ML20199K035

Forwards Final Event Repts ER-97-02 & 97-05,rev 1 Re Criticality Accident Alarm Sys (CAAS) Cluster Meter Readings Which Were Observed to Be Lower than Engineering Requirements

ML20199K035
Person / Time
Site:	Paducah Gaseous Diffusion Plant
Issue date:	01/28/1998
From:	Polston S UNITED STATES ENRICHMENT CORP. (USEC)
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
GDP-98-1005, NUDOCS 9802060086
Download: ML20199K035 (9)

Text

3

./

V USEC A Global Energy Company January 28,1998 a

United States Nuclear Regulatory Commission SERIAL: GDP 981005 Attention: Document Control Desk Washington, D.C. 20555 0001 Paducah Gaseous Diffusion Plant (PGDP) Docket Ne.70-7001 - Event Reports ER-97-02 and ER-97-05, Rev.1 Pursuant to 10 CFR 76.120(d)(2), attached is the final report related to the Criticality Accident Alarm System (CAAS) cluster meter readings which were observed m be lower than Engineering requirements.

This report provides supplemental information for Event Reports ER-97-02/ER-97-05 which were issued to the Nuclear Regulatory Commission (NRC) M April 2,1997. Supplemental information is provided for the direct /rcot causes and the associated corrective actions for these events and designated by a revision bar in the right margin of the report. Attachment 2 is a list of commitments made in this report.

l l

Should you require further information on this subject, please contact Bill Sykes at (502) 441-6796.

Sincerely,

/(M Steve Polston General Manager Paducah Gaseous Diffusion Plant SP:WES:JNil:mel Attachments

\\

cc:

NRC Region 111

} lI NRC Senior Resident inspector, PGDP

~

ll llhll 'llllh l.l 9802060086 900128 PDR ADOCK 07007001 C

PDR s

P.O 11ox 1410, Paducah, KY 42001 Telephone 502-441-5803 Fax 502-441-5801 http://www.usec.com Offices in Livermore,( A Paducah, KY Portsmouth, Oil Washington, DC

a.

_1

. Docket No. 70-7001 ~

Page 1 of 7 -

EVENT REPORTS ER-97-02 and ER-97-05 Rev.1 BACKGROUND LThe Criticality Accident Alarm System (CAAS) at Paducah Gaseous Diffusion Plant (PGDP)is L

Edesigned to detect gamma radiation levels that would result from the minimum criticality -

L

_ accident of concem and to warn plant personnel by activating evacuation alamis. The CAAS consists of clusters of three detector modules and one logic module. According to the Safety -

(

Analysis Report (SAR), Section 3.12.6, "The clusters consist of three detector modules which alarm when a gamma dose-rate of 10 milliroentgen per hour (mR/hr) above backgroimd is detected." Each detecter module has an intemally generated signal to maintain a constant operational check of the detection circuits. At the time of this event, the background reading of

- the detectors was initially adjusted to display a nominal 10 mR/hr on the front panel of the

-. detector module. 'ihe alarm setpoint ofeach detector module was set at a nominal 20 mR/hr so

' hat the detector module would go into alarm status ifit received an increase in radiation of 10 L mR/hr or greater above background. The fault setpoint of each detector module was set at a nominal 5 mR/hr so that the detector module would go into fault status if the background reading dropped significantly. - A fault status is indicative of equipment problems and causes the CAAS

to transmit a trouble signal to the central _ control facility. Each detector module will detect radiation independently of each other. The cluster is designed to minimize the number of false audible evacuation alarms that plant personnel experience by applying the following logic to interpret detector module alann status. To receive an audible CAAS alarm, one of two e conditions must exist: (1) at least two of the three detector modules must be in alarm status -

simultaneeusly; or (2) one detector module is in alarm status while the other two detector modules are in fault status.

On November 6,1996, under regulation of the Department'of Energy, two CAAS detector modules in Cluster X in the C-337 building were observed with low background readings of 9 mR/hr and 8.5 mR/hr. (Event Report PAD-1996-0058). While the actual background radiation level would be essentially zero, the CAAS indicating meter is set to indicate a background of 10 mR/hr i 0.5 mR/hr. This means at an actual radiation field of 10 mFJhr, the meter will indicate 20 mR/hr i0.5 mR/hr. The alarm is r.et to initiate at 10 mR/hr above background. (10 mR/hr ~

background setpoint plus 10 mR/hr radiation field equals 20 mR/hr alarm setpoint nominal values.) A low background reading on a module could prevent the module from going into alarm status even though it has detected a 10 mR/hr increase in radiation. As stated above, in order to generate an audible alarm, the cluster logic requires either (a) two detectors to be in alarm status; or (b) one detector to be in alarm status while the other two detector modules are in fault status. Therefore, low background readings on two detector modules simultaneously could prevent an audible alarm from being generated even though one or more modules hcs detected an

