05000443/LER-2004-002
| Docket Numbersequential Revmonth Day Year Year Month Day Year N/Anumber No. 05000 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 4432004002R00 - NRC Website | |
I. Description of Event
On October 5, 2004 at 1830, while operating in Mode 1 at 100% power, it was determined that pressurizer level recorder 1-RC-LR-460 [LR], one of the two channels of pressurizer level instrumentation required by TS 3.3.3.6, Accident Monitoring Instrumentation, had been inoperable for a period longer than the seven days permitted by Technical Specifications.
Investigation into a September 24, 2004 failed analog channel operational test (ACOT) found that the recorder, a model 227 Foxboro recorder, was inoperable for approximately 60 days from April 5, 2004 until June 4, 2004 due to the failure of a feedback potentiometer on the level recorder.
A review of the level recorder's response during an ACOT on the pressurizer level instrument performed on April 5, 2004 showed that the recorder trace was not consistent with traces observed during previously performed ACOTs and was not consistent with the response that would be displayed by a properly functioning recorder. The performance of the recorder during the April ACOT, with only 26 days of in-service time on the feedback potentiometer, indicates that the recorder was inoperable on April 5, sixty days before the potentiometer was replaced during routine maintenance. Additional reviews of the level recorder's response during previous ACOTs revealed that the recorder was inoperable from July 2, 2001 until January 3, 2002 and from August 26, 2002 until September 9, 2002.
A 24-hour notification was made to the NRC at 1958 on October 5, 2004 in accordance with Section 2G of Seabrook Station's Operating License.
II. Cause of Event
The cause of this event was inadequate failure analysis that did not identify the causal relationship between process oscillations and the design life of the potentiometer. In addition, numerous apparent cause evaluations did not adequately address the effectiveness of corrective actions for repeat failures of the potentiometers.
There had been several failures of the recorder since a new style feedback potentiometer was first installed in March 2002. The apparent cause evaluations completed for the failures did not adequately address why previous corrective actions were ineffective in resolving the recorder failure. Although it was known that the Foxboro model 227 recorders were experiencing feedback potentiometer failures, personnel familiar with the Foxboro recorder did not understand that the failure mode of the feedback potentiometer is to fail "as is" and to provide a false indication similar to an operable potentiometer. When the failure mode was understood, the possibility of additional undetected failures of the level recorder became evident. In addition, the causal relationship between the process cycle frequency and the potentiometer design cycle life had not been identified during previous failure evaluations. The design life of the potentiometer is 10 million cycles while the process cyclic input to the potentiometer was approximately one million cycles per day. Formal troubleshooting activities identified the causal relationship between the cyclic behavior of the process-input signal and the design life of the feedback potentiometer to result in a nominal failure interval of approximately 10 days.
The evaluation for extent of condition for this event concluded that Foxboro model 227. recorder RC-LR-460 is the only recorder that is subjected to signal oscillations such that premature potentiometer failures could be expected. The second accident monitoring pressurizer level instrument channel, RC-LR-459, does not have a similar problem as the design includes an additional process card that acts as a signal filter. All other PAM recorders monitor a temperature or pressure (not level) instrument loop that is not susceptible to the excessive signal oscillations.
Ill. Analysis of Event The design function of the pressurizer level instrumentation is to provide primary information for the control room operators to take specific preplanned manual actions for which no automatic control is provided. These actions are required for safety systems to accomplish their safety function for design basis accident events. The operators rely on indication of pressurizer level to make key decisions in both the abnormal and emergency operating procedures.
This event resulted in no adverse safety consequences as the second channel of pressurizer level instrumentation was operable and available. The redundant pressurizer level recorder, 1-RC-LR-459, has not experienced frequent, similar failures and alternate normal and post.
accident qualified instruments were unaffected by the condition of 1-RC-LR-460. However, the event has regulatory significance in that it constituted a condition prohibited by the Technical Specifications.
This event was classified as a Maintenance Rule Functional Failure as defined in Maintenance Rule system function PAM-01 for 1-RC-LR-460.
IV. Corrective Actions
A design modification has been implemented to filter out the noise signal that is causing premature feedback potentiometer failure.
The feedback potentiometers are being verified operable on a periodic basis to ensure the design modification has corrected the premature potentiometer failure.
Supplemental training will be provided to Plant Engineering on performance of Apparent Cause Evaluations related to equipment failures.
Plant Engineering Guideline PEG 45, "Maintenance Rule Goal Setting and Monitoring," will be revised to provide specific guidance for conducting Maintenance Rule Functional Failure (MRFF) evaluations to include (1) identification of failure modes and effects, (2) monitoring for effectiveness of corrective actions, and (3) peer and supervisor reviews of completed failure analysis.
V. Similar Events None