05000325/LER-2005-001
| Docket Number04 - 09 2005 2005 - 001��--00 06 08 2005 05000 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 3252005001R00 - NRC Website | |
Energy Industry Identification System (EIIS) codes are identified in the text as [XX].
INTRODUCTION
On April 9, 2005, at 0050 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> Eastern Daylight Time (EDT), a Unit 2 automatic Reactor Protection System (RPS)/[JC] actuation occurred due to low reactor vessel water level. This automatic scram signal is received from the 2-B21-LTM-N017A-1, E-1, C-1, and D-1 reactor water level master trip instruments, with a nominal trip setpoint of 166 inches. Operators had planned to initiate a manual scram if reactor water level lowered to 171 inches. At the time of the scram, level indications in the control room from the 2-C32-LI-R606A, B, and C instruments ranged from 172 inches to 173 inches. During subsequent investigations of the anomaly between indicated reactor vessel water level and actual reactor vessel water level for Unit 2, it was determined that the high water level trip instrumentation, required by Technical Specification 3.3.2.2, "Feedwater and Main Turbine High Water Level Trip Instrumentation," had been rendered inoperable by adjustment of a time constant in the Digital Feedwater Control System (DFCS)/[JK] software. This adjustment was made in April 2003, for Unit 2 and April 2004, for Unit 1. This condition is being reported in accordance with 10 CFR 50.73(a)(2)(i)(B) as operation prohibited by the plants' Technical Specifications. The Unit 2 automatic RPS actuation is reported in LER 2-2005-002.
EVENT DESCRIPTION
Initial Conditions Unit 1 was in Mode 1, at approximately 100 percent rated thermal power.
Unit 2 was in Mode 1, at approximately 65 percent rated thermal power at the time of the reactor scram.
Discussion During the spring 2003, Unit 2 refueling outage, new Woodward governors were installed on the Reactor Feedwater pumps (RFPs)/[SK]. In addition, DFCS changes were implemented to support Extended Power Uprate (EPU). In April 2003, during power ascension testing following the Unit 2 refueling outage, excessive RFP control valve oscillations were observed.
A troubleshooting team was organized to resolve the RFP control valve oscillations. This team obtained support from System Engineering, Design Engineering, Maintenance, Training (i.e., for simulator assistance), EPU, various vendor representatives, and several industry experts. Initial troubleshooting activities focused on the new Woodward governors, however these efforts were unsuccessful. Based primarily on a vendor recommendation, it was determined that use of a time constant filter (i.e., first order filter) in the DFCS logic would improve the condition by eliminating the "noise" input from the level transmitters. This was accomplished by activating the DFCS time constant filter software parameter (i.e., FLOP) and then setting the DFCS filter time constant (FTIM) to 0.05 minutes (i.e., 3.0 seconds). The use of this filter was considered to be an adjustment of a pre-existing tuning parameter rather than a EVENT DESCRIPTION (continued) modification of the system design. As a result, a time delay was inserted "downstream" of the 2-C32-LT- NO04A, B, and C level transmitters. Implementing these changes resolved the excessive RFP control valve oscillations.
Subsequently, the same software changes were implemented on Unit 1 during the spring 2004, refueling outage.
As revealed by the April 9, 2005, Unit 2 scram, implementation of DFCS software time constant changes had an unanticipated impact on reactor water level indication in the control room as well as on the initiation of the Feedwater and Main Turbine High Water Level Trip Instrumentation which initiate from 112-C32- LT-N004A, B, and C level transmitters. For steady state or slow changes in reactor water level, there would be no noticeable lag. However, for faster transients the water level signal would experience a more significant lag; diverging from actual level by a more noticeable amount. Given this lag, it cannot be assured that the Feedwater and Main Turbine High Water Level Trip Instrumentation would have provided the required trips at less than or equal to 207 inches (i.e., the Allowable Value established in Technical Specification Surveillance Requirement 3.3.2.2.2). With this instrumentation inoperable, Units 1 and 2 have operated in a condition prohibited by Technical Specifications since implementation of the modification for each unit (i.e., April 2003, for.Unit 2 and April 2004, for Unit 1).
