05000263/LER-2017-006
| Monticello Nuclear Generating Plant | |
| Event date: | 11-14-2017 |
|---|---|
| Report date: | 01-12-2018 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor |
| 2632017006R00 - NRC Website | |
| ML18012A868 | |
| Person / Time | |
|---|---|
| Site: | Monticello  |
| Issue date: | 01/12/2018 |
| From: | Church C R Northern States Power Company, Minnesota, Xcel Energy |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| L-MT-18-003 LER 17-006-00 | |
| Download: ML18012A868 (5) | |
comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person Is not required to respond to, the information collection.
Monticello Nuclear Generating Plant 05000-263 2017 - 00
EVENT DESCRIPTION
On November 14, 2017, the Monticello Nuclear Generating Plant (MNGP) was operating in Mode 1 at 100% Power. It was identified that the use of the Reactor Protection System (RPS) test fixture described in some operations procedures would result in the loss of two RPS reactor Scram functions. The test fixture used in surveillance procedures 0008, Main Steam Isolation Valve Closure Scram Test Procedure and 0009, Turbine Stop Valve Closure Scram Test Procedure, unintentionally resulted in the loss of Technical Specification (TS) Table 3.3.1.1 Function 5, Main Steam Isolation Valve-Closure and Function 8, Turbine Stop Valve- Closure. It was concluded that closure of three of four Main Steam Lines (MSLs) or Turbine Stop Valves (TSVs) would not necessarily have resulted in a full Scram during testing depending on the combination of closed valves during the bypass condition.
Operations procedures were revised to incorporate the use of the test fixture on December 29, 2008 for the TSV Closure Scram Test Procedure and February 4, 2009 for the Main Steam Isolation Valve (MSIV) Closure Scram Test Procedure.
Use of the test fixture was intended to eliminate the need to initiate half Scrams during calibration or functional testing of the RPS instrumentation.
On March 7, 2009, the test fixture was first applied during the TSV functional test and during MSIV functional testing on July 11, 2009. The test fixture was applied during quarterly surveillances through September 16, 2017.
On November 14, 2017, a condition report was generated after performance of an operating experience evaluation of a similar event at another station. The event was determined to be applicable to the MNGP and concluded that MNGP's method of using the test fixture for channel functional testing of the MSIV and TSV RPS functions makes the required number of operable instrument channels insufficient to meet the TS Bases B 3.3.1.1 description for Action C.1. The operations procedures utilizing the RPS test fixture were subsequently quarantined.
On December 8, 2017 and December 11, 2017, the 0009 and 0008 surveillance procedures were revised to remove the use of the RPS test fixture.
EVENT ANALYSIS
The unintended loss of RPS trip functions during performance of RPS surveillance procedures 0008 and 0009 resulted in a NRC reportable condition under 10CFR 50.73(a)(2)(v) as, any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to: 10CFR 50(a)(2)(v)(A) shutdown the reactor and maintain it in a safe shutdown condition, and 10CFR 50(a)(2)(v)(D) mitigate the consequences of an accident. This event is considered a Safety System Functional Failure per NEI 99-02, Revision 7.
The RPS is arranged as two separately powered trip systems, trip system A and trip system B. The automatic trip logics of trip system A are trip logics Al and A2. Similarly, the trip logics for trip system B are trip logics B1 and B2. Each of the two trip logics used for automatic trip signals receives input signals from at least one trip channel for each monitored variable. Thus, two trip channels are required for each monitored variable to provide independent inputs to the trip logics of one trip system. At least four trip channels for each monitored variable are required for the trip logics of both trip systems.
For Function 5, Main Steam Isolation Valve-Closure, the logic arrangement within the automatic Scram trip logic is arranged as such that a reactor trip occurs for the condition where three or more MSLs are less than 90% open. This means that one of two, or both, MSIVs in a MSL are less than 90% open. This occurs as the logic uses valves A and B for the Al trip logic, C and D for the A2 trip logic, A and C for the B1 trip logic, and B and D for the B2 trip logic. By varying the order in which the auxiliary relay contacts are paralleled within each RPS trip logic it can be assured that a half Scram will occur in each trip system even if a failure of all the MSL switches occurs on a MSL. In total, the MSIV comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the Information collection.
Monticello Nuclear Generating Plant 05000-263 2017 - 00 closure function contains eight trip channels and four auxiliary relays per trip system.
For Function 8, Turbine Stop Valve-Closure, the logic arrangement within the automatic Scram trip logics is arranged as such that a reactor trip occurs for the condition where three or more TSVs are less than 90% open. This occurs as the logic uses TSV-1 and TSV-2 for the Al trip logic, TSV-3 and TSV-4 for the A2 trip logic, TSV-1 and TSV-3 for the B1 trip logic, and TSV-2 and TSV-4 for the B2 trip logic. By varying the order in which the auxiliary relay contacts are paralleled within each RPS trip logic it can be assured that a half Scram will occur in each trip system provided both contacts on a TSV fail. In total, the TSV closure function contains four trip channels and four auxiliary relays per trip system.
