:17.64307:41:17.64507:41:17.64607:41:17.64807:41:17.65007:41:17.65107:41:17.65107:41:17.65107:41:17.65207:41:17.65407:41:17.65707:41:17.65707:41:17.65807:41:17.66107:41:17.67407:41:17.67707:41:17.85707:41:17.86207:41:1707:41:1707:41:1707:41:1707:41:1707:41:1707:41:1707:41:1707:41:1707:41:1707:41:1707:41:1707:41:19.65307:41:19.66407:41:19.76807:41:19.80407:41:21.21007:41:2907:41:2907:41:3007:41:34

RTSG 2 OPENVOPT CH D (SBTD01)CH D TRIP CKT BKR POSCH B TRIP CKT BKR POSLO DNBR CH A (SBTA04)HI LPD CH A (SBTA03)RTSG 3 OPENVOPT CH C (SBTC01)CEDM CONT SIGNAL BUS UNDV 2CEDM CONT SIGNAL BUS UNDV 3CEDM CONT SIGNAL BUS UNDV 4CEDM CONT SIGNAL BUS UNDV 1CH C TRIP CKT BKR POS (SBMTC10)CEDM BUS UNDV 3 (SFCE9UV3)CEDM BUS UNDV 4 (SFCE9UV4)CEDM BUS UNDV I (SFCE9UV1)CEDM BUS UNDV 2 (SFCE9UV2)LO DNBR CH D (SBTD04)HI LPD CH D (SBTD03)GEN OR REACTOR INIT TRIP (MT91)GEN/REAC INIT TRIP (MTYS27)

TRIPTRIPTRIPTRIPTRIPTRIPTRIPTRIPTRIPTRIPTRIPTRIPTRIPYESYESYESYESTRIPTRIPTRIPTRIP

RONANEVTSOEEVTSOEEVTSOEEVTSOEEVTSOERONANEVTSOERONANRONANRONANRONANEVTSOEEVTSOEEVTSOEEVTSOEEVTSOEEVTSOEEVTSOERONANEVTSOETYPERTYPERTYPERTYPERTYPERTYPERTYPERTYPERTYPERTYPERTYPERTYPERRONANRONANRONANRONANRONANTYPERTYPERTYPERTYPER

STM BYP VLV 1 OPEN PERM(SFSB 1OP) YESSTM BYP VLV 2 OPEN PERM(SFSB20P) YESSTM BYP VLV 3 OPEN PERM(SFSB30P) YESSTM BYP VLV 4 OPEN PERM(SFSB40P) YESSTM BYP VLV 5 OPEN PERM(SFSB5OP) YESSTM BYP VLV 6 OPEN PERM(SFSB60P) YESSTM BYP VLV 7 OPEN PERM(SFSB70P) YESSTM BYP VLV 8 OPEN PERM(SFSB80P) YES4160V SWGR I LOAD SHED YESESF BUS UNDV CH A-1 TRIPESF BUS UNDV CH A-4 TRIPSERtBR AIR HDR 02 STATUS (IAAS2) LONORM SVCS XFMR 3ENBNXO1 TRBL TRIPNORM SVCS XFMR 3ENBNX02 TRBL TRIPESF SVCS XFMR 3ENBNX03 TRBL TRIPUNIT AUX XFMR 3EMANX02 TRBL TRIPDG A RUNNINGPZR NAR RNGE PRESS CH A 2177.50 2220.OOLPZR NAR RNGE PRESS CH B 2184.03 2220.OOLPZR NAR RNGE PRESS CH C 2180.50 2220.OOLPZR NAR RNGE PRESS CH D 2160.00 2220.OOL

CRDR#2715659UNIT 3 REACTOR TRIP -LOSS OF FORCED CIRCULATION

June 14, 2004

07:41:3607:41:3807:42:17.20107:42:17.58407:42:17.60007:42:17.60007:42:17.60007:42:17.60707:42:2007:42:2307:42:2407:42:36.79007:43:3907:43:4007:43:4007:43:4007:43:4007:43:4107:43:4107:43:4107:43:4107:43:4207:43:4207:43:4207:43:42

