05000251/LER-2003-001, From Turkey Point 4 Regarding Channel Failure of Qualified Safety Parameter Display System
| ML031700485 | |
| Person / Time | |
|---|---|
| Site: | Turkey Point  |
| Issue date: | 06/12/2003 |
| From: | Jones T Florida Power & Light Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| L-2003-133 LER 03-001-00 | |
| Download: ML031700485 (6) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 2512003001R00 - NRC Website | |
text
,up FPL JUN 1 2003 L-2003-133 10 CFR § 50.73 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D. C. 20555 Re:
Turkey Point Unit 4 Docket No: 50-251 Reportable Event: 2003-001-00 Date of Event: 4/10/2003 Channel Failure of the Qualified Safety Parameter Display System The attached Licensee Event Report 50-251/2003-001-00 is being submitted pursuant to the requirements of 10 CFR § 50.73 (a)(2)(i)(B) to provide notification of the subject event.
If there are any questions, please call Walter Parker at (305) 246-6632.
ry u
- ours,
/v />,f#TW e
Jones
//Vi e,Prisident T/
ey Point Nuclear Plant TOJ/DRL Attachment cc:
Regional Administrator, USNRC, Region II Senior Resident Inspector, USNRC, Turkey Point Nuclear Plant an FPL Group company c3a1Dt
NRC;ORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 3150-0104 EXPIRES 7-31-2004
(-201)
, the NRC may not cnduct or sponsor, and a person Is not required to respond to, the information collection.
- 1. FACILiY NAME
- 2. DOCKET NUMBER f3. PAGE Turkey Point Unit 4 05000251 Page 1 of 5
- 4. TIE Channel Failure of Qualified Safety Parameter Display System
- 5. EVENT DATE
- 6. LER NUMBER
- 7. REPORT DATE
- 8. OTHER FACIUTIES INVOLVED MONTH DAYI YEAR YEAR SEQUENTIAL REVISION MONTH DAY l YEAR rACIUTYNAME DOCKET NUMBER INUMBER NUMBER MO__
I___________
04 10 2003 2003 -
001 00 06 12 2003 FACILY NAME DOCKET NUMBER F9.
OPERATING 1
- - 1
- 1. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR 5: (Check one or more)
MODE 1
L 20.2201(b) 20.2203(aX3XI) 50.73(aX2)O1(B) 60.73(a)(2XIxXA)
- 10. POWER 7 9 20.2201 (d) 20.2203(aX4) 50.73(aX2I) 6 50.73(a)(2Xx)
LEVEL 20.2203(aX1) 50.36(cXIXiXA) 60.73(aX2)OvXA) 73.71 (a)(4) 20.2203(aX2)(D 60.36(cX1X)ixA)
=
0.73(aX2)(vXA) 73.71(aX5) 20.2203(aX2XID 50.36(CX2) 150.73(aX2XvXB)
= OTHER 20.2203(aCX2XI) 50.416(a)(3XID 50.73(aX2XvXC)
Specy In Abstract below or 20.2203(aX2XIv)
- 50. 73(a)(2Xi1A) 6 50.73(aX2)(v)(D) hI
Abstract
On April 10, 2003 at 2:50 AM, Unit 4 was operating at 79 percent reactor power while performing a power reduction for turbine valve testing. Operations personnel observed that the 4A Core Exit Thermocouple Subcooling Margin Monitor of the Qualified Safety Parameter Display System was not responding as expected to the power reduction.
The instrument channel was subsequently reset and it began to respond as expected to the unit power reduction.
Investigation revealed that some inputs to the 4A Channel of the Qualified Safety Parameter Display System had stopped responding to actual plant conditions. It was determined that this condition existed since March 22, 2003 at approximately 6:40 PM. During the time that these inputs were inoperable, the unit had inadvertently exceeded the 7-day Technical Specification Action Statements 31 and 37 of Accident Monitoring Technical Specification 3.3.3.3 for inoperability of the 4A In-Core Thermocouples, and the Reactor Vessel Level Monitoring System. This event was determined to be reportable on April 15, 2003, under the criteria of 10 CFR 50.73 (a)(2)(i)(B).
