05000440/LER-2007-005

LER-2007-005, Plant Startup With Inoperable Reactor Core Isolation Cooling System

Docket Number
Event date:	12-12-2007
Report date:	02-11-2008
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
4402007005R00 - NRC Website

Energy Industry Identification System Codes are identified in the text as [XX].

INTRODUCTION

On December 12, 2007, at 2110 hours0.0244 days <br />0.586 hours <br />0.00349 weeks <br />8.02855e-4 months <br />, the Reactor Core Isolation Cooling (RCIC) [BN] system. was declared inoperable after an engineering review of RCIC testing concluded that the test results were unacceptable. Specifically, the RCIC flow controller [TC] test traces showed that the controller settings were not adequate and may challenge stable flow control during system operation. The plant was in Mode 1 (i.e., Power Operation) at the time of discovery with the reactor operating at 89 percent of rated thermal power (RTP). The plant commenced a restart from a forced outage on December 6, 2007. The RCIC system was.tested during the restart process to demonstrate that it could perform its intended function. However, further review of the test results showed that the RCIC system could not re!iably function as designed. This invalidated the operability declaration made during the startup. Restart of the plant (i.e., entering Mode 2, Startup with reactor pressure > 150 psig, and Mode 1, Power Operation) with the RCIC system inoperable is prohibited by Technical Specification (TS) Limiting Condition for Operation (LCO) 3.0.4. TS LCO 3.5.3 Required Actions were also not met. This event is being reported in accordance with 10CFR50.73(a)(2)(i)(B), any operation prohibited by TS.

�

EVENT DESCRIPTION

On November 28, 2007, a reactor protection system (RPS) actuation resulting in an automatic reactor scram from 100 percent of RTP was caused by failed power supplies in the Digital Feedwater Control System. The RCIC system started and tripped 13 seconds later prior to reaching rated flow due to low pump suction pressure as sensed by RCIC pump suction pressure transmitter. This event was reported in Perry LER 2007-004.

During the subsequent forced outage and reactor startup, the RCIC system underwent extensive trouble-shooting, testing, and maintenance. The Bailey Model 701 flow controller units in the main control room and the remote shutdown room were replaced. The flow controller settings were adjusted and the system was tuned. The RCIC system was operated in accordance with its System Operating Instruction (SOI) several times for post-maintenance testing.

On December 6, 2007, at 2143 hours0.0248 days <br />0.595 hours <br />0.00354 weeks <br />8.154115e-4 months <br />, the plant entered Mode 2 (i.e., Startup) to restart from the forced outage.

On December 7, 2007, at 0722 hours0.00836 days <br />0.201 hours <br />0.00119 weeks <br />2.74721e-4 months <br />, the RCIC system was declared operable prior to exceeding 150 pounds per square inch gauge (psig) reactor pressure. At 0837 hours0.00969 days <br />0.233 hours <br />0.00138 weeks <br />3.184785e-4 months <br />, reactor pressure was established at 160 psig. The RCIC system low pressure pump flow test was then performed in accordance with TS Surveillance Requirement (SR) 3.5.3.4. The test was successful and the operators declared the RCIC system operable and available. At 2123 hours0.0246 days <br />0.59 hours <br />0.00351 weeks <br />8.078015e-4 months <br />, the plant entered Mode 1.

On December 8, 2007, at 0257 hours0.00297 days <br />0.0714 hours <br />4.249339e-4 weeks <br />9.77885e-5 months <br />, the RCIC system high pressure pump flow test was completed in accordance with SR 3.5.3.3. This surveillance test demonstrates the operational readiness of the RCIC system to start within 30 seconds and produce ?_ 700 gallons per minute (gpm) flow rate, with RCIC steam supply pressure 920 psig. The RCIC system was declared operable and power ascension proceeded. The RCIC system was then taken out of service for additional maintenance and tuning of the flow controller.