DG A OPER (DGYS5)DG B OPER (DGYS6)LOSG lPRESSCHALOSGlPRESSCHCLEG 1-3 MSIS ALEG 1-3 MSIS BMSIS B LEG 2-4 -MSIS A LEG 2-4MSIV CLOSURESDOWNCOMER FWIV CLOSURESECON FWIV CLOSURESINSTR AIR N2 BKUP VLV PV-52 OPENTURB BYP GP X QK OP (SFSBQOX)SBCS VLV 1 OPEN PERM (SFSB1OP)SBCS VLV 2 OPEN PERM (SFSB20P)SBCS VLV 3 OPEN PERM (SFSB30P)STEAM BYP VLV 1 POS (SFSB INC)SBCS VLV 4 OPEN PERM (SFSB40P)SBCS VLV 5 OPEN PERM (SFSB5OP)STEAM BYP VLV 4 POS (SFSB4NC)STEAM BYP VLV 6 POS (SFSB6NC)STEAM BYP VLV 7 POS (SFSB7NC)SBCS VLV 6 OPEN PERM (SFSB60P)SBCS VLV 7 OPEN PERM (SFSB70P)SBCS VLV 8 OPEN PERM (SFSB80P)

RUNINGRUNINGTRIPTRIPTRIPTRIPTRIPTRIP

NONONONOCLOSEDNONOCLOSEDCLOSEDCLOSEDNONONO

TYPERTYPEREVTSOEEVTSOERONANRONANRONANRONANERFDADSERFDADSERFDADSRONANTYPERTYPERTYPERTYPERTYPERTYPERTYPERTYPERTYPERTYPERTYPERTYPERTYPER

REACTOR TRIP INVESTIGATION 9ODP-01P06 Page 17 of 21 Rev. 12 Appendix C Page 30f 4

SAMPLEPLANT TRANSIENT REVIEW ASSESSMENT

PVNGS INVESTIGATION PROGRAM | D | EVTTME

PLANT TRANSIENT REVIEW ASSESSMENT a/7gC/0 Ni7rW FDESCRIPTION t P e , / pip oV

SmFrT PERSONNELSHnT MANAGER _CONTROLROOMBtPERVISOR

&//7,n4~zJ | 6ES 8< 2 ,wk . UnDE X6} bSz/eSHIrTTECHNICALDVISOR A OTHER PERSON INVOLVED EVET

PLANT CONDITIONS PRIOR TO THE EVENT

MODE REACTOR POWER Mwe * CA POSmGI$, PRESSURIZER PRESSURE TAVO

/ 99qz,1' / % // /5 6 ' 22s9 I 554 °>PREISVflEL, BORON CONCENTRATON *SG LEVEL(W1DE RAN GE)#9 SU LEVEL (WIDE RANaE) f2

S/e. 2Z 624,0pcm . 7EVOLUTIONS IN PROGRESS PRIOR TO THE EVENT ; r e Cs

/k7700 D47- xloplex. 6 3c~Pln 7-0 cwl:Z5 c ;,e ,k6 E /-z1L1)/A,4D /AJ

CONTROL SYSTEM STATUS PRIOR TO EVENTREACTOR REGULATING SYSTEM CEDMCS:

O TEST Tavg Selected 1 2 AVG. AS MS MG Ml STANDBY

FEEDWATERCOOLSYSTEMS: SG 1 SG#2

MASTER. MANMA MAN/

DOWNCOMER REG. VALVE MANUAIJAUTO STATION: MAN14O)[ MAN

ECONOMTZER REG. VALVE XANUAIJAQ STATION. ̀ AN/U :L b

FEED PUMP SPEED MANUAIJAUTO STATION:. MANUTOLBIAS SETTING: R -5 RP4GE CONTROLLER: MAN, 0D

STEAM BYPASS CONTROL F F1 [7j] PRESSURIZER LE L CONTROL []< COAL _A T !n' EMZ )OCAL AUITO MAN sr-r

PRESSURlZER PRESSURE CONTROU m I _ REACTOR POWR CurBAm SYmm.;;15 w SP 55

RPS/ESFAStBOP-ESFAS STATUS PRIOR TO EVENTLLST ANY CHANNELS TRIPPED OR IN BYPASS PRIOR TO THE EVENT*

PV419-04DF(4-89) (Continued on Form PV415-04DJ)

