ML20134B604

Completes Commitment Made to NRC in Ltr Re Reportable Occurrence Concerning TS Violation

ML20134B604
Person / Time
Site:	Pennsylvania State University
Issue date:	01/23/1997
From:	Randy Erickson PENNSYLVANIA STATE UNIV., UNIVERSITY PARK, PA
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
NUDOCS 9701300224
Download: ML20134B604 (9)

Text

_.

l l

(814)863-9580  !

PENNSTATE Fax: (814) 863-9659 Vice President for Research The Pennsylvania State University ,

207 Old Main  !

University Park, PA 16802-1503 I

l January 23,1997 )

I U.S. Nuclear Regulatory Commission i l

Document Control Desk Washington, DC 20555 Re: Reportable Occurrence: Tech Spec Violation License R-2, Docket No.50-005, letter of December 20,1996 i l

Dear Sir or Madame:

I This letter and its attachment, addendum to reponable event letter of December 20,1996, completes the commitment made to the U.S. Nuclear Regulatory Commission in our letter of December 20,1996. If you have any questions on this matter, please refer them directly to Warren F. Witzig at (814) 865-6351.

Sincerely,

+ d~s Dr. Rodney A. Erickson Interim Vice President for Research RAE:WFW/ldb4008A.97 gj Attachment pc: Region I Administrator  ;

T. Flinchbaugh

\

\

n 1s>

Subscribed to the sworn before me on this J'/ ti day of Wmu au& ,1994, Notary Public in and for Centre County, Pennsylvania. l/ (

f l 9701300224 970123 PDR ADOCK 05000005 Notarial Seal S PDR Bonnie L. Burns, Notary Public

' g State College Boro, Centre County My Commission Expires Nov. 22,1999

.- January 23,1997 Addendum to Reportable Event Letter of December 20, 1996 l Introduction

. On December 16,1996 the Penn State Breazeale Reactor operated in violation of a Technical l Specification (TS) requirement. The reactor was operated at 100 watts steady state and subsequently pulsed ($2.75). It was discovered after the pulse that the fuel temperature safety channel was inoperative during the steady state condition and during the pulse. The other safety channels, linear power, and percent power, were operational during the steady state operation. The reactor's negative

temperature coefficient and the TS limit for pulse magnitude are the dominate safety features during a pulse. Even though the fuel temperature safety channel trip is ineffective at protecting the core during a pulse, it is required by TS. It is also a TS requirement that the peak fuel temperature be recorded 3 during a pulse. During the operation prior to the pulse #6659, TS Sections 3.2.3 and 3.2.4 were violated. During pulse #6659, sections 3.2.3,3.2.4 and 4.2.3e were violated.

, Based on the operating history and characteristics of the reactor core, peak fuel temperatures of approximately 500 *C wem expected for this size pulse ($2.75). The expected fuel temperature is well below the LSSS of 700 *C. The loss of a safety channel is a serious matter. During this event, the core parameters were within the limits analyzed in the Safety Analysis Report.

J Event History A series of pulses were being performed for an experimenter who was monitoring reactor pulse power with an external data acquisition system (figure 1). During the course of this day 13 pulses had been completed, ranging in power from 1150 MW to 1200 MW. During the last pulse

the reactor operator noticed that reactor fuel temperature did not respond to an increase in reactor i power. Peak fuel temperature readings of approximately 500 *C were expected. Fuel temperature j indication during the pulse did not change and the peak fuel temperatures reconfed during the pulse ,

{ were 33.7 *C and 32.5 *C for fuel temperature #1 and #2 respectively. The following is a timeline l of what took place.

19:41:37 Pulse #6658, Peak Power = 1176 MW, Fuel 1 Temp = 495 *C, Fuel 2 Temp = 494 *C 19:47:00 Startup for pulse # 6659 19:47:23 Fuel Temp 1 = 13.6 *C, Fuel Temp 2 = 15.4 *C 19:48:00 *** Experimenterincreased probe potential to +20 volts from +15 volts

19

48:21 Fuel Temp 1 = 30.2 *C, Fuel Temp 2 = 31.9 *C (Note the event at 19:48:00 above) i 19:51:00 Reactor critical at 100 watts

! 19:57:00 Pulse #6659, Peak Power = 1168 MW, Fuel 1 Temp = 33.7 *C, Fuel 2 Temp = 32.5 *C 1

l 20:00:00 Phone call to system expert for guidance

! 20:10:00 AP-4 Event Evaluation initiated, AP-10 "Do Not Operate " tag placed on console 20:14:00 Reactor secured 20:39:25 Fuel Temp 1 = 30.2 *C, Fuel Temp 2 = 33.1 *C 20:40:00 *** Experimenter shutoff equipment for the night 20:40:23 Fuel Temp 1 = 10.1 *C, Fuel Temp 2 = 12.4 *C Approximate times the experimenter started and ended operation outside of experiment's specifications.

