ML17313A224

LER 98-001-00:on 980130,reactor Protection & ESFAS Instrumentation Not Bypassed within one-hour Allowed by TS Occurred.Caused by Inadequate Procedures.Expectation to Detect Alarm Conditions Was Emphasized to CR Personnel

ML17313A224
Person / Time
Site:	Palo Verde
Issue date:	02/26/1998
From:	Marks D ARIZONA PUBLIC SERVICE CO. (FORMERLY ARIZONA NUCLEAR
To:
Shared Package
ML17313A223	List: ML17313A222 ML17313A224
References
LER-98-001, LER-98-1, NUDOCS 9803090378
Download: ML17313A224 (10)

Text

LlCENSEE EVENT REPORT (LER)

DOCKET NUMBER (2) PAGE (3)

ACIUTYNAME (1) 0 5 0 0 0 5 2 8 1oFO Palo Verde Unit 1 (4)

Reactor Protection and ESFAS instrumentation not b assed within the one hour allowed b TS LER NUMBER 6 REPORT DATE OTHER FACILITIESINVOLVED 6 REVIQON MONTH T NUMBERS MQNlH OAT SEQUENTIAL NUMBER NUM8ER 0 5 0 0 0 0 1 3 0 9 8 9 8 - 0 0 1 0 0 0 2 2 6 9 8 0'5 0 0 0 REPORT IS SUBMITTED PURSUANI'O THE REQtnREMENTS OF 10 CFR C (Check one or more of the ooBowlno) (11) 2IL402(b) 20.405(c) 50.73(a)(2)(n) 73.71(b) 20.405(a)(1)(i) 50.35(c)(1) 50.73(a)(2)55 73.71(c) 20.405(a)(1) 50.30(c)(2) 50.73(a)(2)(rii) OTHER (Specify in Abstract LEVEL(IO) 1 0 0 Oi) 20.405(a)(1)(iii) 5O73(a)(2)() 50.73(a)(2)(riiii)(A) beIINr and in TsxL NRC Form 20405(a)(1)(H 5O73(a)(2)(a) 5073(a)(2)o'er)(B) 355A) 20.405(a)(1)(r) 50.73(a)(2)(rs) 50.73(a)(2)(r)

UCENSEE CONTACT FOR THIS LER (1 2)

Daniel G. Marks, Section Leader, Nuclear Regulatory Affairs 6 0 2 3 9 3 - 6 4 9 2 COMPLETE ONE UNE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT (13)

MANUFAG REPORTABLE MANUFAC. REPORTABLE TURER TO NPRDS TURER TO NPRDS SUPPLEMENTALREPORT EXPECTED(14) EXPECTED DAY YEAR SUBMISSION YES Of Tes, complete EXPECTED SUBMISSION DATE) DATE (1 5)

TRAcT (Umit to 1400 spaces. Le., approximately fifteen srngleepsce pepi 'tten lines) (16)

On January 30, 1998, at approximately 1716 MST, Palo Verde Unit 1 was in Mode 1 (POWER OPERATION), operating at approximately 100 percent power when the requirement for Technical Specification Limiting Condition for Operation (TS LCO) 3.3.1 and 3.3.2 for an inoperable low steam generator No. 1 (SG-1) pressure trip parameter was not met. From approximately 1605 MST to 1716 MST, low SG-1 pressure trip parameter had been inoperable for greater than the one-hour allowed by TS without being placed in the bypassed or tripped condition due to the low SG-1 pressure setpoint drifting low during the performance of a surveillance requirement.

The cause of the event was attributed to inadequate procedural guidance that did not address the potential impact of the response time testing in progress on the low SG setpoints.

As corrective action, the surveillance procedure was updated to require Instrumentation and Control personnel and Control Room personnel to verify that the low SG pressure setpoint(s) aze correct.

No previous similar events have been reported pursuant to 10CFR50.73.

98030'7)0378 980226 PDR ADOCK 05000528 S PDR

41 41 LICENSEE'EVENT REPORT (LER) TEXT CONTINUATION DOCKET NUMBER LER NUMBER PAGE YEAR RPAQON NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 8 0 0 1 0 0 0 2 of 0 5 1~ REPORTING REQUIREMENT:

This LER 528/98-001-00 is being written to report an event that resulted in an operation or condition prohibited by the plant's Technical Specifications (TS) as specified in 10 CFR 50.73(a)(2)(i)(B).