REACrORTRIPINVESTIGATION 90DP-01PO6 Page 18 of 21 Rev 12 Appendix C Page 4 of 4

SAMPLEPL.ANT TRANSIENI REVIEW ASSESSMENTr

PVNGS niVESTIGATION PROGRAM EVENT DATZEr EVEh MIE

PLANT TRANSIENT REVIEW ASSESSMENT - CONTINU/M/° 040 -W 1t

PECORD TRI TINTIt l OutWs the Initiating ReactorTrip Paraneter (if available) within the required value? E YES a

NOlf NO, Explain:

Was the response time (i.e.. the time from reaching the process setpolnt until the bus undervoltage g YES E NOsla soccurs.) of the initiating trip signal within the required value as listed in the PVNCS TechcirlcSpecifications?

If NO. Explain:

ESFASIBOP-ESFAS ACrUATIONSWas Pressurizer Preseure below th SIAS eetpoint (1837 psis) }0 t} 9&og E]( YES NO

If YES, then HPSI injection has occurred. Refer to T1RM 3.5203, condition (A). Notify the Mech.System Engineering Section Leader and Mechanical Design Engineering Section Leader.

RECORD ANY iXAACUATIOM OR SAS-8OPB AtAnTOn AND Til C 2KANNELS ACTUATED,

Were any RCS preesuretemperature limits, as listed in Teeh Specs violated? Y NO

If YES, provide unmmary and evaluation in the Incident Investigation Report. Outline thecirczumstances defining the eccurrence, the results of any Engineering Evaluations performedto evaluate the impact on the RCS.

Does this event involve a potentially damaging transient (Le.. waterhammer event) requiring pipinginhpeeaton? -ja }J5 Bq&ILD/6AJ& C SS g YES ] NO

Person(s) ContaectedIf further Inspection is required, such as inspection of hydraulic and mechanical snubber perTechnical Requirement Manual (TRM) TSR 3.7.101.1.d, pneure appropriate tracking mechanismis Initiated.

Have one or more Main Ste Safety Valves actuated? YES NO

IfYES, then declare those MSSVj INOPERABLE(refer to LCO 3.7.1) until aetpoint testing verifiesoperability and contact System Engineerng to determine needed testing of the MSSV.

Person(s) Contacted

Did RCS pressure exceed 2750 psia? [J YES NO

If YES, provide a discussion in the Incident Investigation Report which enumerates the actionstaken to comply with Technical Specifdcation 2.2.

Has any MSB pressure exceeded 248 paig? .] YES NO

Determine whether this occured by reriewing ERFDADS date (MTP414CP, MTP415CP. MTP416CP.& MTP417CP). Pure in excess of 248 plg could lsdicab tehat the capacity of an MSR relief valvehas been exceeded.IfYES. notify the Mechanial Design Engineering Section Leader and MechanicalMVintenanceS.o __

pV419044WJ (298)

212.OOCA RgM. 289 4190-900121 (00/300)

APS -Arizona Public Service Company

COMPANY CORRESPONDENCE

ID#: 162-10921-GWVAIEMF

DATE: June 16,2004

TO: James T. TaylorSta.#: 7848Ext.: 82-6080

FROM:

Sta.#:

Ext.:

G. W. Andrews769382-5709

Digitally signed by: Andrews, George W(Z99748)Date: 06/17/2004 16:14:11Reason: I am approvinbthis documentLocation: PVNGS 6/ 1-Z

