05000251/LER-2003-001
| Docket Number | |
| Event date: | 04-10-2003 |
|---|---|
| Report date: | 06-12-2003 |
| 2512003001R00 - NRC Website | |
FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Turkey Point Unit 4 05000251
REVISION
Description of the Event
On April 10, 2003 at 2:50 AM, Unit 4 was operating at 79% reactor power while performing a power reduction for turbine valve testing. Operations personnel observed that the 4A Core Exit Thermocouple Subcooling Margin Monitor of the Qualified Safety Parameter Display System (QSPDS) [IP:cpu] was indicating 35°F and not responding to the unit power reduction. The 4B Core Exit Thermocouple Subcooling Margin Monitor of the QSPDS was indicating 43°F and responding normally. The 4A Channel was subsequently manually reset at approximately 3:19 AM and began to respond as expected to the unit power reduction, in agreement with the 4B Core Exit Thermocouple (CET) Subcooling Margin Monitor. 4A Reactor Coolant System (RCS) Subcooling Margin Monitor was unaffected by this event.
QSPDS is a two channel, seismically and environmentally qualified Class IE system that is used to determine if inadequate core cooling conditions exist or are likely. There are two independent and redundant channels with independent 120 volt vital A.C. power supplies. Each channel uses independent sensors to monitor the required temperatures, pressures, and water levels. Each channel also includes a central processing unit (in the computer room) and an operator interface (in the control room). QSPDS provides no automatic safety functions.
The following parameters are displayed on each of the two independent channels:
- Water level in the reactor vessel above the upper core plate
- CET temperatures
- RCS hot and cold leg temperatures
- RCS pressure
- CET, RCS and Plenum Subcooling/Saturation margins (calculated from measured parameters above) Various sensors are used to provide the data required. Sensors include:
- Thermocouples for monitoring core exit temperatures (CETs)
- RCS pressure transmitters
- Heated Junction Thermocouples (HJTC) for monitoring water level above the upper core plate A total of 51 thermocouples are arranged over the mixing columns on the upper core support plate. They are used for direct temperature indication of core exit temperatures and for calculating subcooling margin.
Each channel cabinet contains two microprocessor chassis, referred to as Chassis #1 and Chassis #2.
Chassis #1 accepts the inputs for the Subcooling Margin Monitor function and performs related calculations. Chassis #2 accepts the CET and HJTC inputs and performs the related calculations. The heater controllers associated with the HJTC function are controlled by signals from Chassis #2.
A serial data link connects Chassis #1 and Chassis #2. Some data from Chassis #1 is sent to Chassis #2 for use in calculations. All data is gathered and calculated by Chassis #2 and is sent to Chassis #1.
FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Turkey Point Unit 4 05000251 I REVISION The QSPDS has a hardware failure monitoring function, which can be interpreted through a series of error codes. However, no codes were captured before the system was reset. The system vendor however reported that the system is not designed to detect or indicate failures of the type observed and expressed doubt that capture of the hardware error codes would have helped to further define the problem. This is the first recorded QSPDS failure of this type at Turkey Point. The system vendor reports that QSPDS system failures of this type have not been seen or reported at any other site. This appears to be an isolated event, which is of a nature that may not be repeatable.
Cause of the Event
The apparent cause of the 4A QSPDS channel failure is a sticking input relay on one of the thermocouple input boards on Chassis #2. Chassis #2 input cards use flying capacitor relays which have moving parts.
Failure of an input relay to open up could have halted the scanning of all channels on the chassis, resulting in channel failure. Physical disconnects such as a disconnected cable, connector or pin were eliminated as possible causes because a system reset cleared the failure.
The cause of the failure to recognize inoperability of the 4A QSPDS channel was due to the method of monitoring the QSPDS channels. Flat-lining of the 4A QSPDS channel was not recognized at steady state conditions since no deviation between the channel readouts could be seen at steady-state operating conditions. The monthly TS surveillance for the QSPDS channels could not identify the failure because it compares the channels for deviations and could not detect a deviation between the channels at steady state conditions.
This QSPDS system is considered obsolete and the Chassis thermocouple input boards for the failed channel are currently unavailable. Since plans exist to upgrade this QSPDS system in 2004/2005, and since the apparent cause of the Chassis thermocouple input boards failure is not conclusive, the near term corrective actions are to increase QSPDS channel input parameter monitoring to ensure TS compliance.
Analysis of the Event
On April 11, 2003, review of system archive files from other computer systems receiving inputs from QSPDS revealed that on March 22, 2003 at approximately 6:40 PM, all CETs and HJTCs for the 4A QSPDS channel had stopped updating as indicated by flat-lining of indicator trends. CET Subcooling Margin Monitor, the In-Core Thermocouples, and the Reactor Vessel Level Monitoring System inputs to the 4A QSPDS channel had stopped responding to actual plant conditions. This trend was not recognized from March 22 to April 10 due to steady state plant conditions at 100 percent power. The monthly channel TS surveillance for the QSPDS had been performed as a Post Maintenance Test (PMT) for repairs to the 4B QSPDS on April 9, 2003. However, this test, which logs and compares readouts between channels, could not detect discrepancies between the channels at steady state plant conditions and could not identify the channel failure. Only during the power maneuver on April 10, 2003 was the flat-line trend finally recognized. The channel remained inoperable until it was reset and operability testing was FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Turkey Point Unit 4 05 0 0 02 51 completed at approximately 4:22 AM on April 10, 2003. Based on the archive file reviews, this event was determined to be reportable on April 15, 2003, under the criteria of 10 CFR 50.73 (a)(2)(i)(B).