On December 10, 2007, at 0535 hours0.00619 days <br />0.149 hours <br />8.845899e-4 weeks <br />2.035675e-4 months <br />, a second RCIC system high pressure pump flow test was completed as a post maintenance test for the additional maintenance and tuning. The RCIC system passed the test and was declared operable.

Plant engineering performed a follow-up review of the RCIC flow controller settings and the flow controller test traces obtained from the testing/tuning activities. The traces were compared to those traces obtained for previous RCIC injections and to established acceptance criteria for RCIC system tuning. The review found that the flow controller tuning parameters were not adequate and could challenge stable RCIC system flow during the reactor pressure vessel (RPV) injection mode of operation.

On December 12, 2007, at 2110 hours0.0244 days <br />0.586 hours <br />0.00349 weeks <br />8.02855e-4 months <br />, the RCIC system was declared inoperable based on the review of recent RCIC flow controller performance. Technical Specification 3.5.3, RCIC System, Required Actions A.1 and A.2 (Verify by administrative means HPCS is OPERABLE within one hour and Restore RCIC System to OPERABLE status within 14 days) were entered. Required Action A.1 was completed.

The RCIC system underwent further tuning and testing efforts to properly set the flow controller. On December 21, 2007, at 0155 hours0.00179 days <br />0.0431 hours <br />2.562831e-4 weeks <br />5.89775e-5 months <br />, the RCIC system was declared operable and the plant exited TS 3.5.3 Condition A.

CAUSE OF EVENT

The change to Mode 2 with RPV pressure > 150 psig and Mode 1 during plant restart from the forced outage was made without the knowledge that the RCIC system could not perform its design function. The RCIC system passed its surveillance tests to demonstrate operational readiness and compliance with TS surveillance requirements. The system had been retuned with the RCIC flow controller set to values thought to be acceptable and demonstrated to be acceptable during the December 10, 2007, high pressure pump flow test test. Plant engineering, the vendor, and station management discussed RCIC system performance for the retest and tuning verification steps and concurred that the RCIC system performance was acceptable, but could be further optimized at a later date. Based on these considerations, the operators declared the RCIC system operable. It was not until two days later on December 12, 2007, that it was determined by additional engineering review of the test traces, the controller settings, and comparison with previous data that the new RCIC flow controller settings were questionable such that, if called upon, the RCIC system might not be able to perform its design function.

Further review found that the RCIC system had, in effect, been inoperable since January 21, 2006 because of the settings applied to the RCIC flow controller at that time. The settings were incorrect and would have prevented the RCIC system from performing its design function. Refer to Perry Mode 2 with RPV pressure >150 psig was entered on December 6, 2007, and when Mode 1 was entered on December 7, 2007.

Knowledge deficiencies in personnel responsible for determining and implementing RCIC flow controller tuning parameters played a significant role with interpreting the RCIC test results. The engineering staff lacked the requisite training/experience to define RCIC system acceptance criteria and direct process control tuning activities. The Instrumentation and Control (I&C) staff also lacked the requisite training and experience to define process control tuning set points and process control loop response acceptance criteria. Over time, the station expertise had eroded such that the maintenance activity resulted in unrecognized controller output adjustments that were outside of the expected ranges.

The cause for implementing incorrect RCIC flow controller tuning parameters was the lack of configuration control over the RCIC flow control loop tuning process to assure reliable RCIC performance consistent with its design basis. The RCIC controller settings had been removed from the Master Setpoint List since they were considered operational adjustments. The tuning procedure allowed for in field adjustments as necessary and set up the conditions where procedural barriers were removed and the station became dependent on knowledge and expertise to properly tune the RCIC flow controller.

EVENT ANALYSIS

This event does not in■iolve an operational transient or analyzed accident described -in the plant's, Updated Safety Analysis Report (USAR) Chapter 15, Accident Analysis. The plant did not comply with TS LCO 3.0.4 which states that when an LCO is not met, entry into a Mode or other specified condition in the Applicability shall only be made when the associated Actions to be entered permit continued operation in the Mode or other specified condition in the Applicability for an unlimited period of time. The RCIC system was inoperable during plant restart and therefore did not meet TS LCO 3.5.3 when the plant entered Mode 2 with RPV pressure > 150 psig and Mode 1.