The apparent cause of the failure is a sticking input relay on one of the thermocouple input boards on Chassis number 2 of the 4A Channel of the Qualified Safety Parameter Display System. Corrective actions include increased monitoring and trending of QSPDS. This event did not compromise the health or safety of plant personnel or the general public.
NRC FORM 366 (7-2001)
NRCORM 366A U.S. NUCLE REGULATORY COMMISSION (7-2001)
LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION FACIUTY NAME (1)
DOCKET LER NUMBER (6)
PAGE (3)
SUUER NUMBER Turkey Point Unit 4 05000251 l
Page 2 of 5 2003 001 00 TEXT (if more space Is requirec use additionI copies of NRC Form 366A) (7)
Description of the Event On April 10, 2003 at 2:50 AM, Unit 4 was operating at 79% reactor power while performing a power reduction for turbine valve testing. Operations personnel observed that the 4A Core Exit Thermocouple Subcooling Margin Monitor of the Qualified Safety Parameter Display System (QSPDS) [IP:cpu] was indicating 35cF and not responding to the unit power reduction. The 4B Core Exit Thermocouple Subcooling Margin Monitor of the QSPDS was indicating 43F and responding normally. The 4A Channel was subsequently manually reset at approximately 3:19 AM and began to respond as expected to the unit power reduction, in agreement with the 4B Core Exit Thermocouple (CET) Subcooling Margin Monitor. 4A Reactor Coolant System (RCS) Subcooling Margin Monitor was unaffected by this event.
QSPDS is a two channel, seismically and environmentally qualified Class IE system that is used to determine if inadequate core cooling conditions exist or are likely. There are two independent and redundant channels with independent 120 volt vital A.C. power supplies. Each channel uses independent sensors to monitor the required temperatures, pressures, and water levels. Each channel also includes a central processing unit (in the computer room) and an operator interface (in the control room). QSPDS provides no automatic safety functions.
The following parameters are displayed on each of the two independent channels:
Water level in the reactor vessel above the upper core plate CET temperatures RCS hot and cold leg temperatures RCS pressure CET, RCS and Plenum Subcooling/Saturation margins (calculated from measured parameters above)
Various sensors are used to provide the data required. Sensors include:
Thermocouples for monitoring core exit temperatures (CETs)
RCS pressure transmitters RTDs for RCS Thot and Tc.1d temperatures Heated Junction Thermocouples (HJTC) for monitoring water level above the upper core plate A total of 51 thermocouples are arranged over the mixing columns on the upper core support plate. They are used for direct temperature indication of core exit temperatures and for calculating subcooling margin.
Each channel cabinet contains two microprocessor chassis, referred to as Chassis #1 and Chassis #2.
Chassis #1 accepts the inputs for the Subcooling Margin Monitor function and perforns related calculations. Chassis #2 accepts the CET and HJTC inputs and performs the related calculations. The heater controllers associated with the HJTC function are controlled by signals from Chassis #2.
A serial data link connects Chassis #1 and Chassis #2. Some data from Chassis #1 is sent to Chassis #2 for use in calculations. All data is gathered and calculated by Chassis #2 and is sent to Chassis #1.
NRC 7ORM 366A U.S. NUCLEAR REGULATORY COMMISSION (7-201)
LICENSEE EVENT REPORT (LER)
TEXI CONTINUATION FACIUTY NAME (1)
DOCKET LER NUMBER (6)
PAGE (3)
NUMBER 2 YEAR SEQUENTIAL REVISION Turkey Point Unit 4 05000251 I
NUMBER NUMBER Page 3 of 5 2003 001 00 TEXT (If more space Is requiredL use additional copies of NRC Forn 36A) (17)
The QSPDS has a hardware failure monitoring function, which can be interpreted through a series of error codes. However, no codes were captured before the system was reset. The system vendor however reported that the system is not designed to detect or indicate failures of the type observed and expressed doubt that capture of the hardware error codes would have helped to further define the problem. This is the first recorded QSPDS failure of this type at Turkey Point. The system vendor reports that QSPDS system failures of this type have not been seen or reported at any other site. This appears to be an isolated event, which is of a nature that may not be repeatable.
