05000269/LER-2006-005
| Docket Number | |
| Event date: | |
|---|---|
| Report date: | |
| Initial Reporting | |
| 2692006005R01 - NRC Website | |
EVALUATION:
BACKGROUND
The Low Temperature Overpressure Protection (LTOP) System protects the reactor vessel [RPV] from excessive pressures at low temperature conditions. The LTOP system is comprised of two diverse trains. One train is a power operated relief valve (PORV)[RV] with a lift setpoint based upon the low temperature pressure limits. The second train consists of operator action, assisted by administrative controls, alarms, and an operating philosophy that maintains a steam or gas bubble or air space in the pressurizer [PZR] during all modes of operation (except for inservice hydrotesting). A control room operator, provided with approved procedures, monitors Reactor Coolant System (RCS)[AB] pressure and pressurizer level during operations at RCS temperatures below 325 F. In addition, alarms are provided to alert the operator that an overpressure event is occurring. The LTOP analysis credits either a RCS pressure or pressurizer level alarm [ALM] to alert the operator. These alarms ensure that time is available for the operator to mitigate an overpressure event prior to exceeding the low temperature pressure limits.
Two RCS pressure instrumentation channels are provided for the LTOP system. The first of these (channel 1) contains the low range RCS pressure transmitter [PT] with associated Operator Aid Computer (OAC) [CPU] point 01A2004 for control room indication [PI] and alarm capability. This instrument channel provides the actuation signal for the PORV, and its alarms are not credited for the operator action LTOP train. The second instrument channel (channel 2) contains the RCS narrow range pressure transmitter (RPS Channel C) [PT] which is re-ranged for LTOP service prior to entering LTOP conditions. A jumper is installed to send the signal to OAC point 01A2235. This channel contains the alarms credited for the operator action LTOP train. It does not provide an actuation signal to the PORV.
Technical Specification (TS) 3.4.12 requires two trains of Low Temperature Overpressure Protection to be operable in Mode 3 when the RCS temperature is below 325 F. Required Action F.1 of this specification states that an inoperable administrative controls train (Condition F) requires compensatory measures to be taken within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. If compensatory measures are not implemented within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (Condition G), Required Action G.1 requires the RCS to be depressurized and a vent path capable of mitigating the most limiting LTOP event must be established within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
At the time this event occurred, Unit 1 was in Mode 3 starting up from refueling outage 1EOC23. The RCS was increasing in pressure and temperature but still below 325 F. As noted above, TS LCO 3.4.12 requires two operable LTOP trains in this operating condition. Prior to this time (during No Mode), the jumper from the Narrow Range Pressure transmitter instrument loop to OAC point 01A2235 was disconnected and wrapped with electrical tape, disabling the credited instrument loop for the operator action LTOP train. This action was not documented and was not made known to control room operators. Due to the design of the instrument loop, OAC point 01A2235 continued to read near zero psi in the control room (an expected reading for much of the outage) instead of alerting the operator to a "faulted" or "bad input" condition. Had the control room operators known about the disabled instrument loop, TS Condition F would have been entered when the RCS vent paths were closed on startup, and a dedicated LTOP operator would have been designated as a compensatory measure as required by TS.
Without prior knowledge of the disabled instrument loop, however, no compensatory measures were taken within the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> action time required by TS. In this condition, TS requires depressurization of the RCS and creation of a vent path within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to eliminate the potential for overpressurization. Again, without knowledge of the disabled instrument train, this action was not taken. At the end of the 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> required action time, the plant was being operated in a condition prohibited by TS. This condition is reportable under 10 CFR 50.73 (a)(2)(i)(B).
There were periods during the time of LCO applicability when a dedicated operator was assigned for reasons other than the disabled instrument loop. This action restored TS compliance for those periods of time, but not for the entire period of LCO applicability. The net effect of these actions reduced the exposure time (time in LCO noncompliance) from about 11 days to approximately 45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br />. A detailed timeline of this event is provided below.
EVENT DESCRIPTION
October 7, 2006:
Shutdown of Unit 1 commences for a scheduled refueling outage (1E0C23). LTOP conditions are entered at approximately 0713 hrs when RCS temperature drops below 325 F in Mode 3. Operator Aid Computer (OAC) data indicates computer point 01A2235 (indicating output of narrow range pressure transmitter in LTOP RCS pressure channel 2) is responding to pressure changes.
October 10, 2006:
RCS vent path is established at 0000 hrs following removal of upper primary steam generator hand hole covers. LTOP LCO conditions are exited. OAC data indicates 01A2235 is still responding to pressure changes. This indicates that the lifting of the lead from the narrow range transmitter has not yet occurred.
