05000334/LER-2005-001
| Docket Numberseouential Rev | |
| Event date: | 06-09-2005 |
|---|---|
| Report date: | 07-28-2005 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 3342005001R00 - NRC Website | |
PLANT AND SYSTEM IDENTIFICATION
Westinghouse-Pressurized Water Reactor {PWR} Reactor Trip System Instrumentation {JC}
CONDITIONS PRIOR TO OCCURRENCE
Unit 1: Mode 1 at 100 percent power There were no systems, structures, or components that were inoperable at the start of the event that contributed to the event other than as described below.
DESCRIPTION OF EVENT
On June 9, 2005, a Beaver Valley Power Station (BVPS) Unit 1 control room operator questioned whether the Channel 1 OverTemperature Differential Temperature (OTDT) setpoint indicator in the Reactor Protection System was operating less dynamically than Channel 2 and Channel 3. A review of computer generated trends of the OverTemperature Channels confirmed that Channel 1 was less dynamic than Channels 2 and 3. A subsequent check of the Channel 1 lead/lag time constant modules in the instrument rack at 1748 hours0.0202 days <br />0.486 hours <br />0.00289 weeks <br />6.65114e-4 months <br /> revealed that the lead/lag switches for dynamic compensation module TM-1RC 412E were in the OFF position and the lead/lag derivative switch was in the T1 X 1, T2 X 1 position.
The last maintenance surveillance procedure utilized on this Channel was performed on June 1, 2005. The Tau 1 (lead time constant) and Tau 2 (lag time constant) switches should have been left adjusted to 2.8 seconds for Tau 1, 2.8 seconds for Tau 2, and T1 X 10, T2 X 1 for the lead/lag derivative. The Technical Specification requirements for the lead time constant would have been satisfied with Tau 1 set at 2.8 in the associated circuitry.
Following this discovery, Channel 1 OTDT was removed from service at 1942 hours0.0225 days <br />0.539 hours <br />0.00321 weeks <br />7.38931e-4 months <br />, the lead/lag module switches were restored to their proper positions at 2027 hours0.0235 days <br />0.563 hours <br />0.00335 weeks <br />7.712735e-4 months <br />, and the Channel was returned to service at 2047 hours0.0237 days <br />0.569 hours <br />0.00338 weeks <br />7.788835e-4 months <br /> on June 9, 2005.
Immediate follow-up actions involved checking the setpoints for the same modules in Channels 2 and 3 OTDT. Switch settings for the remaining reactor protections dynamic compensation applications at Unit 1 and Unit 2 were subsequently verified. Settings for these channels were found to be within their technical specification limits.
On June 7 for 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and again on June 9 for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, Channel 3 OTDT was removed from service for routine maintenance actions, which resulted in 2 of the 3 Channels OTDT being inoperable since Channel 1 was unknowingly not operable.
REPORTABILITY
BVPS Unit 1 Tech Spec 3.3.1.1 Table 3.3-1, Item 7 for OTDT requires that the values for Tau 1 and Tau 2 be set as specified in the BVPS Unit 1 Core Operating Limits Report (COLR). The COLR specifies that Tau 1 be greater than or equal to 30 seconds and that Tau 2 be less than or equal to 4 seconds. Tau 1 and Tau 2 were found to be in the OFF position, which put Tau 1 and Tau 2 at a value of 0 seconds. This condition satisfies the Tech Spec criteria for Tau 2, but does not satisfy the Tech Spec requirement for Tau 1.
Thus, the Channel 1 OTDT Tau 1 setting of zero seconds (OFF position) did not meet the required setting of greater than or equal to 30 seconds from June 1 to June 9, 2005.
Action 7 from Technical Specification Table 3.3-1 applies if one OTDT instrument is not operable. Action 7 states "With the number of Operable channels one less than the Total Number of Channels, Startup and/or Power Operation may proceed provided . . . . the inoperable channel is placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />." The time that the Tau 1 was set at zero seconds from June 1 to June 9, 2005, exceeded 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Therefore, this was a condition prohibited by plant Technical Specifications, and is reportable pursuant to 10 CFR 50.73(a)(2)(i)(B).
Pursuant to NUREG-1022, Rev. 2, page 36: "Entry into STS 3.0.3 is not necessarily reportable under 10 CFR 50.73(a)(2)(i)(B). However, it should be considered reportable under this criterion if the condition is not corrected within an hour, such that it is necessary to initiate actions to shutdown, cooldown, etc." Based upon this NUREG-1022 criteria, any event where Technical Specification 3.0.3 is applied
- longer than one hour would be reportable under 10 CFR 50.73. On June 7 for 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and again on.June 9 for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, Channel 3 OTDT was removed from service for routine maintenance actions, which resulted in 2 of the 3 Channels OTDT being inoperable since Channel 1 was unknowingly not operable. There are no actions listed for more than one OTDT Channel inoperable in Technical Specification Table 3.3-1. Thus, with two of the three OTDT channels inoperable, Technical Specification 3.0.3 was applicable, each time lasting longer than one hour. Thus, each of these two times that Channel 3 was removed from service was also a condition prohibited by plant Technical Specifications, and is reportable pursuant to 10 CFR 50.73(a)(2)(i)(B). It is noted that when Channel 3 was made inoperable, it was also put into a trip condition during this time, which would not have caused the loss of the OTDT function in conjunction with the degraded channel 1 condition. Hence, this is not reportable pursuant to 10 CFR 50.73(a)(2)(v) as a condition which prevented the fulfillment of a safety function.