This condition did not affect the RPS low water level scram function (i.e., Function 4, "Reactor Vessel Water Level - Low Level 1," of TS Table 3.3.1.1-1, "Reactor Protection System Instrumentation"). This automatic scram signal is received from the 1/2-B21-LTM- NO17A-1, B-1, C-1, and D-1 reactor water level master trip instruments, with a scram setpoint of greater than or equal to 166 inches and an Allowable Value of greater than or equal to 153 inches.
EVENT CAUSE
The root cause of this condition is attributed to a lack of a sufficient questioning attitude related to the impact of the parameter change on all system output responses combined with a lack of detailed knowledge and documentation associated with the DFCS software.
Personnel involved with the change were unfamiliar with the DFCS software design and were highly reliant upon vendor input. Both the DFCS system engineer and his supervisor were relatively new in their positions and the previous DFCS system engineer is no longer employed at BSEP. Maintenance personnel had limited knowledge of the DFCS software. Overall, the personnel involved with the change lacked a sufficient questioning attitude related to the impact of the parameter change on all system output responses.
Rather, there was a "tunnel vision" focus on resolving the RFP control valve oscillations. This mindset was perpetuated throughout the post-troubleshooting design change process.
EVENT CAUSE (continued) The available design and configuration information for the DFCS software which relates to how an input signal is processed within DFCS is not sufficient to fully evaluate the affect a change made internal to DFCS has on the output functions of DFCS.
CORRECTIVE ACTIONS
The DFCS time constant filter was de-activated in both the Unit 1 and Unit 2 DFCSs on April 10, 2005.
This restored Technical Specification operability of the Feedwater and Main Turbine High Water Level Trip Instrumentation.
In order to prevent recurrence, enhanced design and configuration documentation for the DFCS software will be developed. This will be completed by October 14, 2005.
A review of existing digital software which provide control or interactive functions (i.e., other than indication) will be performed to ensure design and configuration control of the software are adequate. This will be completed by October 14, 2005.
SAFETY ASSESSMENT
The safety significance of this condition is considered minimal. No actual safety consequences occurred as a result of this event. The automatic low water level RPS trip setpoint was not affected by the addition of the time constant.
The time delay affected the high water level turbine trip, which is credited in the analysis of the Feedwater Controller Failure - Maximum Demand (FWCF) transient; described in Section 15.1.2 of the BSEP Updated Final Safety Analysis Report (UFSAR). With the Main Turbine Bypass (MTBP) system operable (i.e., which it was for both units during the period that the time delay was in effect), the FWCF was a non limiting event. However, even with MTBP system operable, the FWCF transient impacts the off-rated thermal limits in the Core Operating Limits Report (COLR). The impact of the time delay was evaluated and it was determined that (1) the FWCF transient remained bounded by other events over the range of plant conditions existing for the duration of this condition, and (2) there was sufficient margin between off rated thermal limits, when conservatively adjusted to account for the time delay, and the lowest observed minimum operating Minimum Critical Powttr Ratio (MCPR), to absorb any adverse impact from this condition.
Similarly, had the MTBP system been inoperable on either unit, the consequences of a FWCF would not have significantly impacted safety. Technical Specification 3.7.6, "The Main Turbine Bypass System," implements more restrictive Average Planar Linear Heat Generation Rate (APLHGR) and MCPR limits to SAFETY ASSESSMENT (continued) reestablish thermal limit margin. Additionally, BSEP procedurally maintains a 2 percent margin (i.e., more than the time delay impact) to the thermal limits to ensure adequate margin to Technical Specification limits. These factors would mitigate the impact of the time delay on the FWCF transient with the MTBP system inoperable.
PREVIOUS SIMILAR EVENTS
Inspection Report 2003-006, dated January 16, 2004, documents a self-revealing finding associated with an inadequate design review of a Unit 2 reactor feed pump speed control modification which resulted in an increased susceptibility to reactor feed pump trips as a result of voltage transients. This condition is documented in AR 110399110399 The corrective actions associated with AR 110399110399were focused on enhancing the design review/change process. Additionally, these corrective actions were not completed until after the changes made to the DFCS software time constant were implemented. Therefore, the corrective actions associated with AR 110399110399could not reasonably be expected to have prevented this event.
COMMITMENTS
No regulatory commitments are contained in this report. Those actions discussed in this submittal will be implemented in accordance with corrective action program requirements.