Cause of the Event
The apparent cause of the 4A QSPDS channel failure is a sticking input relay on one of the thermocouple input boards on Chassis #2. Chassis #2 input cards use flying capacitor relays which have moving parts.
Failure of an input relay to open up could have halted the scanning of all channels on the chassis, resulting in channel failure. Physical disconnects such as a disconnected cable, connector or pin were eliminated as possible causes because a system reset cleared the failure.
The cause of the failure to recognize inoperability of the 4A QSPDS channel was due to the method of monitoring the QSPDS channels. Flat-lining of the 4A QSPDS channel was not recognized at steady state conditions since no deviation between the channel readouts could be seen at steady-state operating conditions. The monthly TS surveillance for the QSPDS channels could not identify the failure because it compares the channels for deviations and could not detect a deviation between the channels at steady state conditions.
This QSPDS system is considered obsolete and the Chassis thermocouple input boards for the failed channel are currently unavailable. Since plans exist to upgrade this QSPDS system in 2004/2005, and since the apparent cause of the Chassis thermocouple input boards failure is not conclusive, the near term corrective actions are to increase QSPDS channel input parameter monitoring to ensure TS compliance.
Analysis of the Event
On April 11, 2003, review of system archive files from other computer systems receiving inputs from QSPDS revealed that on March 22, 2003 at approximately 6:40 PM, all CETs and HJTCs for the 4A QSPDS channel had stopped updating as indicated by flat-lining of indicator trends. CET Subcooling Margin Monitor, the In-Core Thermocouples, and the Reactor Vessel Level Monitoring System inputs to the 4A QSPDS channel had stopped responding to actual plant conditions. This trend was not recognized from March 22 to April 10 due to steady state plant conditions at 100 percent power. The monthly channel TS surveillance for the QSPDS had been performed as a Post Maintenance Test (PMT) for repairs to the 4B QSPDS on April 9, 2003. However, this test, which logs and compares readouts between channels, could not detect discrepancies between the channels at steady state plant conditions and could not identify the channel failure. Only during the power maneuver on April 10, 2003 was the flat-line trend finally recognized. The channel remained inoperable until it was reset and operability testing was NRCfORM 36A U.S. NUCLEAR REGULATORY COMMISSION (7-2001)
LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION FACIIITY NAME (1)
DOCKET LER NUMBER (6)
PAGE (3)
YEAR SEQUENTIAL REVISION Turkey Point Unit 4 05000251 I
001 00 Page 4 of 5 1
.,,.2003 001 00 TEXT of more space Is requrec Lse oddiflonal copies of NRC Fofn 366A) (17) completed at approximately 4:22 AM on April 10, 2003. Based on the archive file reviews, this event was determined to be reportable on April 15, 2003, under the criteria of 10 CFR 50.73 (a)(2)(i)(B).
Action Statement 31 of TS 3.3.3.3, applicable to In-Core Thermocouples, states that if the number of OPERABLE channels is less than the Total Number of Channels, either restore the inoperable channel to OPERABLE status within 7 days or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in at least HOT SHUTDOWN within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Action Statement 37 of TS 3.3.3.3, applicable to the Reactor Vessel Level Monitoring System, states that if the number of OPERABLE channels is one less than the Total Number of Channels, either restore the inoperable channel to OPERABLE status within 7 days or, if repairs are not feasible without shutting down, prepare and submit a Special Report to the NRC within 30 days following the event.
Since one channel had been inoperable for a period of approximately 18 days, 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> and 42 minutes, Unit 4 had inadvertently exceeded the 7-day Technical Specification (TS) Action Statements 31 and 37 of Accident Monitoring Technical Specification 3.3.3.3 for inoperability of the 4A Channel of the In-Core Thermocouples, and the Reactor Vessel Level Monitoring System. As such, this event is reportable under 10 CFR 50.73 (a)(2)(i)(B), since failure of the 4A Channel of the QSPDS existed longer than allowed by the applicable TS 7-day shutdown Action Statements.