ANALYSIS OF EVENT
In the Channel 1 OTDT quarterly channel functional test procedure (1MSP-6.20-1), the "As Found" switch positions for lead/lag modules TM-1RC-412E and TM-1RC-412L are recorded, then only the switches for lead/lag module TM-1RC-412E are placed to the OFF ANALYSIS OF EVENT (Continued) position to support static calibration. During the performance of 1MSP-6.20-1, it was identified that the values for the Delta-Temperature Channel Alignment and the Tavg Channel Alignment needed minor adjustments. Direction is provided in 1MSP-6.20-1, to perform a calibration using the calibration procedure for this channel (1MSP-6.38-1).
Specific portions of 1MSP-6.38-I or the entire MSP may be performed. Step VII.F.14 of 1MSP-6.20-1 states, "Perform remaining Channel Functional Test requirements using 1MSP-6.38-1". MC Supervision determined the applicable sections of 1MSP-6.38-1 that would require performance to calibrate the suspect modules, and marked the sections that did not require performance as Not Applicable (N/A). The section for lead/lag module TM 1RC-412E calibration was marked N/A since TM-1RC-412E was not the location of the out of tolerance condition found in channel functional testing 1MSP-6.20-1. Following applicable module calibrations, the Channel Functional Test was completed and OTDT Channel 1 was restored by 1MSP-6.38-I. The restoration sections of both 1MSP-6.20-1 and 1MSP-6.38-1 require placing TM-1RC-412E switches back to their "As-Found" conditions. However, 1MSP-6.38-1 only required performing the restoration step for the TM-1RC-412E lead/lag module if the calibration section for that module was performed. Since that section was not performed, the restoration step was bypassed. 1MSP-6.20-1 was not referenced for restoration since the channel functional and restoration requirements were considered satisfied with performance of 1MSP-6.38-I. OTDT Channel 1 was restored to service, with the lead/lag module TM-1RC-412E switches left in the OFF position. This subject event from the initial start of 1MSP-6.20-1 to the completion of 1MSP-6.38-1 involved three l&C crews spanning 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> and it was determined that the performing MC technicians followed the procedures as written.
CAUSE OF EVENT
The procedure preparation and review process regarding restoration was inadequate. The procedures had been extensively changed as part of a procedure upgrade effort. Following the technical line review of this procedure, the writer incorporated additional technical changes. The procedure writer made an error by not ensuring the restoration of the equipment to an operable condition following transition from one procedure to the other.
The reviewer failed to ensure technical adequacy of these changes and also determined that no additional line review was needed. Accordingly, the procedure validation was inadequate for the complexity of this change. Contributing causes involved less than adequate turnover process, pre-job briefs, and standards.
An extent of cause evaluation determined that a similar procedural issue applies to the maintenance surveillance procedures for BVPS Unit 1 Channel 2 and Channel 3 of OTDT, for BVPS Unit 1 Channels 1, 2 and 3 of OverPower Differential Temperature (OPDT), and to the maintenance surveillance procedures for the BVPS Unit 1 Channels 1, 2 and 3 of CAUSE OF EVENT (Continued) Pressurizer Pressure protection applications. These described functions only affect the Reactor Trip System; the Engineered Safety Features Actuation System (ESFAS) procedures were not affected.
SAFETY IMPLICATIONS
The Overtemperature Differential Temperature (OTDT) reactor trip protects the core against exceeding the Departure from Nucleate Boiling Ratio (DNBR) limit. The Overpower Differential Temperature (OPDT) reactor trip protects against excessive power (fuel rod rating protection). The OTDT function was affected by this event; the OPDT function was not affected.
OTDT provides primary or backup protection for many Design Basis Accidents. For example, in the event of a complete loss of heat sink, i.e., no steam flow to the turbine, protection of the reactor coolant system against overpressure is afforded by pressurizer and steam generator safety valves along with any of the following reactor trip functions:
1. Reactor trip on turbine trip 2. High pressurizer pressure reactor trip 3. OTDT reactor trip 4. Low-low steam generator water level reactor trip.
Automatic turbine load runback is initiated by an approach to an overpower or overtemperature condition. This will prevent high power operation that might lead to an undesirable condition, which, if reached, will be protected by reactor trip.
Reactor trip is actuated if any two out of three Differential Temperature channels exceed an OTDT setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature and pressure to protect against violating the DNB design criteria.