A./I

FILE:

SUBJECT: Safety Limit Evaluation for Unit 3 Reactor Trip on June 14, 2004

Unit 3 experienced an automatic reactor trip at 0741 on June 14, 2004 in response to a griddisturbance which caused Reactor Coolant Pump (RCP) speed to increase. The higher RCP speedresulted in an increase in mass flow rate adding positive reactivity to the core, increasing power toabove the PPS VOPT setpoint. Subsequently, all four CPCs also tripped on a VOPT auxiliary tripwhen CPC Calibrated Neutron Power (PID 171) exceeded the VOPT rate setpoint which is an 8%band above previous power.

CPC A: PID171 at trip = 109.01%

CPC B: PID171 at trip = 108.20%

CPC C: PID171 at trip = 107.46%

CPC D: PID171 at trip = 108.25%

Reactor Engineering has reviewed the data from PTARS and the CPC and CEAC Trip buffers and hasconcluded that the Safety Limits for DNBR, Peak Fuel Centerline Temperature, and PressurizerPressure were not exceeded.

The Peak Fuel Centerline Temperature Safety Limit was not exceeded as evidenced by LPD values onall 4 CPC being less than 21 kW/ft.

PTARS data indicates that maximum pressurizer pressure during the event was approximately 2285psia. Therefore the RCS pressure safety limit of 2750 psia was not challenged during this event.

If you have any questions or need further assistance, please contact Erik Flodin at extension 5899 orpager 602-226-1120.

GX\A/EMF/emf

cc: C. K. SeamanG. NV. AndrewsW. D. ChapinP. J. Kirker

7693769376937398

R. P. BanderaD. W. VogtReactor Eng. RouteJ. P. McDowell

7693783376937997

A subsidiary ofPinnacle West Capital CorporationCOMPANY CORRESPONDENCE

ID # 469-00369\MSC\dlh

DATE: June 18, 2004

TO: Paul KirkerSta. # 7398Ext. # 82-3366 Digitally signed by: Coppock, Michael

S(Z00328) i/FROM: M. Steve Coppock Date: 06/18/2004 19:16:30s. # 7565 Reason: I am approving this document

Location: PVNGS 'Ext. # 82-5990

SUBJECT: Unit 3 Grid Problem Reactor Trip of June 14, 2004 - Control Systems ResponseEvaluation CRDR 2716859; 2716861

Event SummaryAt 07:41am on June 14, 2004 Unit 3 experienced a major grid disturbance. As the offsite power linesshed, generator load decreased rapidly and the Main Turbine tripped on overspeed. The reactor tripped afew seconds later from 109% (CPC excore neutron power) on a PPS generated Variable Over PowerTrip (VOPT). The VOPT was generated since the RCPs were still receiving power from the overspeeding turbine-generator which increased Rx flow and as a consequence reactor power. (Frequencywas recorded as high as around 67 Hz.) A Notificationf of Unusual Event was declared due to loss of off-site power.

About 35 seconds into the event, SG pressure begain to drop rapidly due to the SBCS opening all eightSBCVs which resulted in an automatic MSIS. This was due to a momentary loss of half of the SBCS'spower (DlI ) early in the event. This response is as expected for this abnormal set of conditions. (Seecomplete discussion under the SBCS Response.)

Heat removal was manually controlled via the ADVs and by Auxiliary Feedwater.

The response of the Control Systems (FWCS, SBCS, RPCS & RRS) are not required to operate forPVNGS Nuclear Safety per UFSAR Chapter 7.7/CESSAR 7.

Feedwater Control System (FNWCS) ResponseThe FWCS initially responded with the Reactor Trip Override feature, closing the economizer valvesand positioning the downcomers at 40%. However with the electrical problem, seconds into the event,the Feedwater Pumps tripped and the Operators then used Auxiliary Feedwater.