When the test fixture is applied while testing Function 5, Main Steam Isolation Valve-Closure, in the Al trip logic, the test fixture is applied over two different auxiliary relay contacts, which are arranged in parallel. The MSIV function contains two trip channel sensors (inboard and outboard MSIV limit switches) in series with the trip auxiliary relay. When the test fixture is applied, four trip channels or two MSL channels are placed in an inoperable status within a trip logic due to its parallel configuration. Similarly, when testing is performed on Function 8, Turbine Stop Valve-Closure, the test fixture is applied over two different auxiliary relay contacts, which are arranged in parallel. Each auxiliary relay receives input from a TSV trip channel sensor within a trip channel. When the test fixture is applied, two trip channels or TSVs are placed in an inoperable status within a trip logic due to its parallel configuration.
While a valid Group 1 Isolation (closure of all four MSLs) would still have resulted in a full Scram, the TS Bases statement for operability of the MSIV logic was not met. Similarly, when the test fixture is applied for TSV testing two of the four channels are bypassed. A turbine trip resulting in a hydraulic trip signal to all four of the TSVs would still have resulted in a full Scram, however, the TS Bases statement for operability of the TSV logic was not met. Certain combinations of three of four MSLs and TSVs would not have resulted in a Scram. It is therefore concluded that MNGP's method of using the test fixture for channel functional testing of the MSIV and TSV RPS functions makes the required number of operable instrument channels insufficient to meet the TS Bases B 3.3.1.1 description for Action C.1.
TS 3.3.1.1 Condition C requires restoring RPS trip capability. For Function 5, Main Steam Isolation Valve-Closure, this would require both trip systems to have each channel associated with the MSIVs in three MSLs (not necessarily the same MSLs for both trip systems) OPERABLE or in trip (or the associated trip system in trip). For Function 8, Turbine Stop Valve-Closure, this would require both trip systems to have three channels, each OPERABLE or in trip (or the associated trip system in trip).
The required action and completion time for TS 3.3.1.1 CONDITION C:
C. REQUIRED ACTION - Restore RPS trip capability, COMPLETION TIME - 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Condition C was applicable to both the MSIV and TSV RPS logic functional testing.
The longest time the test fixture was applied during the last three years was 37 minutes for the MSIV surveillance and 62 minutes for the TSV surveillance. TS 3.3.1.1 Required Action C.1 was not entered during the performance of the surveillance and in one case the test fixture was applied longer than the one hour allowance for restoring the inoperable RPS channel to service (62 minutes on January 6, 2017 for TSV testing). However, the channel functional test completion time of 62 minutes was within required four hours to reduce thermal power to less than or equal to 40% RTP per TS 3.1.1.1 Required Action E.1.
SAFETY SIGNIFICANCE
The RPS initiates a reactor Scram when at least one MSIV in three of four MSLs close (Function 5) or when three of four TSVs close (Function 8). The automatic MSIV and TSV closure reactor Scrams preserve the integrity of the fuel cladding comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to Impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the Information collection.
Monticello Nuclear Generating Plant 05000-263 2017 - 00 and the Reactor Coolant System (RCS) in anticipation of the transients caused by closure of these valves.
With the test fixture applied, certain combinations of three of four MSL or TSV closure signals would not necessarily have resulted in a full Scram. This condition would require a single failure, or multiple failures, within a RPS trip system that is being functionally tested. A single failure of an inboard or an outboard MSIV position indication switch associated with either MSL channel not bypassed by the test fixture will not prevent a half scram from occurring. Only the simultaneous failure of both the inboard and outboard valves to close, failure of both the inboard and outboard position indicating switches to open, or an auxiliary relay failure which causes an auxiliary relay to not drop out (armature binding) would defeat a scram. Similarly for TSV testing, a failure of a TSV to close, failure of a position indicating switch, or a failure of the auxiliary relay to drop out would need to occur to prevent a Scram. Each of these MSIV and TSV events would be highly unlikely to occur and would need to occur within the same trip system that is being functionally tested but on the opposite trip logic. As a result, the safety significance of this condition is low.
While a valid Group 1 Isolation (closure of all four MSLs) would still have resulted in a full Scram, the Technical Specification Bases action statement for operability of the MSIV logic was not met. Similarly, a turbine trip resulting in a hydraulic trip signal to all four of the TSVs would still have resulted in a full Scram, however, the Technical Specification Bases action statement for operability of the TSV logic was not met.
CAUSE
Operations procedures were revised to incorporate the use of the test fixture to reduce the number of half Scrams received during surveillance testing in December, 2008 for the TSV Closure Scram Test Procedure and February, 2009 for the MSIV Closure Scram Test Procedure, which unintentionally resulted in the loss of TS Table 3.3.1.1 Function 5, Main Steam Isolation Valve-Closure and Function 8, Turbine Stop Valve-Closure. The preparer and reviewers of the screenings and procedure changes did not recognize the installation of the test fixture disabled trip Function 5, Main Steam Isolation Valve-Closure and Function 8, Turbine Stop Valve-Closure. The preparer and reviewer had an inaccurate mental model that it was acceptable to use the test fixture on all RPS functions to prevent a half Scram. Due to the inaccurate mental model, the potential impact of the parallel auxiliary relay was not evaluated. This allowed the number of operable channels of both MSIV and TSV RPS functions to be reduced such that the RPS trip capability was not maintained as described by the TS 3.3.1.1 Bases B 3.3.1.1 description for Action C.1.
CORRECTIVE ACTION
The operations procedures were quarantined until December 8, 2017 and December 11, 2017 when the 0009 and 0008 surveillance procedures were revised to remove the use of the RPS test fixture.
PREVIOUS SIMILAR EVENTS
There were no similar MNGP Licensee Event Reports during the past three years.
- 006