I

l l ,

January 23,1997 I -

As indicated, a step change occurred in both fuel temperatures just prior to performing pulse

1. 6659. After performing pulse #6659 the operator immediately realized that the fuel temperature l channels were inoperative. Immediately, the staff placed a phone call to the system expert for i consultation, as to which historical trends may be ofimportance in the investigation. (Some historical trends are overwritten in 20 minutes time.) Several of these trends are attached. An AP-4 Event Evaluation was initiated and an AP-10 "Do Not Operate" tag was placed on the console.

Approximately 43 minutes after performing pulse #6659 the fuel temperatures returned to the  !

expected normal operating temperatures. The fuel temperature channel was inoperative for 53 1 minutes. An extensive investigation into the cause of the event was initiated and completed.

Attached are trends of pulse #6658, pulse #6659 and a time trend showing reactor power, and reactor fuel temperature during pulses #6658 and #6659. l l

Testing and Analysis Immediately a comprehensive evaluation of this event was undertaken. Attachment 1 l documents the fuel temperature before, during and after pulse #6659. This trend clearly shows the j fuel temperature step change just prior to operating the reactor at 100 watts and returning to normal -

some 53 minutes later. Attachment's 2 and 3 show the data acquired during pulses #6658 and

1. 6659. After reviewing data from the Local Area Network (LAN) system, the DCC-Z message log, the trends printed by the staff immediately after the event, and reviewing the event with the experimenter, we were able to reconstruct the timetable above. Between pulses #6658 and #6659 the experimenter increased the experimental probe e.xcitation from +15 volts to +20 volts, this l caused the initial step change in the fuel temperatures. After the event had taken place and the mactor was secured, the experimenter turned his equipment off for the night. This resulted in the fuel temperatures returning to their normal readings. During the investigation the following key steps were completed:

AECL was contacted for failure modes and effect analysis report.

• Gamma-Metrics was contacted for technical assistance.

• Problem was isolated to experimental equipment.

• Mechanical coupling between the experiment and the reactor core investigated.

High speed isolator was tested for DC end AC response.

Experimental setup and equipment manuals were reviewed.

. Thermocouple functionality m the instrumented element was verified.

• Pool water was analyzed for fission products and none were found.

After completing these steps and reviewing the experimental data acquisition manuals, it was determined that the maximum analog input level for the data acquisition system was exceeded when the experimenter increased the probe excitation from +15 volts to +20 volts. This excitation potential inemase activated the over voltage protection circuit in the data acquisition equipment creating a cunent path to plant ground. This created a ground loop through the instrumented element in the core (Figure 1). The design of the instrumented element is such that the thermocouple junction is connected to plant ground through the reactor core tower. After determining that a ground loop was the fault we were able to duplicate the effect by simulation. The simulation duplicated the effect of shunting the thermocouples making them inoperative and non-responsive to a temperature transient. When the ground loop is broken the fuel temperature safety channel operates properly. It was verified that the functionality of the thermocouples returns to normal by either disconnecting the experimental equipment from the pulse power analog output signal, turning off the excitation power supply or by turning off the data acquisition system. While the ground loop is in place, the thermocouples are inoperative and there is -10 volts potential on each side of the thermocouples with respect to instrumentation ground.

l 2

i 1 .

t January 23,1997 l -

Evaluation and Conclusions The -10 volt potential measured on both sides of the thermocouples with respect to j instrument ground is key to the analysis of why the thermocouples were ron-operative dudng the steady state operation and did not respond to the pulse. Referring to Figure 1, the main

components of the thermocouple amplifier circuit are the thermocouple, diode protection, JFET, j instrumentation amplifier and the temperature compensation. The thermocouple input is connected j between R1 and R2 and R6 and R7 which provides bias current for the amplifier and a substitute j voltage if the the.mocouple opens or is disconnected. This substitute voltage provides an input to 4

the amplifier that generates an output indication of greater than 1200' C. Zener diodes CRl- CR4, provide over voltage protection for the input of the amplifier. The JFET is normally held off by

holding the gate to source differential voltage to approximately -13 volts. When the gate is pulled to i ground by a test switch, the differential gate to source voltage becomes approximately 0 volts j

, turning the JFET on. This shorts the thermocouple inputs together; activating the test switch j j Fuel 1 Ref. or Fuel 2 Ref. also generates a non-operate condition which causes a teactor trip.

