05000440/LER-2006-004
| Docket Number | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(vii)(A), Common Cause Inoperability 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor |
| Initial Reporting | |
| ENS 42854 | 10 CFR 50.72(b)(3)(v)(A), Loss of Safety Function - Shutdown the Reactor |
| 4402006004R00 - NRC Website | |
Energy Industry Identification System Codes are identified in the text as [XX].
I. INTRODUCTION
On September 21, 2006, at 1815 hours0.021 days <br />0.504 hours <br />0.003 weeks <br />6.906075e-4 months <br />, based on General Electric (GE) Safety Communication SC06- 010, "Stability Option III OPRM Arming Setpoint," and available information, it was determined that all four Oscillation Power Range Monitor (OPRM) [JC] channels were inoperable due to their recirculation drive flow setpoint settings not meeting requirements of Technical Specifications (TS) Surveillance Requirement (SR) 3.3.1.3.5. The OPRM instrumentation provides input to the Reactor Protection System (RPS). The OPRM instrumentation is relied upon for providing a safe shutdown safety function when operating during an unstable power to flow condition. At the time of the event, the plant was operating in Mode 1, at 100 percent of rated thermal power (RTP). A notification (ENS Number 42854) was made to the NRC Operations Center at 2013 hours0.0233 days <br />0.559 hours <br />0.00333 weeks <br />7.659465e-4 months <br />, in accordance with 10 CFR 50.72(b)(3)(v)(A), as a condition that could have prevented fulfillment of a safety function of a system needed to shut down the reactor and maintain it in a safe shutdown condition.
This condition is being reported in accordance with 10 CFR 50.73(a)(2)(i)(B), as a condition prohibited by Technical Specifications; 10 CFR 50.73(a)(2)(v)(A), a condition that could have prevented fulfillment of a safety function of a system needed to shut down the reactor and maintain it in a safe shutdown condition; and 10 CFR 50.73(a)(2)(vii)(A), as an event where a single cause or condition caused at least two channels to become inoperable in a single system designed to shut down the reactor and maintain it in a safe shutdown condition.
II. EVENT DESCRIPTION
On September 14, 2006, with the plant at 100 per cent power in Mode 1, the Perry plant staff was notified by GE via a draft Safety Communication SC06-010 of a potential non-conservative setting of the OPRM Enabled Region Drive Flow Setpoint when the plant is in Single Reactor Recirculation Loop Operations. The issue was entered into the corrective action program to document resolution of the condition. On September 21, 2006, at 1815 hours0.021 days <br />0.504 hours <br />0.003 weeks <br />6.906075e-4 months <br />, based on available information, it was determined that all four OPRM channels were inoperable due to their current flow setpoint settings being non-conservative, and TS Limiting Condition for Operation (LCO) 3.3.1.3 Action B.1 was entered to initiate an alternate method to detect and suppress thermal hydraulic instability oscillations within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. At 2005 hours0.0232 days <br />0.557 hours <br />0.00332 weeks <br />7.629025e-4 months <br />, operators completed implementation of backup stability protection for detecting and suppressing thermal hydraulic instability oscillations to meet the TS LCO Action requirement. On September 21, 2006, at 2013 hours0.0233 days <br />0.559 hours <br />0.00333 weeks <br />7.659465e-4 months <br />, notification ENS Number 42854 was made to the NRC Operations Center as described above. All four channels of OPRMs remain inoperable until the setpoints are corrected.
III. CAUSE OF EVENT
The cause of the condition was the Boiling Water Reactor Owners' Group (BWROG) and GE approved methodology, as supplied in NEDO-32465-A, "Reactor Stability Detect and Suppress Solutions Licensing Basis Methodology for Reload Applications," dated August 1996, was flawed for not considering the maximum indicated drive flow while in Single Loop Operations. This resulted in the potential to not meet the Technical Specification requirement that the OPRMs be enabled when core flow is less than 60 per cent and power is greater than 23.8 per cent.
A contributing cause was that the independent verification that was performed was not performed in accordance with NOP-CC-2001, "Design Verification," step 4.1.2.2. This was a missed opportunity to detect that the methodology used in calculation FM-012, Revision 1, "OPRM Device Settings and Setpoints," was flawed.
IV. EVENT ANALYSIS
The safety significance of this event was determined to be very low.
General Design Criterion (GDC) 10 requires that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin to assure that acceptable fuel design limits will not be exceeded during any condition of normal operation, including the effects of anticipated operational occurrences. Additionally, GDC 12 requires the reactor core and associated coolant, control, and protection systems to be designed to assure that power oscillations that can result in conditions exceeding acceptable fuel design limits, are either not possible or can be reliably and readily detected and suppressed. The OPRM system provides compliance with GDC 10 and GDC 12, thereby providing protection from exceeding the fuel minimum critical power ratio Safety Limit (i.e., SLMCPR).