At approximately 1716, MST on January 30, 1998, Palo Verde Unit 1 was in Mode 1 (POWER OPERATION) operating at approximately 100 percent power.

TS Limiting Condition for Operation (LCO) 3.3.1 (reactor protection instrumentation) (JC) and TS LCO 3.3.2 [engineered safety features actuation system (ESFAS) instrumentation) (JE) state that the channels shall be OPERABLE. Specifically, the low steam generator (AB) pressure trip shall have a total of 4 OPERABLE channels per steam generator (SG).

The associated ACTIONs for both TS LCO 3.3.1 and 3.3.2 state that with the number of channels OPERABLE one less than the total number of channels, STARTUP and/or POWER OPERATION may continue provided the inoperable channel is placed in the bypassed or tripped condition within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

Contrazy to the requirement for TS LCO 3.3.1 and 3.3.2, from approximately 1605 MST to 1716 MST on January 30, 1998, low steam generator No. 1 (SG-1) pressure trip (parameter 11) had been inoperable for greater than the one-hour .allowed by TS. At approximately 1716 MST, Control Room personnel placed the Channel A low SG-1 pressure trip in bypass and entered 3.3.1, 3.3.2, 3.3.3.5 (remote shutdown system monitoring instrumentation) (IU),

and 3.3.3.6 (post-accident monitoring instrumentation) (IP).

2~ EVENT DESCRIPTION:

Prior to the event, at approximately 0854 MST on January 30, 1998, Control Room personnel placed the plant protection system (PPS) ( JC) A channels in bypass for performance of the bistable and bistable relay response time test by Instrumentation and Control (1&C) maintenance personnel. Control Room personnel entered TS LCO 3.3.1, 3.3.2, 3.3.3.5, and 3.,3.3.6. As part of the procedure steps to restore the PPS A channels, 1&C personnel requested Control Room personnel to perform a channel check on the parameters to be unbypassed. Following the channel checks, at approximately 1605 MST, Control Room personnel removed the PPS A channels from bypass and exited TS LCOs 3.3.1, 3.3.2, 3.3.3.5, and 3.3.3.6.

During the performance of the PPS A channels response time testing, many alarms associated with the response time testing came in and were cleared by Control Room personnel following verification that the alarms were associated only with PPS A channels. Most of the alarms occurred on the control board windows and were audible. An additional surveillance was in

0 LICENSEE'EVENT REPORT (LER) TEXT CONTINUATION AQUIYNAME DOCKET NUMBER LER NUMBER PAGE YEAR REVISION NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 8 0 0 1 0 0 0 3 Cf progress to test the interlocks on the Non-class 1E 13.8 kV startup transformer (NAN-X02) (EA) and many alarms appeared in annunciator windows and/or scrolled down the computer screen. At approximately 1700 MST, NAN-X02 was restored and a majority of the alarms cleared. Control Room personnel noticed that the Channel A low SG-1 pressure setpoint alarm scrolled to the top of the computer screen and at approximately 1716 MST, Control Room personnel placed the Channel A low SG-1 pressure trip (parameter 11) in bypass and entered TS LCO 3.3.1, 3.3.2, 3.3.3.5, and 3.3.3.6. At approximately 1718 MST, Control Room personnel also placed Channel A low SG-1 and SG-2 level trip (parameter 18 and 19) in bypass in accordance with applicable TS LCO ACTIONs.

Following further investigation into the Channel A low SG-1 pressure setpoint alarm, Control Room personnel discovered that at approximately 1514 MST on January 30, 1998 (while the channel was in bypass for testing), the low SG-1 pressure setpoint had drifted from the normal 890 psia to 795 psia. Control Room personnel also noted that the Channel A low SG-2 pressure setpoint (parameter 12) had drifted below 890 psia at approximately 1458 -MST and returned to normal at approximately 1522 MST.

At approximately 2121 MST, Control Room personnel placed the Channel A low SG-2 pressure trip (parameter 12) in bypass and initiated approved work request documentation to troubleshoot both anomalies.

Contrary to the requirements of TS LCO 3.3.1 and 3.3.2, from approximately 1605 MST to 1716 MST on January 30, 1998, Channel A low SG-1 pressure trip (parameter 11) had been inoperable for greater than the one-hour allowed by TS. There were no safety system actuations and none were required.