Steam Bypass Control System (SBCS) ResponseThe SBCS responded to the initial loss of load (turbine trip) with a reactor power cutback and a quickopen (QO) of all eight steam bypass valves (Group X & Y). At very close to the same time, a reactor tripwas also generated. The reactor trip blocked Group Y from the QO signal but the group Y valves didmodulate open as expected (except for 1005 which was observed to be alittle slow). About 4 seconds

Page 2 of 2469-00369\MSC\dlhJune 18,2004

after the turbine trip, panel DlI power was momentarily interrupted (approx. 1 sec) to the SBCS, asindicated by a loss of SGNPT1 024 and all eight valve position signals.

This power loss initiated a 30 second timer that disconnects the valves from the SBCS. (This timer isnormally needed when returning the system to service after testing.) All eight valves started closed dueto the loss of signal. (Valve 1003 was noticed to close slowly at this time.) This power loss wasapparently long enough to initiate the timer but not long enough to switch the Master controller tomanual and run its output to zero as a longer power loss should do (The Master controller also gets itpower from DlI ). Testing on a bench showed that it takes about a second of power loss for the M/Astation to switch to manual. After power was restored, both the Modulate and Permissive controllerscontinued to provide more demand since pressure was still above the setpoint. Both controllers have anintegral gain of 30 sec which saturated them high while the timer timed-out. When the timer timed-outthe valves were switched back onto the 100% demand signal. All eight valves then modulated open inabout 14 sec. As pressure dropped the SBCS did demand the valves to go closed but this was too late toprevent the MSIS. (The 1003 valve was also very slow to close here.)

An open failure of the SBCS is considered a MRFF so this failure will be investigated further underCRDR # 2716859. Troubleshooting WM 2716022 was initiated to verify the functionality of the SBCS(Functional Test completed on 6/16/04; SAT).

WM 2715740 for the slow response of SBCS valve 1003. The failure-to-close is considered a MRFFand will be investigated further by CRDR # 2716861

Reactor Regulating System (RRS) ResponseThe RRS is not required for a reactor trip.

Reactor Power Cutback System (RPCS) ResponseThe RPCS properly initiated the cutback demanded by the SBCS however within a second the reactortripped.

Pressurizer Level Control System (PLCS) andPressurizer Pressure Control System (PPCS) ResponseThe level control controller switched to manual with zero output on loss.of power (from Dl I) untilrestored by the operators. Pressurizer level was controlled manually. Back-up safety bank heaters wereavailable for automatic control as soon as the diesels were running. All controls responded as expected.

Should any questions arise, please contact Dan Holland at extension x6694 or Gary Anderson atextension x5742.

MSC/mlhldlh

cc:

Page 3 of 2469-00369\MSC\dlhJune 18, 2004

C. D. Mauldin 7605D. M. Smith 7602T. L. Radtke 7294M. J. Winsor 7669D. C. Fan 7546D. W. Smyers 7357B. D. Ramey 7590P. Paramithas 7663M. L. Hypse 7535M. A. Radspinner 7526G. T. Anderson 7535D. L. Holland 7590D. Fisher 7357

APSArizona Public Servicc Company

COMPANY CORRESPONDENCE

ID #: 162-10935-BSB

DATE: June 22, 2004

TO: James McdowellSta. #: 7997Ext. #: 82-5668

FROM: Brian Blackmore Digitally signed by*. Blackmore, Brian S(Z99910) Nuclear Fuel ManagementDate: 06/22/2004 10:59:24

Sta. #: 7693 Reason: I am the author of this document Transient AnalysisExt.#: 82-5372 Location: PVNGS

SUBJECT: NFM Nuclear Safety Assessment: Unit 3, Loss of Power on June 14, 2004Procedure 9ODP-OIP06 (Reactor Trip Investigation) requires a nuclear safety assessment to beperformed which should address the affect of the event on nuclear safety; and should include acomparison of observed values to those maximum and minimum values specified in the TechnicalSpecifications and the Safety Analysis Report. The purpose of the procedure is to complete an accurateinvestigation of unplanned reactor trip events. This procedure also applies to Unit restartauthorization activities following reactor trip events.