The RCIC system is not an Engineered Safety Feature System. RCIC system operation is credited for several transients described in the USAR Chapter 15. The availability of the RCIC system contributes to the reduction of overall plant risk. The RCIC system is designed to operate either automatically or manually following RPV isolation to provide adequate core cooling and control RPV water level. The RCIC system is designed to initiate and discharge within 30 seconds at 700 gpm flow over a reactor pressure range of 165 to 1215 pounds per square inch absolute (psia).

The safety significance of starting the plant with an inoperable RCIC system is very low. A bounding probabilistic risk assessment (PRA) was performed for this condition. The PRA calculated the incremental conditional core damage probability (ICCDP) in this case to be 1.4E-07.

The Incremental Large Early Release Probability (ICLERP) is calculated as 15 percent of ICCDP, which results in an ICLERP of 2.1E-08. Configurations with a core damage probability less than 1.0E-06 and a large early release probability less than 1.0E-07 are not considered to be significant risk events.

CORRECTIVE ACTIONS

The control room operators declared the RCIC system inoperable and entered TS LCO 3.5.3, Condition A when notified of the RCIC flow controller tuning issues. The Required Actions were performed within the completion times specified in TS 3.5.3.

A comprehensive engineering analysis of the RCIC system performance prior to, during, and after the November 28, 2007, RPS actuation was performed. The RCIC system was re-tuned during startup from the forced outage. The RCIC flow controller settings were reset to values utilized during initial plant startup testing. Based on the results of the engineering analysis, the restoration of tuning parameters to startup testing values, and successful completion of post maintenance testing, the RCIC system was declared operable on December 21, 2007, at 0155 hours0.00179 days <br />0.0431 hours <br />2.562831e-4 weeks <br />5.89775e-5 months <br />.

The settings for the RCIC pump flow control modules in the main control room and the remote shutdown room will be placed under configuration management controls at the values demonstrated successful in the 1987 Startup Test RCIC RPV injection settings.

Instruction ICI-C-E51-003, RCIC CONTROL SYSTEM TUNING, will be revised to specify limits to perform RCIC flow loop tuning/controller setting changes. After calibration, repair or replacement, Perry will ensure RCIC flow controller settings are at the last demonstrated calibration positions that allowed a successful RCIC injection. Similar changes to assure configuration control of RCIC flow controller settings will also be applied to l&C work instructions ICI-B17-008, P&I CONTROLLER DIAL CALIBRATIONS,iand ICI-B16-015, BAILEY TYPE 701 CONTROLLER.

A training needs analysis will be performed for engineering personnel with' respect to process�, controller tuning. A job-task analysis will be performed for i&;,' to encompass the lessons learned from the RCIC events, especially for tuning of the RCIC flow controller. The results will be incorporated into the engineering and I&C technician training programs as appropriate.

The licensed operator training program lesson plan for the RCIC system will be revised to incorporate lessons learned from this event.

PREVIOUS SIMILAR EVENTS

A review of Perry LERs and the corrective action program database for the past five years found one similar event where a Mode change was implemented without complying with TS LCO 3.0.4.

instance where the Division 1 emergency diesel generator was declared inoperable in Mode 1 because of failing its monthly generator start and load surveillance. The plant changed Modes two times with the diesel generator inoperable. This condition was reportable in accordance with 10CFR50.73(a) (2)(i)(B). The corrective actions which were implemented involved restoring the generator output voltage within acceptance limits and improving the system operating instructions for the emergency diesels. None of the actions could reasonably have been expected to preclude occurrence of the recent forced outage startup with the RCIC system inoperable.

COMMITMENTS

There are no regulatory commitments contained in this report. Actions described in this document represent intended or planned actions, are described for the NRC's information, and are not regulatory commitments.