When the thermocouple inputs are shorted the output of the thermocouple amplifier indicates the temperature of the compensation circuit. Due to the -10 volt potential being arplied to the thermocouple junction the JFET was turned on. It was turned on by decreasing the gate to source 1 voltage to approximately -3 volts. Turning on the JFET shorted the thermocouple inputs together. l This does not generate a non-operate condition because the test switch was not activated and i therefore did not trip the reactor. Shorting the inputs together forced the output of the amplifier to approximately 30 *C, which was the temperature indication of the temperature compensation circu.t. Additionally when these inputs are shorted, they cannot respond to any temperature change in the fuel. This resulted in a non-operative thermocouple during the steady state operation and pulse #6659 since the circuit could not respond to the temperature of the instrumented element.

Tarefore the fuel temperature safety circuit was inoperative.  ;

Additional Testing During the analysis of the event,it became evident that similar effects could possibly occur if the over voltage protection circuit of the thermocouple amplifier is activated. If a potential of-sufficient magnitude is impressed on the thermocouples the over voltage protection circuit could activate. To determine if this is the case, funher testing was undertaken. A potential (+V) was applied to the thermocouple junction and increased to +20 volts while monitoring the thermocouple outprt indications. Increasing the potential up to approximately +14 volts caused no noticeable change on the temperature indicators. Between 14 and 20 volts the output of the temperature channel dropped from a simulated high temperature (300*) to 0 *C and remained there. The over voltage protection did clamp the input to approximately 15 volts protecting the amplifier as was intended. As we suspected, the temperature channel fails to function if over the voltage protection circuit activates.

Root Cause The primary root cause of this event was inadequate isolation between the reactor safety system and an experimental setup. The reactor staff understood the imponance of isolating the reactor safety system from possible sources of compromise, but did not adequately evaluate the effect that possible failure modes of the experiment could have upon the safety system.

Additionally, the staff did not anticipate that a connection to the pulse power channel could have an effect on an adjacent fuel temperature channel. A second contributing cause to this event was operator failure to adequately observe and understand the state of the reactor prior to and during steady state operation, i

3 I

l 4

L -

January 23,1997 Actions Taken to Prevent A Recurrence A number of actions have taken place to assist in forestalling a recurrence of this event such

( as, administrative controi, operating procedures improvement, operator training and the

specifications for prospective experimenters as well as operator monitoring of the experiment's

progress.

i These included:

i l j e To increase administrative control, SOP-5, Experiment Evaluation and Authorization, has been 1 j modified as follows: '

f 1) A statement has been added that reads " Experiments shall be designed such that no j j extraneous signal is to be allowed to reach the reactor safety system. Experimenters

~

can be provided needed signals either from auxiliary systems not connected to the 4

reactor console or through a suita. ale isolation device from the control console. Use ofisolation devices must be reviewed according to 10CFR 50.59 and approved by i the reactor Director or designee."

2) A statement has been added that reads "The experimental evaluation shall determine j if a detailed experimental procedure is needed to assure compliance with TS. All l specifications for experimenters shall include communication to the operator of the j intention to perform the next experimental step, and the requirement to receive i reactor operator acknowledgment that it is safe to perform that step before l proceeding."

1 .* To reinforce the need for operator awareness at all times of al; seactor parameters important to l safety, SOP-1, Reactor Operating Procedure, has been modified as follows:

i i A statement has been added that reads "The reactor operator shall practice an operator i awareness protocol such that all safety parameters are compared and evaluated. Any 1

I abnormal or unexplained behavbr or any deviation from expected values of safety j parameters shall be immediately investigated."

I e Operator training has been completed on the root cause of this event, on the increased administrative control and operator awareness of parameters important to safety. The procedural changes above, reflect issues discussed in the operator training. ,

1 Restart of Reactor Operations  !

The above precautions have been satisfactorily explained to the Reactor Safeguards Committee. The management has authorized restart of the reactor and a rigorous console checkout ,

is underway as well as the customary reactor restart checkout. l l

WFW:MEB:DEH:TLF/pjs 4008B.97 i

4

s.

