05000412/LER-2001-003
| Beaver Valley Power Station Unit No. 2 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 4122001003R00 - NRC Website | |
FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3)
PLANT AND SYSTEM IDENTIFICATION
Westinghouse-Pressurized Water Reactor System Reactor Protection System (.1C)
CONDITIONS PRIOR TO OCCURRENCE
Unit 2: Mode 1 at 100 % power There were no systems, structures, or components beyond the immediate instrumentation involved that were inoperable that contributed to the event.
DESCRIPTION OF EVENT
At 1049 hours0.0121 days <br />0.291 hours <br />0.00173 weeks <br />3.991445e-4 months <br /> on November 20, 2001, a Relay Crew at Beaver Valley Power Station (BVPS) Unit No. 2 began a routine performance of a maintenance surveillance procedure (MSP) to functionally test a 4 KV Underfrequency Relay used in the Reactor Protection System. The station entered Action Statement 7 for Item 17 in Table 3.3-1 of Technical Specification 3.3.1_1 during the performance of this MSP. During the initial steps of this MSP to remove the subject relay from service, a step directed the Relay Crew to open knife switches and verify certain control room indications were not flashing. This step was prior to the actual performance testing of the subject Underfrequency Relay. However, the indications were flashing as noted on the plant computer and by the plant Control Board annunciators. The procedure did not address what actions were to be taken should the expected response not be received nor what an abnormal response could indicate.
Prior to the initiation of this MSP, the plant computer had malfunctioned several times that day and had just malfunctioned again prior to the abnormal indications experienced in performing the MSP.
The Assistant Nuclear Shift Supervisor (ANSS) directed that the MSP be put on hold until the plant computer problems were resolved directed that the Underfrequency relay be returned to normal status. Therefore, the Reactor Protection System was returned to normal operation. The ANSS attributed the unexpected response to ongoing problems with the plant computer. Action Statement 7 from Technical Specification 3.3.1.1 was exited.
At 1432 hours0.0166 days <br />0.398 hours <br />0.00237 weeks <br />5.44876e-4 months <br /> on November 20, 2001, the performance of the Underfrequency Relay MSP was restarted since the plant computer problems were believed to have been corrected. Technical Specification 3.3.1.1, Item 17, Action 7 was entered. Again during the initial steps of the MSP to remove the relay from service, the control room indications began to flash when knife switches were opened, which was not the expected response. The ANSS, the Reactor Operator and Relay Crew discussed the situation, While the Relay personnel speculated that these unexpected indications may have been caused by a failure in another part of the circuit (an area beyond their direct expertise), it was noted that the indications did not confirm any problems with the Underfrequency Relay that they were attempting to test. The ANSS again directed that the relay be returned to FACILITY NAME (1) DOCKET (2) LER NUMBER (6) J normal status, the system returned to normal operation, and the Technical Specification Action Statement was exited. Neither the ANSS nor the Relay Crew sought immediate Instrumentation & Control (I&C) personnel input who had more expertise in the instrumentation upstream of the relay.
On November 21, 2001, the information on the unexpected indications from the previous performances of the MSP was brought to the attention of l&C personnel who immediately recognized that the channel was inoperable and suspected that these unexpected indications were due to a failed interposing relay in the circuit between the Underfrequency Relay being tested in the MSP and solid state circuitry. A failed interposing relay would not allow the Underfrequency relay and channel of the Reactor Protection System to operate satisfactorily. When I&C personnel alerted the control room at 1500 hours0.0174 days <br />0.417 hours <br />0.00248 weeks <br />5.7075e-4 months <br /> on November 21, 2001, the station declared the channel associated with the subject Underfrequency Relay inoperable and entered Technical Specification 3.3.1.1, Item 17 of Table 3.3-1, Action Statement 7 which requires that the inoperable channel be placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The failed interposing relay was replaced, the Underfrequency Relay MSP was performed satisfactorily, and the Technical Specification Action Statement was exited at 1959 hours0.0227 days <br />0.544 hours <br />0.00324 weeks <br />7.453995e-4 months <br /> on November 21, 2001.
REPORTABILITY
Subsequent evaluation of the condition determined that the unexpected indications received during the test setups on November 20, 2001 were firm evidence that the interposing relay was inoperable at that time (even though it was not recognized then). The subject Underfrequency channel of the Reactor Protection System was not then put into a trip condition or returned to an operable status within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> as required by Technical Specification 3.3.1.1, Item 17, Action Statement 7. This was a condition prohibited by the plant's Technical Specifications and is reportable pursuant to 10 CFR 50.73(a)(2)(i)(B).