3~ ASSESSMENT OF THE SAFETY CONSEQUENCES AND IMPLICATIONS OF THIS EVENT:

The low SG pressure trips provide protection against an excessive rate of heat extraction from the SGs and resulting rapid, uncontrolled cooldown of the reactor coolant system (RCS) (AB). This trip is needed to shut down the reactor (AB) and assist the ESF system in the event of. a main steam (SB) line break or main feedwater (SJ) line break accident. A main steam isolation signal (JE) is initiated simultaneously. An operability determinati'on was performed and determined that the low SG pressure setpoints remained capable of performing the required design functions within the updated Final Safety Analysis Report Chapter 15 analyses. The event did not result in any challenges to the fission product barriers or result in any release of radioactive materials. Therefore, there were no adverse safety consequences or implications as a result of this event.

This event did not adversely affect the safe operation of the plant or health and safety of the public.

LICENSEE'EVENT REPORT (LER) TEXT CONTINUATION DOCKET NUMBER LER NUMBER PAGE YEAR RENSON NUMBER NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 8 0 0 1 0 0 0 4 of 0 5

4. CAUSE OF THE EVENT:

An independent investigation of this event is being conducted in accordance with the APS Corrective Action Program. A preliminary evaluation has determined that the apparent root cause is attributed to inadequate written communications in that the response time test procedure did not contain guidance regarding the potential impact on the low SG pressure setpoints during the performance of the response time testing (refer to Section 5 for details). The procedure stated that resetting the low SG pressure setpoint was not applicable in Modes 1 (POWER OPERATION) or 2 (STARTUP) (SALP Cause Code D: Defective Procedure). Transportability issues to related surveillance procedures is being addressed in the investigation.

In addition, a human performance evaluation (HPE) was completed; The HPE noted that an unexpected Channel A low SG-1 pressure setpoint alarm was not immediately recognized. With both the response time test and the restoration of NAN-X02 causing a large number of alarms, Control Room pezsonnels'utility-licensed operator) ability to recognize an alarm such as the low SG pressure .setpoint alarm that has no audio or flashing annunciator window was impacted. The SG pressure setpoint alarm on the computer screen was embedded amongst many other alarms. Although the setpoint indication on the control board is in close proximity to the parameters that Control Room personnel verified during the performance of the channel check, the channel check surveillance procedure did not require a verification of the setpoint indication. The HPE also noted that Control Room personnel were unaware that under certain conditions, the response time test could affect the setpoints.

If the final evaluation results differ from this determination, a supplement to this report will be submitted to describe the final root cause determination.

5. STRUCTURES, SYSTEMS, OR COMPONENTS INFORMATION:

The response time test was not expected to affect SG setpoints even though the design characteristics of the instrument's components can initiate card oscillation which set up the potential for the low SG pressure setpoint to drift. The variable setpoint cards within the PPS are sub)ect to setpoint oscillations if the input to the setpoint card exceeds approximately 10 VDC. The setpoint oscillation is due to range limitations of the digital-to-analog converter on the variable setpoint cards.

II '/

,1

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION DOCKET NUMBER LER NUMBER PAGE YEAR SEQUENTlAL RENQON NUMBER NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 8 0 0 1 0 0 0 5 of 0 5 There are no indications that any structures, systems, or components were inoperable at the start of the event which contributed to this event. No component or system failures were involved. No failures of components with multiple functions were involved. No failures that rendered a train of a safety system inoperable were involved.

6. CORRECTIVE ACTIONS TO PREVENT RECURRENCE:

An independent investigation of this event is being conducted in accordance with the APS Corrective Action Program. Actions to prevent recurrence are being developed based upon the results of the investigation and aze being tracked to completion under the PVNGS Commitment Action Tracking System. These actions include a procedure change requiring I&C and Control Room personnel to verify that the low SG pressure setpoint(s) aze correct on completion of the test. In addition, the expectation to detect alarm conditions was emphasized to Control Room personnel.

7. PREVIOUS SIMILAR EVENTS:

Although previous events have been reported pursuant to 10 CFR 50.73 in the past three years for missing TS surveillance requirements, the causes discussed in the previous events have not been similar to this event.

Therefore, the corrective actions of the previous events would not have prevented this event.

II;