The risk significance of the Loop 1 OTDT Channel being inoperable since the time that the last maintenance surveillance procedure was performed on June 1, 2005 until it became operable again on June 9, 2005 is considered to be of low risk significance. This is based on the following, using the current BVPS Unit 1 PRA model (BV1REV3) initiating event frequencies and trip logic module failure probabilities:
SAFETY IMPLICATIONS (Continued) The BVPS-1 Updated Final Safety Analysis Report (UFSAR) states that the Uncontrolled Boron Dilution at Power and Main Feedwater Line Break are accidents that utilize the OTDT trip. The Main Feedwater Line Break is considered to be of low safety significance, since a reactor trip signal would still be generated to mitigate the analyzed accident, either by other diverse reactor trip signals (e.g., high pressurizer pressure, low-low steam generator water level). Moreover, the Main Feedwater Line Break conditional core damage probability associated with an Anticipated Transient Without Scram (ATWS) is less than 1.0E-07, based on the current PRA model. For the Uncontrolled Boron Dilution at Power, the UFSAR states that with the reactor in automatic rod control, the power and temperature increase from the dilution results in insertion of the control rods and activation of the rod insertion limit alarms (low and low-low), which would alert the operators to initiate mitigating actions. The Uncontrolled Boron Dilution at Power events are treated in the PRA model as core power excursions events, which have a conditional core damage probability of about 2.0E-07.
Therefore, it is not expected that there would be a significant increase in Core Damage Frequency (CDF) or Large Early Release Frequency (LERF) as a result of the Loop 1 OTDT Channel being inoperable. Both of these conditional core damage probability values are considered to have very low risk significance.
Turning the lead/lag protection module off would cause the Channel 1 OTDT function to - be delayed by the time amount afforded by the time constant. Channels 2 and 3 would be unaffected by Channel 1 being inoperable. On June 7 and June 9, 2005, Channel 3 was removed from service and placed in a trip condition, as required. This resulted in 2 of the 3 loops OTDT being inoperable. In the event of an actual high OTDT, the logic for OTDT channels to trip would have been reduced to 1 out of 2. Assuming a single failure of Channel 1 OTDT, the reactor would trip when required due to the 1 out of 2 trip logic. If Channel 2 OTDT is assumed to be the single failure, Channel 1 would trip the reactor.
However, the trip would be delayed and the assumptions in the safety analysis might not have been met. To bound this condition, the PRA risk significance (described above) modeled the OTDT function as a failure. The risk significance determined that there was no significant increase in CDF or LERF.
Based on the above, the safety significance of the OTDT Channel 1 lead module being set too low between June 1 and June 9, 2005 at BVPS Unit 1 was very low.
CORRECTIVE ACTIONS
1. The BVPS Unit 1 OverTemperature Differential Temperature Protection Channel 1 was removed from service, the lead/lag module TM-1RC-412E switches were restored to their proper positions, and the Channel was returned to service on June 9, 2005. The setpoints for the same modules in Channels 2 and 3 OTDT were also immediately checked.
2. The test maintenance surveillance procedure (MSP) and the calibration MSP associated with each of the three differential-temperature channels at BVPS Unit 1 will be revised prior to next use to enhance the transition between these two channel—associated MSPs and for other procedural improvements.
3. The surveillance test MSPs and calibration MSPs for each Pressurizer Pressure channel at BVPS Unit 1 will be similarly revised prior to next use.
4. Specific switch settings data will be added to various differential temperature protection system maintenance surveillance procedures.
5. New procedure validation criteria will be developed at BVPS which will include restoration improvements.
6. The Maintenance supervisors will be trained on the lessons learned from this event.
Completion of the above and other corrective actions are being tracked through the BVPS corrective action program.
PREVIOUS SIMILAR EVENTS
A review found no prior Beaver Valley Power Station Unit No. 1 Licensee Event Reports within the last five years involving lead/lag time constant values in the protection system.
However, two Beaver Valley Power Station Unit No. 2 Licensee Event Reports were found within the last five years involving lead/lag constant values in the protection system.
BVPS Unit 2 LER 2003-001, "Lag Time Constant for Steam Line Pressure Channel Used in the Reactor Protection System Found Out of Tolerance.
BVPS Unit 2 LER 2002-003, "Calibration Discrepancies in Delta Temperature Tau Time Constant Values Used in the Reactor Protection System.
PREVIOUS SIMILAR EVENTS (Continued) Although a previous BVPS Licensee Event Report (Unit 2 LER 2003-001) involved a lag switch left with an incorrect value and corrective actions were taken to ensure that lag values are returned to service at their appropriate setpoints, these prior corrective actions were not directly applicable to BVPS Unit 1. This is due to differences in the protection systems' platform (i.e., 7100 for Unit 1 versus 7300 for Unit 2) and the method to return/verify lead/lag settings.
COMMITMENTS
There are no new commitments made by FirstEnergy Nuclear Operating Company (FENOC) for BVPS Unit No. 1 in this document.