05000315/LER-2001-002
| Docket Number | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 3152001002R00 - NRC Website | |
FACILITY NAME (1) DOCKET NUMBER(2) LER NUMBER (6) PAGE (3) Donald C. Cook Nuclear Plant Unit 1 05000-315 Conditions Prior to Event Unit 1 was in Mode 1, Power Operation, at 100 percent rated thermal power Unit 2 was in Mode 1, Power Operation, at 100 percent rated thermal power
Description of Event
On June 22, 2001, the power range nuclear instrumentation (PRNI) channel functional test for the Unit 1 quarterly calibration was not conducted in accordance with Technical Specification (TS) 3.3.1.1, Table 3.3-1, Action 2a.
This TS requires placing the inoperable PRNI channel in the tripped condition within one hour. To meet TS requirements, the PRNI channel is placed in trip before the detector is disconnected. Contrary to the TS requirements, the calibration procedure for the PRNI's returns the bistables to an un-tripped state while the detectors are still disconnected and after the channel has been inoperable for greater than one hour.
The TS non-compliance was introduced into the calibration procedure when it was revised to allow testing of the alarms.
The Unit 1calibration procedures were revised on November 20, 2000, the Unit 2 calibration procedures on February 2, 2000. These changes were made as a corrective action for a Condition Report. Procedure reviews and test performances since the change had not detected the TS non-compliance. On June 26, 2001, another CR was written which identified the potential TS non-compliance; however, the concern was evaluated, via the corrective action program, and dispositioned as a procedural enhancement. At that time, a 10 CFR 70.73 reportability review was not conducted.
The potential reportability of this event was not realized until July 9, 2001, when a procedure writer, working on updating the PRNI channel functional test procedures, questioned TS compliance. The second CR was written July 11, 2001, because the first CR did not recognize the significance of the condition, or its reportability. On July 11, 2001, this event was determined to be reportable in accordance with 10 CFR 50.73(a)(2)(i)(B) as a condition prohibited by the plants TSs.
Specifics Concerning the Procedure Problems:
The combined surveillance procedures provide identical instructions for the performance of the calibration and functional testing of the four PRNI channels for the respective units. The surveillance functional testing portion of the procedure(s) complies with TS requirements. In these procedures, the channel calibration involves unplugging the SSPS connector, which causes the associated Solid State Protection System (SSPS) Power Range Channel trips. This connector is moved early in the procedure for calibration since it is known that the calibration will take longer than one hour to perform.
During calibration, the portion of the channel functional test that checks bistable trip values (using the lobal front panel indicators) is performed, since disconnecting SSPS has no effect on the bistable indicators on the local PRNI drawer.
Since the remote annunciators and lights cannot be checked with SSPS disconnected, SSPS is reconnected and the test signal is used to check that the associated remote status lights and annunciators illuminate. This is performed to satisfy both the TS definition of calibration and to verify a proper connection when SSPS is restored. However, the detectors remain disconnected and the PRNI channel remains inoperable. As such, if the channel has been disabled for more than one hour, the facility is not in compliance with TS 3.3.1.1, Table 3.3-1, Action 2a, because the bistables are not in the tripped condition.
Procedure History:
Generic Letter 96-01 requires that surveillance procedures that test logic circuits required to perform a safety function or whose failure could affect a safety function be reviewed to assure that adequate overlap testing is being performed to meet TS requirements. The Reactor Protection System (RPS), Engineered Safety Feature Actuation System (ESF) and Emergency Diesel Generator (EDG) load shed and sequencing circuits are systems specifically addressed in GL 96-01.
Surveillance testing of automatic actuation logic circuits of system functions credited in the accident analysis with surveillance requirements in the TS is also addressed in GL 96-01. Cook Nuclear Plant (CNP) documented its implementation GL 96-01 test requirements to the Nuclear Regulatory Commission (NRC) in October 1997.
Prior to the 1997 unit shutdowns, the functional test procedures for both units permitted N/A to be entered for the status lights that had setpoint values below the existing reactor power. Consequently, the control board status lights for P8, P10 and the Low Range High Flux Trip would not have been routinely checked when exercising the bistables.
