05000410/LER-2003-003

LER-2003-003,

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(vii)(A), Common Cause Inoperability 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor
4102003003R01 - NRC Website

I. Description of Event

On October 2, 2003, Nine Mile Point Unit 2 (NMP2) was operating at approximately 100% power when Part 21 Information was received from General Electric (GE) informing Nine Mile Point Nuclear Station, LLC (NMPNS) that the Oscillation Power Range Monitor (OPRM) may not prevent exceeding the Safety Limit Minimum Critical Power Ratio (SLMCPR) for all anticipated instability events. As a result, the OPRM was declared inoperable and the action statement of Technical Specification 3.3.1.1, 'Reactor Protection System Instrumentation,' was entered. As required by the action statement, alternate methods to detect and suppress thermal-hydraulic Instabilities were implemented, which allows continued operation for 120 days with the OPRM inoperable.

The OPRM consists of four channels each containing 30 cells. Each cell monitors the number of reactor power oscillations and the amplitude of the oscillations. A reactor trip is generated when the number of oscillations, the conformation count (CC), and the normalized oscillation amplitude both exceed their respective setpoints in at least one cell in two or more channels simultaneously. According to the licensing basis, the oscillation is expected to reach the CC setpoint prior to the amplitude set point.

On July 24, 2003, with the OPRM armed, NMP2 experienced a sloW growing core wide instability event that resulted in an OPRM trip of the reactor. The event is described in Licensee Event Report (LER)03-002. In the NMP2 event, the OPRM detected the instability and initiated a reactor scram that provided SLMCPR protection.

However, post-event analyses by GE concluded that the OPRM did not perform as expected, in that more cells exceeded their amplitude setpoint prior to exceeding their CC setpoint. This was attributed to a large number of unexpected CC resets that occurred throughout the event. The analyses by GE concluded that the adjustable period confirmation variables, as set at NMP2 and approved by GE, did not adequately filter out high frequency noise creating a signal that caused the frequent CC resets.

Based on analysis of the NMP2 event, GE could not confirm that the OPRM, with the current settings, would prevent exceeding the SLMCPR for all anticipated instability events.

II. Cause of Event

The use of conditioning filter parameter settings that were not appropriate for application to actual OPRM signal characteristics resulted in the OPRM being declared inoperable. The cause of this event was a failure to ensure, through proper qualifications and testing, that the OPRM system, as implemented at the plant, is capable of performing its expected trip function during an instability event. There were two contributing factors: a) failure to recognize the conditioning filter actual performance when applied to plant data, and b) the erroneous assumption that "tuning" the system at stable condition will result in proper system performance for unstable conditions.

Hi. Analysis of Event The OPRM at NMP2 had non-conservative settings for the adjustable period confirmation variables (50 msec for the period tolerance and 3.0 Hz for the cutoff frequency). GE could not confirm that the OPRM, with the current settings, would prevent exceeding the SLMCPR for all anticipated instability events. Because of the non- conservatism, all OPRM channels were declared inoperable. This condition is reportable in accordance with 10 CFR 50.73(a)(2)(v)(A), "Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to: (A) Shut down the reactor and maintain it in a safe shutdown condition," and 10 CFR 50.73(a)(2)(vii)(A), Any event where a single cause or condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to: (A) Shut down the reactor and maintain it in a safe shutdown condition." The OPRM would have been inoperable since activation of the trip function in April 2000. This would exceed the action statement requirement of Technical Specification 3.3.1.1, Reactor Protection System (RPS) Instrumentation, which is reportable in accordance with 10 CFR 50.73(a)(2)(i)(B), "Any operation or condition which was prohibited by the plant's Technical Specifications? The following were considered when assessing the significance of this event:

• The SLMCPR is set such that 99.9 percent of the fuel rods are expected to avoid boiling transition if the limit is not violated. The critical power at which boiling transition is calculated to occur has been adopted as a fuel design criterion. However, fuel damage does not necessarily occur if a fuel rod actually experiences boiling transition. The MCPR Safety Limit is a conservative limit for this application because the fuel and clad response to these oscillations are relatively mild. If boiling transition was to actually occur, the cyclic nature of the event provides for clad rewet every two seconds resulting in a nearly negligible cladding temperature transient.

• Although the OPRM may not meet the licensing criteria for SLMCPR protection, the system would still provide a measure of automatic protection.

• There were no adverse consequences. The OPRM provided SLMCPR protection for the July 24, 2003 event at NMP2. MCPR was estimated to be substantially greater than the 1.06 Safety Limit.

• A qualitative risk analysis of the inoperable OPRM concluded that an inoperable OPRM has negligible impact on risk.

Based on the above, the non-conservative OPRM settings did not pose a threat to the health and safety of plant personnel or the public.

IV. Corrective Actions

1. The OPRM was declared inoperable and the Technical Specification required alternate method to detect and suppress thermal-hydraulic instability oscillations was activated. The OPRM remained armed.

2. GE reanalyzed the Conditioning Filter Cutoff Frequency parameter and the Period Tolerance parameter using appropriate simulated signals.

3. NMPNS reviewed the values recommended by GE for the Conditioning Filter Cutoff Frequency parameter and the Period Tolerance parameter to ensure the recommendations were applicable to NMP2, including the impact of the change in cutoff frequency on the oscillation signal magnitude. NMPNS also obtained independent review from an outside contractor.

4. NMPNS prepared and implemented a Design Change to change the Conditioning Filter Cutoff Frequency parameter and the Period Tolerance parameter to the appropriate values.

5. The OPRM was returned to Operable.

FACILITY NAME (1) LER NUMBER (6) DOCKET (2) � 05000410 SEQUENTIAL NUMBER

V. Additional Information

1. Failed Components: None 2. Previous similar events:

• Licensee Event Report 01-003, "Methodology Error Results in Inoperable Oscillation Power Range Monitors," describes an event in which the OPRM was declared inoperable as a result of a GE Part 21 notification. The cause of the event was a methodology error resulting from inadequate design input considerations. The corrective actions of LER 01-003 were specific to the event and would not have prevented the condition resulting from non

• conservative settings of the adjustable period confirmation variables.

• Licensee Event Report 02-005, "Oscillation Power Range Monitors Inoperable Due to Non-conservative Minimum Oscillation Period Setting." describes an event in which the OPRM was declared inoperable as a result of a GE Part 21 notification. The cause of the event was inadequate original "design considerations" by GE. The original licensing topical report was developed with modeling and methodology that existed at the time and only specified a `typical" range of allowable values for the minimum oscillation period of 1.0 to 1.4 seconds. Only specifying a typical range was inadequate. The deficiency in the typical range values was revealed by use of new modeling techniques and by a thorough re-examination of Option ill capability and limitations. The corrective actions of LER 02-005 were specific to the event and subject to modeling limitations. Absent the actual experience gained during the NMP2 event of July 24, 2003, it would not have been expected that the actions taken would have prevented the condition resulting from non-conservative settings of the adjustable period confirmation variables.

3. identification of components referred to in this Licensee Event Report:

Components Oscillation Power Range Monitors Reactor Protection System IEEE 805 System ID � IEEE 803A Function 1G � N/A JC � N/A NRC FORM 3.66A (1-20011