CAUSE OF EVENT
This event was caused by a human performance error of Operations and Relay Crew personnel not recognizing the importance of the unexpected status light indications which were signaling a failed solid state input and hence, protection channel. This lack of recognition resulted in this Reactor Protection System channel not being declared inoperable promptly. The continuing problems with the plant computer on November 20 created an inappropriate mindset that the indications received when trying to remove the Underfrequency Relay from service were directly related to the plant computer problems. The failure to investigate in a timely manner caused a delay in declaring the Reactor Protection System channel to be inoperable and the Technical Specification Action time frame to be exceeded.
In addition, the interposing relay that acts as an isolation device failed in an unexpected manner which caused its failure to be non-detectable (until this monthly MSP was performed). The interposing relay failed in a closed position. The interposing relay is designed to be energize-to- LER NUMBER (6) FACILITY NAME (1) DOCKET (2) 4 of close, but open upon loss of power or signal. Thus, any normal postulated failure of the interposing relay would be expected to cause it to open, which would be immediately detected.
A compounding factor was the inadequacy of the surveillance procedure to adequately address the purpose of the requested action to verify certain indications during the removal of the Underfrequency Relay from service for testing.
SAFETY IMPLICATIONS
During the time that the one channel of underfrequency was inoperable, the remaining two channels were operating satisfactorily. The Reactor Protection System will trip the reactor when two of the three underfrequency channels exceed their setpoint. Thus, a reactor trip would have occurred as a result of any valid underfrequency condition. No underfrequency conditions were observed during the time of this event.
There are many redundant reactor trip mechanisms, which would cause a reactor trip in the scenarios involving underfrequency. First, underfrequency is normally caused by a loss of offsite power which also cause an undervoltage situation. Loss of offsite power also causes a reactor trip on loss of Reactor Coolant Pump flow. Loss of offsite power will also cause a turbine trip above 49% power level. Sufficient redundancy is available to cause reactor trips; therefore the Beaver Valley Power Station PRA model does not specifically credit underfrequency or undervoltage reactor trips in the Solid State Protection System model. Based on this, no increase in risk would occur due to this plant event associated with one channel of Underfrequency of the Reactor Protection System being inoperable.
Based on the above, the safety significance of this event was small.
CORRECTIVE ACTIONS
Briefings were held with Relay Crew personnel regarding this event and what actions should be taken when procedure results are not what is expected.
2. Instructions will be added to relay Maintenance Surveillance Procedures (MSPs) which perform overlap testing of components that interface with solid state to notify I&C if input indications from solid state are not as expected. Other procedure enhancements are being considered.
3. A training needs analysis will be performed for Operations Senior Reactor Operators and Reactor Operators for training enhancements on solid state input indications and their indications of the health of the solid state system.
4. A failure analysis will be performed on the interposing relay that acts as an isolation device to the subject Underfrequency Relay to determine the cause of the failure.
Corrective action completion is being tracked through the corrective action program.
FACILITY NAME (1) DOCKET (2) LER NUMBER (6)
PREVIOUS SIMILAR EVENTS
A review of past Beaver Valley Power Station Units 1 and 2 Licensee Event Reports found five similar events involving exceeding an Allowed Outage Time due to human error within the last three years:
BVPS Unit 1 LER 00-007, "Technical Specification Non-Compliance Due to Misinterpretation of Containment isolation Valve Requirements for GDC 57 Penetrations.
BVPS Unit 1 LER 99-003, "Inadequate Basis for Instrument Inaccuracies in Degraded Voltage Setpoints Lead to Technical Specification Noncompliance.
BVPS Unit 2 LER 99-009, "Missed Performance of Tech Spec Surveillance 4.8.1.1.1.a Following Failure to Re-Establish Auto Bus Transfer Capability of 4KV Bus 2A" BVPS Unit 2 LER 99-008, "Failure to Comply with Technical Specifications Due to Not Meeting SR 4.8.1.1.2.f, Simultaneous Start Test of Emergency Diesel Generators" BVPS Unit 2 LER 99-001, "Failure to Comply with Technical Specifications Due to Not Meeting the Acceptance Criteria for a Source Range Monitor During Surveillance Testing.
A review of past Beaver Valley Power Station Units 1 and 2 Licensee Event Reports found no similar events involving a relay failing in a non-conservative position resulting in an Licensee Event Report within the last three years.