October 25, 2006 OAC data shows that 01A2235 was indicating pressure fluctuations between 0815 hrs and 0915 hrs. A work order search discovered that a procedure was being run at this time to check the RPS alarms (Work Order 01671047-01). The observed response of OAC point 01A2235 is believed to have been the result of testing RPS channel C. This indicates that the jumper was in place at this time.
November 27, 2006:
Unit 1 is in Mode 5. Steam generator upper primary hand hole covers are installed at approximately 1900 hrs. LTOP conditions are entered. Narrow range transmitter is not responding to pressure changes and is reading about 1.9 psi versus the low range reading of about 13.5 psi. Operators do not expect a response from the Narrow Range pressure transmitter at this low pressure. Operating experience has shown that the Narrow Range transmitter begins to respond when there is approximately 20 psi differential between it and the Low Range transmitter. TS 3.4.12 Condition F is entered at 1916 hrs due to Bank 3 pressurizer heaters [HTR] being energized.
Dedicated LTOP operator is assigned, and Unit 1 is in compliance with TS.
December 5, 2006:
Bank 3 pressurizer heaters are de-energized at 0206 hrs and dedicated operator is released from LTOP duty. Operators do not recognize that LTOP RCS pressure instrument channel 2 is inoperable and TS 3.4.12 Condition F is still applicable. Required action F.1 is not met within the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> completion time (dedicated LTOP operator is not assigned). At 0606 hrs, Condition G is entered but not recognized by operators. At 1620 hrs Condition F is entered again because High Pressure Injection System (HPI)[BG] throttle valve [FCV] 1HP-120 travel stops are not in place. A dedicated LTOP operator is assigned, satisfying Required Action F.1, and. TS compliance is restored. At 2122 hrs, travel stops are installed on 1HP-120 and dedicated LTOP operator is released. Condition F is still applicable but not recognized.
December 6, 2006:
Required action Fl to assign a dedicated operator is not met within the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> completion time. Condition G is applicable at 0122 hrs but not recognized, and Required Action G.1 is not pursued.
Completion time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> expires for Required Action G.1 at 1322 hrs. Unit 1 is in non-compliance with TS at 1322 hrs.
December 8, 2006:
RCS temperature increases above 325 F in Mode 3 at 1026 hrs. LTOP conditions are exited. Narrow range pressure transmitter is still indicating about 1.9 psi versus a low range pressure transmitter reading of 466 psi. Unit has been operated in condition prohibited by Technical Specifications for approximately 45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br />.
December 9, 2006:
At approximately 0216 hrs, while in Mode 3 with RCS temperature above 325 F, LTOP instrument channel 2 was found disabled.
Instrumentation technician performing restoration procedures for RCS narrow range pressure transmitter 1RCPT0019P discovers the jumper to computer point 01A2235 has been disconnected in computer cabinet 1-1-2 and the end of the wire wrapped with electrical tape.
The presence of the tape indicates removal is recognized but not documented or reported to the control room. Therefore, the time of occurrence is unknown.
Prior to this event Unit 1 was shut down for refueling. OAC computer points 01A2235 (RCS Narrow Range pressure transmitter indication) 01L3169 (LTOP RCS Pressure High (Channel 2) alarm), and 01L3168 (LTOP Pressurizer Level High (Channel 2) alarm) were out of service prior to the event. No other safety systems were out of service that would have contributed to this event.
This event is reportable per the criteria of 10CFR50.73 (a)(2)(i)(B) because the unit operated for approximately 45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br /> in a condition prohibited by TS.
CAUSAL FACTORS
Operation with an inoperable narrow range. RCS pressure indication while in LTOP LCO applicability is a condition prohibited by Technical Specifications (TS) 3.4.12. Operation in this condition was caused by a number of factors, which are discussed below.
1) A latent design error existed in the narrow range RCS pressure instrument loop. A buffer in the circuit converts the 4-20 mA transmitter output to a 0-10 v signal which is sent to the OAC.
The OAC will generate a BAD message when the output signal from the buffer is more than 5% outside of the expected range. This would require a reading of -0.5 v to generate the BAD quality message.
