05000529/LER-2008-001
| Docket Number Sequential Revmonth Day Year Year Month Day Yearnumber No. 05000 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor |
| 5292008001R01 - NRC Website | |
All times are Mountain Standard Time and approximate unless otherwise indicated.
1. REPORTING REQUIREMENT(S):
This LER is being submitted pursuant to 10 CFR 50.73(a)(2)(i)(B) as a condition prohibited by Technical Specifications (TS) and 10 CFR 50.73(a)(2)(v)(A) as a condition that could have prevented the fulfillment of a safety function required to maintain the reactor in a safe shutdown condition when plant operators failed to reset the Boron Dilution Alarm System (BDAS). When a BDAS channel is in an alarm condition, the channel loses its ability to alert the control room operators of an inadvertent boron dilution event until the channel is reset manually. Technical Specification (TS) 3.3.12 Actions A.1, B.1 and C.1 were not performed, and TS Limiting Conditions for Operation 3.0.4 was not met when the Operating Mode was changed from Mode 6 to Mode 5.
2. DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):
The Boron Dilution Alarm System (BDAS) (EIIS: IG) provides two independent and redundant channels (channels 1 and 2) to ensure detection and alarm of a boron dilution event while in hot standby, hot shutdown, cold shutdown, and refueling modes, Modes 3 through 6, respectively.
The BDAS is credited in the Updated Final Safety Analysis Report Chapter 15 safety analysis with alerting operators to an inadvertent boron dilution 15 minutes prior to achieving criticality assuming the maximum dilution rate while in modes 3, 4, and 5, and within 30 minutes in Mode 6. This allows the operator time to diagnose and terminate the boron dilution prior to criticality.
The BDAS receives and monitors two neutron flux signals (one per BDAS channel) from the startup channel nuclear instrumentation. When these neutron flux signals increase during shutdown to equal to or greater than the calculated alarm setpoint, alarm signals are generated. The BDAS provides two separate and independent alarm signals (one signal per BDAS channel) to the plant annunciation system upon determination of a boron dilution event. Each alarm signal will cause the annunciator window "Possible Inadvertent Boron Dilution" to alarm.
Each BDAS channel calculates the boron dilution alarm setpoint to one-third decade above the current neutron flux when the flux is not increasing. If the neutron flux signal increases to the setpoint, an alarm signal is generated. The current neutron flux indication and alarm setpoint (per channel) are displayed on the BDAS panel located behind the control room panel area.
� When a BDAS channel alarms, a reactor operator is required to evaluate the alarm, initialize the system to the current neutron flux and reset the alarm which reestablishes a setpoint value of one-third decade above the current flux level.
3.INITIAL PLANT CONDITIONS:
On May 8, 2008, Unit 2 was in Mode 6 (Refueling) following refueling activities with the reactor coolant system (RCS) (El IS: AB) at atmospheric pressure and temperature between approximately 76 to 99 degrees Fahrenheit.
4.EVENT DESCRIPTION:
From May 8 through May 21, 2008, multiple instances occurred in which Control Room operators treated the BDAS alarm as a nuisance alarm and failed to reset the alarm for extended periods of time (1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />). The alarm would often activate many times a shift at low power levels due to electronic noise in the circuit. Since the BDAS control panel is located in the control room back panel area an operator is required to turnover in progress activities to another qualified operator to reset the BDAS alarm.
5.ASSESSMENT OF SAFETY CONSEQUENCES:
The BDAS channels alarm to alert operators to take action to terminate inadvertent boron dilution and are required to be operable in Modes 3, 4, 5 and 6. Operability of the BDAS channels are necessary to meet the assumptions of the safety analyses to mitigate the consequences of an inadvertent boron dilution event as described in the Updated Final Safety Evaluation Report (UFSAR), Chapter 15. A review of plant data from May 8, 2008, to May 22, 2008, identified multiple occasions where both BDAS alarms were not reset for an extended period of time. Refueling (Mode 6) for Unit 2 commenced on May 8, 2008, at 11:26 and was completed on May 14, 2008, at 02:57 (Mode 5). During this timeframe, RCS boron concentration ranged from 4152 to 4184 ppm, well above the 3000 ppm required by TS LCO 3.9.1 and the Core Operating Limits Report Unit 2, Rev. 15.
Unit 2 entered Mode 5 on May 14, 2008, with both BDAS alarms actuated. In Mode 5, make up from the Volume Control Tank (VCT) automatically cycles as required to maintain RCS inventory. This process resulted in diluting the boron concentration in the RCS to approximately 3753 ppm at its lowest concentration on May 16, 2008, at 15:17. The prior boron sample was 4230 ppm on May 15, 2008, at 08:55. Procedure 72ST-9RX14, Shutdown Margins - Modes 3, 4 and 5, was completed satisfactorily on May 16, 2008, at 20:20, concluding that shutdown margin was met.
No inadvertent dilution occurred from the time Unit 2 entered Mode 6 on May 8, 2008, to May 22, 2008, when the Operations Department issued a night order stating the importance of the 0 BDAS alarm and directing timely reset of the alarms. This.event was determined to be a safety system functional failure as described in 10 CFR 50.73(a)(2)(v)(A), since the failure to reset the BDAS alarms could have prevented the fulfillment of a safety function. The event described did not result in any challenges to the fission product barriers or result in the release of radioactive materials. Therefore, there were no adverse safety consequences or implications as a result of this event and the event did not adversely affect the safe operation of the plant or the health and safety of the public.
6.CAUSE OF THE EVENT:
The direct cause of the event was operators treated the BDAS alarm as a nuisance alarm and failed to reset the alarm in a timely manner which rendered the alarm unavailable to perform its technical specification function of alerting the operators to a boron dilution event.
The root cause was the operators did not recognize that by not resetting the BDAS alarms they were preventing the alarm from fulfilling its safety function of alerting the control room operators to an inadvertent dilution event.
A contributing cause of the event was that previously identified BDAS design changes to minimize nuisance alarms were not implemented.
7.CORRECTIVE ACTIONS:
Corrective action included the following:
- A night order was issued on May 22, 2008, after the condition was identified. The night order stated the importance of the BDAS alarm and directed timely reset of the alarm.
- Additionally, procedure 40AL-9RK3A, "Panel BO3A Alarm Response," was revised to include a note stating the alarm function is necessary to maintain operability of the BDAS.
- Training was conducted for plant operators in License Operator Continued Training (LOCT) and License Operator Initial Training (LOIT) on the investigation results from this event.
- The BDAS discriminator voltage was optimized in all three Units to reduce the number of nuisance alarms caused from electronic noise.
8. PREVIOUS SIMILAR EVENTS:
No similar conditions have occurred in the prior three years.