Reference # 7 (Letter # 162-10924-BSB dated June 18, 2004) is superceded by this letter. The letterrevision removes a statement regarding containment temperature as requested by the PRB.

ConclusionThe event experienced by Unit 3 on June 14, 2004, did not result in a transient more severe than thosealready analyzed in the Chapter 15 of PVNGS UFSAR. The turbine tripped first (MTYS47 NO ETSVPRESS Trip) per the PMS sequence of events. Prior to the turbine trip, the turbine load wasexperiencing fluctuations.

The trip report sequence of events documents the reactor tripped on VOPT (the CPC VOPT tripcondition which is reflected as a LOW DNBR trip conditions were met within 0.047 seconds ofreaching the PPS VOPT conditions). The peak reactor power level recorded from CPC trip bufferreport was - 109%. The CPC neutron flux was the maximum power selected as input to CPC VOPT.CPC delta temperature power did not increase appreciably (when compared to neutron flux).Reviewing the CPC logic revealed that the maximum acceptable range for pump speed is within 1% ofthe nominal value. Any pump speed values above the acceptable range is not recognized by the CPCsand so would not increase delta temperature power. The CPC trip buffer reports indicated that all 4RCP speeds were approximately 10% above the nominal pump speed of 1190 RPM at the time of thereactor trip. ERFDADS plots of: turbine speed, excore power, RCS temperatures, and RCP speed werereviewed. These plots show RCP speed was increasing as the turbine speed was increasing and cold legtemperature remained essentially unchanged during the initial 2-3 seconds prior to the trip.

NFM attempted to model this condition using the SIMULATE-3K computer code. RCS flow wasincreased 10% in a 0.1 second time step while inlet temperature was not changed. A search on powerindicated power increased by 3% in 0.1 seconds and had increased by 12% over the first 1 second.Shortly thereafter, doppler had turned power (the code does not model VOPT). Based on the above

162-10924-BSBJ. McdowellPage 2 of 5

response, it is believed that sweeping cold leg water into the core at an increased rate caused areduction in core average temperature with the consequent increase in core average density andpositive reactivity due to MTC.

RCS Tcold initially increased (as expected due to the loss of load). The event initiator was a loss ofload due to grid disturbance. The response time for the reactor trip on VOPT was well within the 0.45second response time assumed in the UFSAR Table 7.2-4AA.

The post trip NSSS response was normal with the exception of the SBCS valves modulating open - Iminute after the reactor trip. The cause of the SBCS open signal is unknown at this time and is beinginvestigated by system engineering. The SBCS steam flow resulted in steam generator pressuredropping and a subsequent MSIS ESFAS actuation. Opening all eight SBCS valves after a reactor tripis bounded by UFSAR 15.1.3 (LDCR 2001-F056) which assumes all SBCS valves open at 100%power. In this case, the CEAs were at the bottom of the core when the SBCS valves opened the secondtime and caused the MSIS.

Equipment and systems assumed in UFSAR Chapter 15 were functional and performed as requiredexcept as noted above. The AFW system was manually placed in service by operations prior toreaching an AFAS condition. Scenarios defined in UFSAR Chapter 15 concerning Turbine Trip(15.2.2), Loss of Condenser Vacuum (15.2.3), Loss of Reactor Coolant Flow (15.3.1), CEAWithdrawal at Power (15.4.2), and Increased Main Steam Flow (15.1.3 see LDCR 2001-F056) werereviewed and remained bounding for this event.