Since the buffer cannot generate a negative voltage signal, an open circuit cannot be detected with this setup. Due to this latent design error, the OAC point continued to receive a zero voltage signal and read approximately 0 psig with a GOOD quality message after it was disabled, even though the circuit was open. This was an expected reading for about a month after the instrument channel became inoperable, because the RCS was depressurized and vented to atmosphere during this time. Operators perform a surveillance on this OAC point once per shift, but are trained to look for a reading and a valid message (other than BAD) to verify the point quality. Thus, prior to heatup there was no indication that the instrument loop was inoperable.
2) During heatup, procedural guidance directed operators to use the low range RCS pressure instrument loop for maneuvering the plant.
Trending of the narrow range RCS pressure indication and comparison to the low range RCS pressure indication was only directed by procedure when a dedicated operator is in place. The procedural guidance allowed trending of wide range RCS pressure instrumentation in the event that the narrow range instrument was unavailable or not trending. Due to the differences in readings between the low range and narrow range instruments, it is not unusual that the operators would trend the low range and wide range instruments to meet this requirement. Operating procedures did not specify an acceptance criterion controlling the acceptable variance between the low range and narrow range instruments, and the computer point continued to read "Good". Therefore, operators did not suspect inoperability of the narrow range indication.
3) An additional contributing cause for this event is the inappropriate action of lifting the lead to the OAC point. This occurred while workers were deleting wires for 1EOC23 instrumentation modifications in close proximity to the LTOP jumper. The wire was erroneously removed along with a number of other wires in the same cabinet. Failure to perform an adequate self-check while executing this task resulted in this inadvertent removal going undetected. Inadequate procedural controls were also a factor in both the occurrence of the inappropriate action and the failure to detect the error.
CORRECTIVE ACTIONS
Immediate:
None. When the event was discovered, the condition of applicability of the LCO had been exited. Therefore, no .immediate corrective actions were required.
Subsequent:
1) The correct configuration of the narrow range pressure transmitter instrument loop was restored per normal procedure.
2) An acceptance criterion has been defined for the variance between the indications on the low range and narrow range instrument loops.
3) Procedure changes have been made to require a channel check once per shift. The channel check will ensure the two instruments agree within the acceptable variance.
Planned:
1) A permanent modification will be implemented to install a new instrumentation loop for RCS pressure indication and alarm. This loop will have proper range for the required service and will provide for proper OAC point quality to the operators.
2) Oconee will assess the need for training on the guidance in site directives concerning the determination of. Temporary Implementation Procedure (TN) applicability to modifications.
3) An extent of condition review will be conducted to determine whether or not there are other OAC points used to satisfy TS requirements which might have a similar latent design error.
4) This event will be reviewed for cross-cutting issues.
There are no NRC commitment items contained in this LER.
SAFETY ANALYSIS
This event did not include a Safety System Functional Failure. The disconnected jumper in instrument channel 2 made the control room alarms for high RCS pressure inoperable. Without a dedicated LTOP operator to monitor the RCS pressure, it is possible that the operator action train of LTOP might not have diagnosed and terminated an LTOP event within the required 10 minute window credited for this event. The other train of LTOP (PORV), however, remained fully operable and available for the entire duration of the event. Therefore, the effect of the inoperability in the operator action train would have been a loss of redundancy and failure to satisfy design basis single failure criteria for a period of time. Nevertheless, the LTOP system would have been fully capable of mitigating the consequences of all LTOP scenarios for which it was designed. There would have been no loss of system function as a result of this event. Therefore, this event is. not classified as a Safety System Functional Failure.
The Low Temperature Overpressure Protection (LTOP) System is required to mitigate consequences of all identified LTOP scenarios by providing either an adequate relief path or administrative controls to ensure that more than 10 minutes are available for operator actions to terminate the LTOP event before the RCS pressure limits are reached. These functions provide protection for the Reactor Coolant System pressure boundary, which is a principal fission product barrier.
Since a redundant train of LTOP was available at all times during the reported event, all system functions of the LTOP.system would have been performed by the unaffected system train (PORV) as designed. Therefore, there would be no adverse effect on fission product barriers as a result of this event, and no impact to the health and safety of the public.
The core damage significance (CDS) of this event has been evaluated quantitatively using the Oconee PRA Model and considering the following:
- The probability of a through-wall crack given an LTOP event
- The duration of the LCO non-compliance (45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br />) Based on this analysis, this event has a small impact, on Plant Core Damage Risk. The Core Damage impact is below the precursor value of 1E-06.
ADDITIONAL INFORMATION
There were no releases of radioactive materials, radiation exposures or personnel injuries associated with this event.
This event is not considered reportable under the Equipment.
Performance and Information Exchange (EPIX) program. The LTOP system is not an EPIX related system and there were no actual component failures.