Docket No. 70-7001 Page 2 of 7 increase in radiation of 10 mR/hr. For that ieason, at the time of the event, clusters were declared inoperable if two of the three detector modules had backg-ound readings below 9.5 mR/hr. As a result of the above event, long term order,(LTO) were issued to establish weekly field monitoring of CAAS clusters to determine if the low background readings constitute a system problem. The LTO instructed operators that " modules with readings found below 9.5

. mR/hr are to be promptly reported to the Plant Shift Superintendent and a work order initiated foi changeout." On February 4,1997, another incident of two CAAS modules with low background readings occurred (Problem Report: PR-CO-97-0556). CAAS clusters U and AK located in the C-337 building were observed with two modules each reading 9.0 mR/hr. The clusters were declared inoperable and the LCO action steps as defined by Operational Safety I

Requirements, KY/D-3971, Section 3.1.2.3, were implemented. The modules were replaced by Instrument Maintenance and Clusters U and AK were declared operable on February 4 and,,

respectively.

DESCRIPTION OF EVENT l

On March 4,1997, during the weekly field monitoring of the CAAS clusters, Cluster V in C-337 l

process bui' ding was found with two of the three detector modules displaying background

)

readings below 9.5 mR/hr. Detector Module Serial No. 580054 and Detector Module Serial No.

l 580105 were both reading 9.0 mR/hr. The cluster detector units are Model GCM-650 gamma criticality monitors, manufactured by Nuclear Research Corporation. Cluster V was declared inoperable. Since the Technical Safety Requirement (TSR) Section 2.4.4.24 defines the Limiting Condition for Operation (LCO) as " Criticality accident detection shall be operable" and since Cluster V does not have complete overlapping coverage from adjacent clusters, the LCO action steps as defined by the TSR Section 2.4.4.2 were implemented. Due to this "as found" inoperable condition, an event nctification was made on March 4,1997, pursuant to 10CFR76 120(c)(2)(I).

An investigation team was established to determine the root cause and corrective actions that will prevent recurrence. The team focused on two primary areas: (1) determination of the proper setpoints for the detectors; and (2) determining the cause(s) of the changes in the detector readings.

The selection of the proper alarm setpoint for detectors is necessary to ensure that the detector will detect the level of radiation generated during the minimum criticality accident of concern, while not generating excessive false audible alanns. The setpoint also determines the radius of coverage for detection. While the detectors may still function for a nearby criticality, the distance at which the minimum criticality would be detected, decreases as the background reading decreases. The detecto s have a fault alarm; however at the time of the events, the fault alarm did not come in until the reading fell to a nominal 5mR/hr. At this level, the detectors

O Docket No. 70-7001 Attacnment 1-Page 3 of 7 would not alarm at a 10 mR/hr increase in radiation level (15 mPJhr total is less than the radiation alarm setpoint of 20 mR/hr). An Engineering Evaluation was prepared to support the changing of these setpoints to ensure the alarm / fault setpoint combination resulted in acceptable detection capability and timely awareness of detector modules which may not be able to meet their intended function. This awareness af a Icw background reading on a detector module will allow timely replacement of that single modub, thereby reducing the probability of clusters being inoperable due to low background readings. In support of this Engineering Evaluation, Instrument Maintenance completed testing to verify that an additive relationship exists between artificial background settings and radiation levels. Additionally, the selection of the proper alarm setpoint and fault setpoint combination ensures that the defined range of acceptable background readings has adequately considered equipment / calibration constraints and limits of error.

To evaluate possible cause(s) of fluctuations in background readings, several initiatives were pursued concurrently. Data bases were developed using data from both the weekly field monitoring of the CAAS clusters and from maintenance records in the Instrument Shop to l

provide trending of CAAS data by such fields as building and module serial number to define dditional testing. The detector modules which exhibited the low readings were

d in the a

Instrument Maintenance shop; no cause of the low reading could be determined. noditionally, detector modules which have exhibited problems in the field were sent to the vendor for evaluation related to the low background incident. Trending data was also provided to the vendor to assist in the troubleshooting. An environmental chamber was used which allowed the Instrument Maintenance shop to do more extensive testing of detector modules under simulated conditions similar to the temperatures which may be experienced in the field. Temperature was l

determined not to be a contributing cause of these eveats since the observed background I

readings were within the manufacturer's specifications for die equipment. Issues which result l

from the above testing / trending initiatives will be tracked to completion through the Corrective Action Program.