The OPRM instrumentation is required to be operable in order to detect and suppress neutron flux oscillations in the event of thermal-hydraulic instability. The power/core flow region protected against anticipated oscillations is defined by thermal power greater than or equal to 23.8 percent RTP and recirculation drive flow less than the value corresponding to 60 percent of rated core flow. The OPRM trip is required to be enabled in this region, and the OPRM must be capable of enabling the trip function as a result of transients that place the core into that power/flow region.
OPRMs do not monitor core flow directly but use the Average Power Range Monitor (APRM) drive flow.
Based on predictions using the GE BILBO core flow model, a relatively high initial core flow of 110 percent of rated flow would be reduced to about 57 percent following a single reactor recirculation pump trip. With run out conditions on the operating pump, the drive flow following a single reactor recirculation pump trip would be approximately 60 percent of rated drive flow. Therefore, an OPRM enable setpoint below 60 percent drive flow may not be sufficient to ensure that the OPRM is enabled for single loop operation whenever core flow is less than 60 percent. The Perry OPRM drive flow setpoint was set to 56.6 percent drive flow, which corresponds to about 62 percent core flow for 2 pump operation. Data collected during initial startup indicates that, following a single recirculation pump trip with the operating pump in runout, the drive flow would be around the enable setpoint. At this condition, the total core flow was about 55 percent of rated.
According to GE correspondence SC06-10, "Stability Operation III OPRM Arming Setpoint," September 20, 2006, as long as the OPRM enable setpoint is high enough so that the OPRM is armed before flow drops below 50 per cent of rated core flow, the core would be sufficiently stable following a single recirculation pump trip such that the SLMCPR would not be exceeded. Sufficient margin exists in the Perry OPRM enable setpoint to prevent continued operation with power oscillations that would result in the SLMCPR being exceeded. In addition, margin is designed into the safety limit such that simply exceeding the SLMCPR would not necessarily result in fuel damage. Based on this information, it is qualitatively concluded that operating with an OPRM enable setpoint of 56.6 percent APRM drive flow had an insignificant impact on the core damage frequency (CDF) or large early release frequency (LERF). There is a high probability that with single reactor recirculation pump operation and drive flow above the OPRM enable setpoint that the total core flow would be above 50 percent of rated flow. Based on various Backup Stability Protection region calculations of GE fuel [SC06-10], sufficient margin is available for total core flows above 50 percent to avoid significant oscillations that could lead to exceeding the SLMCPR.
Based on the above discussion, the described event has a very low safety significance.
V. CORRECTIVE ACTIONS
On September 14, 2006 the initial response to this condition was to establish a requirement that directed plant operators to declare the OPRMs inoperable upon entry into Single Loop Operations. Entry in Single Loop Operations would require plant operators to initiate an alternate method to detect and suppress thermal hydraulic instability oscillations. Subsequent reviews concluded the OPRMs were inoperable under all conditions. On September 21, 2006, plant operators declared the OPRMs inoperable and entered TS LCO 3.3.1.3 Action B.1. As required by the TS Action, plant operators initiated alternate method to detect and suppress thermal hydraulic instability oscillations.
Additional corrective actions to be taken are:
1. Calculation FM-012 "OPRM Device Settings and Setpoints has been revised to update the OPRM Enabled Region Total Drive Flow Setpoint. The revised setpoint is based on current cycle data coupled with expected conditions during Single Loop Operations. The revised setpoint of 63.5 percent total drive flow is greater than the GE Safety Communication recommended value of 60 percent total drive flow.
2. The OPRM setpoint change to the revised setpoint of 63.5 percent is currently scheduled to be completed the week of November 27, 2006. Once the setpoint change to 63.5 percent total drive flow is completed, the OPRMs will be declared operable.
3. Lessons learned regarding choosing an appropriate independent verifier for an important calculation will be presented to the various Engineering Departments' Training Review Committee as part of the Systematic Approach to Training process.
VI. PREVIOUS SIMILAR EVENTS
documents a similar event at Perry. The Perry plant staff was notified by (GE) via a BWROG conference call on June 27, 2001, at approximately 1130 that the OPRM instrumentation SCRAM setpoints were non conservative due to non-conservative analysis. The OPRM equipment was therefore considered inoperable since first placed into service following the scheduled refueling outage in March 2001.
All OPRM channels were declared INOPERABLE and administrative procedural controls were implemented to monitor potential oscillations in reactor power. In August 2004, the OPRM setpoints were changed and Operations declared the OPRM's operable again. None of the issues investigated by the GE and the Detect and Suppress Subcommittee since 2001 involved the OPRM Enabled Region Total Drive Flow Setpoint. The process for determining this setpoint remained unchanged. Based on this fact it could not be reasonably expected that the corrective actions associated with LER 2001-002 should have prevented the condition documented in LER 2006-004.
VII. COMMITMENTS
There are no regulatory commitments contained in this report. Any actions discussed in this document that represent intended or planned actions, are described for the NRC's information, and are not regulatory commitments.