A review of maintenance history identified that during the period in which the 4A QSPDS channel was out of service, the 4B QSPDS channel was removed from service for maintenance for a period of 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and 29 minutes. Action Statement 32 of TS 3.3.3.3, applicable to In-Core Thermocouples, states that with both required channels inoperable, either restore the inoperable channel(s) to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in at least HOT SHUTDOWN within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Action Statement 38 of TS 3.3.3.3, applicable to the Reactor Vessel Level Monitoring System, states that with both the required channels inoperable, either restore the inoperable channel(s) to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or if repairs are not feasible without shutting down, initiate an alternate method of monitoring the reactor vessel inventory, submit a Special Report to the NRC within 30 days of the event, and restore at least one channel to OPERABLE status at the next scheduled refueling. The review indicated that the 4B Channel QSPDS's outage time of 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and 29 minutes due to maintenance while the 4A QSPDS Channel was inoperable, had not exceeded the TS 3.3.3.3 48-hour Action Statement for inoperability of two channels.
It should be noted that although the 4A Channel CET Subcooling Margin Monitor, Reactor Vessel Level Monitoring and CET indications were incorrect, the 4A RCS Subcooling Margin Monitor indication was unaffected by the event and continued to accurately report RCS subcooling margin.
Analysis of Safety Significance The QSPDS is not credited in any plant safety analysis as described in the Updated Final Safety Analysis Report (UFSAR) and QSPDS provides no automatic safety functions. The primary purpose for QSPDS is to aid operators in determining if inadequate core cooling conditions exist during post accident monitoring. The QSPDS system is used throughout the Emergency Operating Procedures for determination of RCS and CET subcooling margin, inventory and level indications and as input to NRC ORM 366A U.S. NUCLEAR REGUlATORY COMMISSIONU.S. NUCLEAR REGLTORY COMMISSION (7-2001)
LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION FACIULTY NAME (1)
DOCKET LER NUMBER (6)
PAGE (3)
YEAR SEQUENTIAL REVISION Turkey Point Unit 4 05000251 l
NUMBER NUMBER Page 5 of 5 2003 001
- - 00l TEXT (7f more space Is requirec use additional copies of NRC Form 366A) (7)
Reactor Coolant Pump tripping criteria. As such, the QSPDS system instrumentation is classified as Type A Variable under the guidance of Regulatory Guide 1.97, Rev. 3, "Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident." Type A Variable instruments are defined as instruments which provide primary information required to permit the control room operators to take specific, manually controlled actions for which no automatic control is provided and that are required for safety systems to accomplish their safety function for design basis events.
Two independent and redundant QSPDS channels provide indication to operators in the control room.
Post accident assessment and monitoring is performed by control room operators and Shift Technical Advisors (STAs) who are trained to use both channels and to make conservative decisions based on their indications.
The safety significance for failure of a single QSPDS channel is low, since control room operators and the Shift Technical Advisor would have noted the failure of the 4A channel by comparison of its indications with its opposite channel. Indication of the failure of the 4A channel would be more pronounced during accident conditions, showing a larger deviation with its opposite channel than was observed during at-power conditions. Upon determination that channel indication was in error, operators would have taken the same action as in this event to reset the 4A Channel, restoring proper indication. Thus, failure of a single channel of QSPDS in this manner would have been recognized and would not have led to misdiagnosis of accident conditions.
This event did not compromise the health or safety of plant personnel or the general public.
Corrective Actions
- 1. Operations logs have been changed to require monitoring and trending of QSPDS once per shift.
- 2. Operations logs have been updated to provide instructions to ensure Engineering will capture QSPDS system error codes prior to channel reset if another failure should occur.
- 3. Engineering is reviewing QSPDS system trends bi-weekly.
Additional Information
A review of Turkey Point LERs indicates that no similar QSPDS failure events have occurred in the past.
The QSPDS vendor also reports that they do not have any previous history of this type of failure.
EUS codes are shown in the format [EIIS SYSTEM: iEEE component function identifier, second component function identifier (if appropriate)].