For further information related to this assessment please see below or call Brian Blackmore atextension 82-5372.

cc:

C.K. Seaman (7693) R.P. Bandera (7693) A. R. Fluegge (7995) G.W. Andrews (7693)

D.W. Vogt (7833) C.A. Hasson (7693) J.T. Taylor (7448) P. J. Kirker (7398)

D. Marks (7636)

162-10924-BSB*J. McdowellPage 3 of 5

Purpose

The primary purpose of the Safety Analysis Assessment is to address the impact of this eventon nuclear safety, including automatic actuations, equipment failures, and personnelresponse. This assessment will include a comparison of the actual observed values to thosemaximum and minimum values specified in the Tech Specs and the Safety AnalysisReport. One way to answer this question is to compare the event to similar analyzed events ofthe appropriate frequency category and ensure that the consequences of the actual event arebounded by the event analyzed. If the event is not similar to events previously analyzed, so'mespecific analyses may be required to demonstrate the acceptance criteria are met.

General Event Description

1) The event experienced by Unit 3 on June 14, 2004 did not result in a transient more severethan those already analyzed in Chapter 15 of the PVNGS UFSAR. The reactor tripped from -109% power due to a generated reactor trip on PPS VOPT caused by an increase in neutronflux power due to grid disturbance. The grid disturbance caused the turbine generatorfrequency and RCP speed to increase. This increase in RCP speed increased core powerresulting in a VOPT. The event initiator was a grid disturbance resulting in a Main Generatortrip which ultimately caused loss of power to the RCP's. The response time for the reactor tripon VOPT was well within the 0.45 second response time specified UFSAR Table 7.2-4AA.

2) The post trip NSSS response was normal with the exception of the SBCS valves modulatingopen - 1 minute after the reactor trip. The cause of the SBCS open signal is unknown at thistime and is still being investigated by system engineering. The SBCS steam flow resulted insteam generator pressure dropping and a subsequent MSIS ESFAS actuation.

3) Equipment and systems assumed in UFSAR Chapter 15 were functional and performed asrequired (with the exception of the SBCS response which is being evaluated by systemengineering). Scenarios defined in UFSAR Chapter 15 concerning Turbine Trip (15.2.2), Lossof Condenser Vacuum (15.2.3), Loss of Reactor Coolant Flow (15.3.1), CEA Withdrawal atPower (15.4.2), and Increased Main Steam Flow (15.1.3 see LDCR 2001-F056) remainedbounding for this event.

Evaluation

As shown in the attached Table there are three major criteria for events included in the UF-SAR Chapter 15 Safety Analysis. The appropriate criteria must be used based on the frequen-cy of occurrence of a given event. This event is conservatively classified in the AnticipatedOperational Occurrence (AO0) category. Events of this type are expected to occur during acalendar year. As such, this event falls into the Moderate Frequency category, and must meetthe design criteria as specified in the attached Table. This class of event is normally evaluatedfor its potential for primary and secondary pressure peaking and fuel failure. In this instance,the design criteria of interest for fuel failure is the DNBR SAFDL.

Each of the three general criteria will be specifically addressed in the following sections.

Shutdown Margin

This event did not challenge shutdown margin criteria. All CEAs inserted as designed. A lossof turbine and reactor coolant flow event is a heatup event and the cold leg temperatures roseslightly above normal temperature after the reactor trip as expected. Since the unit is operatingwith negative moderator temperature conditions, adequate shutdown margin was available

162-10924-BSBJ. McdowellPage 4 of 5

throughout the event. From ihe ERFDADS plots the cold leg temperatures reached a maxi-mum of - 565 'F following the reactor trip. The second SBCS opening did not result in shut-down margin loss since all of the rods had dropped into the core when the SBCS valves hadopened.

Peak Pressure

No postulated event should be severe enough to cause a reactor system pressure boundary rup-ture. The allowable peak pressure for an event is based on the event category. The event cate-gory is tied to ASME Code criteria which generally define pressure limits in terms of apercentage of the design pressure. An AOO would allow a pressure up to 110 percent of thedesign pressure. The ERFDADS data show that both primary and secondary pressures werewell below 110% of the design pressures. The pressurizer pressure peaked at - 2275 psia. Thiswould result in RCS pressure being well below 2750 psia (110% of primary design pressure).The pressurizer pressure before the trip was about 2250 psia. The peak secondary pressurewas - 1175 psia, well below 1398 psia (110% of secondary design pressure). No PSVs orMSSVs lifted as a consequence of this event.