Prior to October, 1997, PRNI calibration was detailed in calibration procedures. These procedures did not check the status lights or annunciators when exercising the bistables, since removing the SSPS connector early in the procedure disconnected the SSPS from the PRNI drawers. The functional and calibration procedures were combined into a single procedure on October 26, 1997 (Unit 1) and October 18, 1997 (Unit 2). However, because both units were shutdown in September, 1997, these procedures were not required to be performed until the units were in Modes land 2.
The expanded system readiness review, conducted as part of the restart effort, identified several discrepancies that led to an in depth independent review of CNP's GL 96-01 response to the NRC. CR 99-16305 was written on June 22, 1999, as a result of this review which determined that not checking the remote indicators and annunciators was not in compliance with the TS 1.9.A definition of "calibration." This condition was identified in July 1999, and reported in LER 315/99-021-00.
CR 99-16305 determined that during the calibration, testing of the remote indicators and annunciators could be done with the detector signals disconnected by restoring SSPS before restoration of the detector inputs. Therefore, the procedure restoration steps were re-sequenced so that SSPS is connected before the detector signal cables are connected. This permitted a check of the remote status lights and annunciators affected by SSPS being disconnected. This resulted in compliance with TS 1.9.A, but introduced the procedure error resulting in non-compliance with TS 3.3.1.1. This revision was input into the combined procedures on November 20, 2000, for Unit 1, and on February 2, 2000, for Unit 2.
The quarterly calibration surveillances detailed in the combined procedures were not performed since both units were shutdown. Since the restart of both units, the quarterly surveillances for Unit 1 and Unit 2 have been performed three and six times, respectively, without the error being discovered.
Cause of Event
The apparent cause of the event was a less than adequate preparation and review of the implementing procedure. This resulted in a failure to recognize this new error introduced while resolving identified Generic Letter 96-01 deficiencies. The manner in which the testing is performed requires the detector to be disconnected from the instrumentation. This makes the channel inoperable. Since the channel calibration takes longer than one hour to perform, the channel is placed in the tripped condition. To complete the test, the channel must be taken out of the tripped condition prior to reconnecting the detector input. The channel remains inoperable because the detectors are still disconnected; thus, TS 3.3.1.1, Table 3.3-1, Action 2a, can not be met. A review of the surveillance test procedures concludes that the test cannot be performed in a manner that is consistent with meeting the current one-hour completion requirement of Action 2a.
The failure to recognize the significance of this event when initially identified on June 26, 2001, is being addressed through the CNP corrective action program.
Analysis of Event
One PRNI channel being inoperable and in an un-tripped condition was not a precursor to any accident and thus does not significantly increase the probability of occurrence of any accident previously evaluated. Due to the redundancy in the reactor trip logic, the channel remaining in an un-tripped condition still allows a two-out-of-three reactor trip logic. This ensures that even if another channel failed, the reactor trip, if required, would still function. Thus, the condition does not represent a significant reduction in a margin of safety.
This condition did not represent a significant degradation of plant safety, or prevent the fulfillment of safety-functions needed to shutdown the reactor, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident.
Corrective Actions
In order to restore compliance with the TS, the one-hour completion requirement needed to be increased to a time that would allow completion of the required testing prior to returning the instrument to service. On August 8, 2001, CNP received NRC approval of a license amendment to revise TS 3.3.1.1, Table 3.3-1, Action 2a, to increase the amount of time allowed to place an inoperable power range neutron flux channel in the tripped condition from one hour to six hours.
On August 9, 2001, the functional test and calibration procedures were revised to implement this TS change.
A root cause analysis of this event is in progress, in accordance with the CNP corrective action program, addressing programmatic corrective actions and generic implications.
Previous Similar Events
Fuel Removed.
The above examples represent failures of surveillance test procedures to meet TS requirements. Procedure revisions made in February and November of 2000, introduced the TS non-compliance. This was prior to the completion of the generic corrective and preventive actions from these previous events. Therefore, the previous actions would not have prevented this reportable condition from occurring.