" - t name =neg_ temp IJpda+? Period = 9,s4sec as w -

.i' ,t , , ,

700.0 rrs IY' l QhY b h,10 d'

0 0 (*  ;

O.100 I

q o1'g/ ,{

j t g&Nr #

Se,03' -i i '

rrs

/'  !

e ft._lca_per \ lc- l4 'l's

-0.815 ',, e/ \/

)

jI d'"

7 3 gg. / ;/[ll

"~# y 5e s), @c I l

I 1

Gg' ~'

i rrs

,duremy rq'_cas

9. 1 A

\ a 66 TB ..

?"l

/ \

0.100 I

\,

r,;c c. Tage 41 .,

i fc_ log _ rate 0,120 f v >y t.,,,p l

-0.100 , ,

i P $$e '

, , , ,g p C t

ATTACHMENT 1

i l

f i  !

l 2

1 i ;0URCE PLUG l

MANU9Ls ..- AUTC 2 S0 WAVE PULSE j CREEN ROCF -

,. LiN 3 J

-1500 j

v* _ Pulse Date: 96 Dec 16

Pulse Time

19:42:41.8 Pv6 a %s8 pulse 003

)%SCRR4- -m00 TR Pas'n: 12.94 in.

To Worth: 2.72 5

- 1) I,.it Per: 0.116 kW l

- l Peak Power: 1176.0 MW

- 900 Intea'd Power: 14.6 MJ BYPASS Half EHt Width: 11.2 ms Time to Peak :256.8 ms Peak Fuel Temperatures RAD / EUAC

- 600 iemp 1: 490.0 C Temp 2: 494.4 'C RCD CONTROL

\

b AUX - e00 i

\

FPCAfIY j g v

v.

> - ~ ~

uuu

,,,a_ )

ECpCtrls EMsg EBar ETrend 3 xit EAlarm 57.14:00:00b7c~0T....1 T System clock synchranized to.X. .

. . . . . , . . . . ATTACIDiENT 2

. . .._ y .

7

e 1 SOURCE PLUG 1 l

3 MANUAL -

AUTO 2 SO WAVE PULSE

~

SCREEN ROOF 3

-1500 RSS SCRAM -

Pulse Date: 96 Dec 16 Pulse Time: 19:58:44.8 Pou e a c,sq pulse.004 i X SCRAM -1200 TR Pas'n- 12.94 in.

~

I TR Ucrth: 2.72 5 l Init Per: 0.089 kW  !

STEPBACK ~

l Peak Power: 1168.0 MW

. . ~ - 900 fl' Intec'd Paeer: 11.3 MJ 1.lVPR5S- . 'EJ

~

Half 2Ht Width: 7.27 ms Time to Peak :256.6 ms i

reek Fuel temperatures i

'l 'KAD / p "nn -

! - 600 Te "a 1 -

- 77 7 'C  !

1 iemp c: x. o ,C ROD CONTROL Il 4 l .

i

'G L -;; d.d ;i a 1 ; 4 gam

- 300

.s  ; ,i ,

i i fi 2c._ u .a rr;n i o

- Spgp57ye? -

/ 8 ,g

.m . , , . _ , _ .

3 K 255 s >

} Exit EAlarm E0pCtrls EMsg EBar @Treni $l

.16 19:59:54 sss 3010 F Pulse Made inhib'd on init power hiah (RSS) DI s

ATTACIDiENT 3

i 1

. I i . l Thermocouple Amplifier l To Hardware Trips

\

j (

)

W,_ \ RSS & DCC-X Displays l 45v ~f v Instrumentation Ground. l i

n' H

n[ 1M { } ..

T - Temp. Compensation i

l

! W,- =

Fuel Ref. Test I l Plant Gnd. r-----------------------3 Power Supply Separation l Pulse Amplifier

! +15 V ,

! -15 V I +15 V isolated

! +  % i i 1 -15 V isolated DCC-X Control &

\ i isolated Gnd. Monitoring

-.- o t System p instrumentation l A ,

Ground f{

f l v

~

_ .l Isolated -

Safety System Output Boun ay Power Supply Bitteker

+- Experimental Setup o e-w p Experimental M7 Plant Ground Data 1 Acquisition System

______\

i g ______7 Plant Ground D7 ,

Figure 1

. _ . _ .- -. . . - .