Fuel Failure and Offsite Dose

No fuel failure occurred since the Specified Acceptable Fuel Design Limit (SAFDL) Depar-ture from Nucleate Boiling Ratio (DNBR) was not exceeded during the event.

Conclusions

The conclusion of this assessment is that the Reactor Trips experienced by Unit 3 on June 14,2004 did not result in a transient more severe than those already analyzed. The primary systemand secondary pressure boundary limits were not approached. The transient did not cause anyviolation of the SAFDLs.

Finally, equipment and systems performance remained consistent with that assumed in theSafety Analysis (with the exception of the SBCS response). Plant response was normal for thesituation that occurred. Scenarios defined in UFSAR Chapter 15 and design assumptions ofthe reactor protection system will remain bounding for this reactor trip. Scenarios defined inUFSAR Chapter 6, concerning Loss Of Coolant Accidents (LOCA), were not applicable tothis transient.

Reference

1.PVNGS UFSAR, 15.3.1, "Total Loss of Reactor Coolant Flow".

2. LDCR 2001-F056 UFSAR 15.1.3, "Increase in Main Steam Flow". Note, this LDCR is withNRA for review and has not been approved yet for incorporation into the UFSAR.

3. PVNGS UFSAR, 15.2.2, "Turbine Trip".

4. PVNGS UFSAR 15.2.3, "Loss of Condenser Vacuum".

5. PVNGS UFSAR 15.4.2, "CEA Withdrawal at Power".

6. N001-13.03-1716, CPC Functional Design Spec.

7. Letter # 162-10924-BSB dated June 18, 2004.

162-10924-BSBJ. McdowellPage 5 of 5

Anticipated Operational Occurrences (AOO).ATGR LIMITING

CATEGORY MODERATE INFREQUENT FAULTS

FREQUENCY INCIDENTS

Frequency May occur during a calendar year. May occur during a plant lifetime Low probability of occurrence dur-ing a plant lifetime

Assumptions Does not assume a Single Failure Assumes most Assumes mostlimiting Single Failure limiting Single Failure

Criteria Shutdown Margin is greater than Shutdown Margin is greater than Shutdown Margin is greater thanzero (Modes 2 -6) zero (Modes 2 -6) zero (Modes 2 -6)

DNBR greater than SAFDL (i.e., no DNBR can violate SAFDL (i.e., DNBR can violate SAFDL (i.e., fuelfuel failure allowed) small amount of fuel failure is per- failure is permitted, with core cool-

mitted) and Dose Consequences are ability maintained) and Dose Conse-limited to a small fraction of quences are limited to less than10CFRI00 requirements. 10CERI00 requirements.

Peak Pressure is less than 110% of Peak Pressure is less than 110% of Peak Pressure is less than 110%* ofDesign Pressure (reference 3) Design Pressure (reference 3) Design Pressure (reference 3)

* - Except for Large Feedwater Line Break and CEA Ejection events which allow 120% of design pressure

The classification of moderate frequency, infrequent incidents and limiting faults are described in ANSI 18.2 (Reference I below). Standard Review Plan-(Reference 2 below) discusses the requirement for moderate frequency events. The definition in the SRP and ANSI are the same. These categories are

summarized above:

Refrerences:

1. ANSI N18.2, "Nuclear Safety Criteria for the Design of Stationary Pressurized *Vater Reactors," American National Standards Institute (1974).

2. NUREG-75-087, "Standard Review Plan for the Review of Safety Analyses Reports for Nuclear Power Plants, LWR Edition", September 1975, USNRC.

3. ASME Boiler and Pressure Vessel Code, Section 111, "Nuclear Power Plant Components," Article NB-7000, "Protection Against Over-Pressurc," Ameri-can Society of Mechanical Engineers.