Action Statement 31 of TS 3.3.3.3, applicable to In-Core Thermocouples, states that if the number of OPERABLE channels is less than the Total Number of Channels, either restore the inoperable channel to OPERABLE status within 7 days or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in at least HOT SHUTDOWN within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Action Statement 37 of TS 3.3.3.3, applicable to the Reactor Vessel Level Monitoring System, states that if the number of OPERABLE channels is one less than the Total Number of Channels, either restore the inoperable channel to OPERABLE status within 7 days or, if repairs are not feasible without shutting down, prepare and submit a Special Report to the NRC within 30 days following the event.
Since one channel had been inoperable for a period of approximately 18 days, 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> and 42 minutes, Unit 4 had inadvertently exceeded the 7-day Technical Specification (TS) Action Statements 31 and 37 of Accident Monitoring Technical Specification 3.3.3.3 for inoperability of the 4A Channel of the In-Core Thermocouples, and the Reactor Vessel Level Monitoring System. As such, this event is reportable under 10 CFR 50.73 (a)(2)(i)(B), since failure of the 4A Channel of the QSPDS existed longer than allowed by the applicable TS 7-day shutdown Action Statements.
A review of maintenance history identified that during the period in which the 4A QSPDS channel was out of service, the 4B QSPDS channel was removed from service for maintenance for a period of 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and 29 minutes. Action Statement 32 of TS 3.3.3.3, applicable to In-Core Thermocouples, states that with both required channels inoperable, either restore the inoperable channel(s) to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in at least HOT SHUTDOWN within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Action Statement 38 of TS 3.3.3.3, applicable to the Reactor Vessel Level Monitoring System, states that with both the required channels inoperable, either restore the inoperable channel(s) to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or if repairs are not feasible without shutting down, initiate an alternate method of monitoring the reactor vessel inventory, submit a Special Report to the NRC within 30 days of the event, and restore at least one channel to OPERABLE status at the next scheduled refueling. The review indicated that the 4B Channel QSPDS's outage time of 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and 29 minutes due to maintenance while the 4A QSPDS Channel was inoperable, had not exceeded the TS 3.3.3.3 48-hour Action Statement for inoperability of two channels.
It should be noted that although the 4A Channel CET Subcooling Margin Monitor, Reactor Vessel Level Monitoring and CET indications were incorrect, the 4A RCS Subcooling Margin Monitor indication was unaffected by the event and continued to accurately report RCS subcooling margin.
Analysis of Safety Significance The QSPDS is not credited in any plant safety analysis as described in the Updated Final Safety Analysis Report (UFSAR) and QSPDS provides no automatic safety functions. The primary purpose for QSPDS is to aid operators in determining if inadequate core cooling conditions exist during post accident monitoring. The QSPDS system is used throughout the Emergency Operating Procedures for determination of RCS and CET subcooling margin, inventory and level indications and as input to FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Turkey Point Unit 4 0500 02 51 I REVISION Reactor Coolant Pump tripping criteria. As such, the QSPDS system instrumentation is classified as Type A Variable under the guidance of Regulatory Guide 1.97, Rev. 3, "Instrumentation for Light-Water- Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident." Type A Variable instruments are defined as instruments which provide primary information required to permit the control room operators to take specific, manually controlled actions for which no automatic control is provided and that are required for safety systems to accomplish their safety function for design basis events.
Two independent and redundant QSPDS channels provide indication to operators in the control room.
Post accident assessment and monitoring is performed by control room operators and Shift Technical Advisors (STAs) who are trained to use both channels and to make conservative decisions based on their indications.
The safety significance for failure of a single QSPDS channel is low, since control room operators and the Shift Technical Advisor would have noted the failure of the 4A channel by comparison of its indications with its opposite channel. Indication of the failure of the 4A channel would be more pronounced during accident conditions, showing a larger deviation with its opposite channel than was observed during at- power conditions. Upon determination that channel indication was in error, operators would have taken the same action as in this event to reset the 4A Channel, restoring proper indication. Thus, failure of a single channel of QSPDS in this manner would have been recognized and would not have led to misdiagnosis of accident conditions.
This event did not compromise the health or safety of plant personnel or the general public.
Corrective Actions
1. Operations logs have been changed to require monitoring and trending of QSPDS once per shift.
2. Operations logs have been updated to provide instructions to ensure Engineering will capture QSPDS system error codes prior to channel reset if another failure should occur.
3. Engineering is reviewing QSPDS system trends bi-weekly.
Additional Information
A review of Turkey Point LERs indicates that no similar QSPDS failure events have occurred in the past.
The QSPDS vendor also reports that they do not have any previous history of this type of failure.
component function identifier (if appropriate)].