During the course of the investigation, another cluster was observed with two modules exhibiting background readings below 9.5 mR/hr. On March 18,1997, at 1305, Cluster N in C-337A bunding was observed by the NRC Inspector with two detector modules reading 9.0 mR/hr (Detector Module Serial No. 580133 and Detector Module Serial No. 580142). Cluster N was declared inoperable and the LCO action steps as defined by TSR Section 2.4.4.2 were implemented. Due to this "as found" inoperable condition, an eveat notification was made on March I8,1997, pursuant to 10 CFR 76120(c)(2)(I). The modules were replaced by Instru*nent Maintenance and Cluster N was declared operable at 1710 on March I8,199'7. The modules were retumed to the Instrument Maintenance Shop for testing.

u

o Docket No. 70-7001 -

3 Page 4 of 7 CAUSES OF EVENT A.

Direct Cause I

i The direct cause of the event was that the setpoints vhich were established for the CAAS l

detector modules did not properly consider the limitations of the equipment. Ac::ording to

.l Engineering Evaluation EV-C-822-97-008, vendor information for the detector module l

indicates that a background setpoint of 10 mR/hr would be expected to vary 10

• 2 mR/hr, I

h Therefore, the expectation for the backgrt. nd reading of the unit to stay between 9.5 and l

10.3 mR/hr is unrealistic. The equipment tolerances used to establish background and alarm I

setpoint values were too tight. Corrective Actions Taken Nos. S through 7 implemented i

new setooints for CAAS detector modules. Setpoint values were selected which ensured I

that (a) an increase of 10 mR/hr above background would be detected; (b) a trouble alarr l

would occur prior to a background reading dropping to an unacceptable level; and (c) i excessive false alarms do not occur. Corrective Actions Taken No. 8 reflects an end-point I

assessment which was conducted to determine the etTectiveness of the setpoint changes in l

correcting the issues of the event. 'Ihe assessment concluded that the setpoint changes had l

been effective since they ensure the equipment will perform its intended safety function in I

accordance with the plant's authorintion basis documents, which is to provide an audible l

alarm in the event the radiation field increases 10 miUhr above background. Additionally, a i

review of trouble alarm data indicates that there have been no adverse trends in the number I

of CAAS trouble alarms or false actuations since the setpoints have been implemented.

l l

B.

Root Cause l

l The root cause of this event is that admieistrative controls did not require the CAAS l

setpoints to be established / revised with st Tficient rigor. At the time of the original l

installation of the CAAS, setpoints were selected for the CA AS to detect a nominal 10 l

mR/hr. The level of rigor required in the selection of alarm setpoints at that time did not I

mandate a full analysis of all measurement uncertainties to ensure the CAAS provided its l

trip function prior to exceeding 10 mR/hr. In March of 1996, the level of rigor related to l

3 establishing setpoints was increased as the setpoint change control process was documented

[

in CP3-EG-EG1070,"Setpoint Change Control." Engineering identified "Q" equipment l

requiring full setraint calculations based on the criteria in 10CFR 76.57 (d)(2)(i) for

[

establishing setpoints for equipment "where a limiting control setting (LCS) is specified for l

a variable on which a safety limit has been placed." Since there are no LCSs specified in l

the Technical Safety Requirements (TSRs) for the CAAS which would drive a setpoint l

calculation, none was required to ensure the requirements of 10CFR 76.87 (d)(2)(i) are l

maintained.

l l

l

4:

Docket No. 70-7001-cAttachinent 1 -

Page 5 of 7 -

The'FSAR/OSRs did not have a 10CFR 76.87(d)(2)(i) eauivalent requirement to ensure a

~ 1.

full accountability of channel uncertainties when selecting trir settings for safety-related' l:

- process ' variables. Trip settings were, themfore, historically based upon a " nominal" value.

l

- -Whil: neither the OSRs nor the TSRs delineated a safety limit (SL) and assc.iated limiting 1 l

. safety system setting (LSSS)/limiGng conditin for safety (LCS) for the CAAS, the SAR l

does credit the CAAS for providing an alarm at an increase of 10 mR/hr above background.

l_

li-In March of 1997, the Configuration Management (CM) Program Manual wa.a issued.

l' Section 4.2.11 of the_CM Program Manual addresses Setpoint Controit and states that "Q

-l-1 and AQ NCS setpoints ard established by developing full calculations t,.d analyses per ISA

-l 67.04, Parts I & II." Engineering will re-examine the items that did not meet the 1996-l criteria for setpoint contml, but which would be covered under this broader CM program criteria.- This evaluation will determine whether a setpoint calculation is required and l

initiate corrections based on findings. (Corrective Actions Planned No.1)

-l-I At the time of the event, the CAAS utilized existing procedures and controls to ensure the q original setpoints e. elected for the CAAS wem maintained. However, since July of 1997, -

l-analyses have been completed and procedures have been revised to adjust setpoints such f

-[

that inherent device inaccuracies are adequately considered to ensure the device will provide l

~ its alarm function prior to reaching a 10 mR/hr above background. -The CAAS system will l_

come under the full rigor of the setpoint control program under Corrective Actions Planned

.lL

, No. 2.

l1 I

I

-CORRECTIVE ACTIONS.-

A.

Corrective Actions Taken

1. On January 2,1997, Operations issued Long Term Orders to perform weckly _ checks of the CAAS clusters to check for low background readings.- Modules with readings found below 9.5 mR/hr were to be promptly reported to the Plant Shift Superintendent and a work orderissued for changeout.

s

2. On March 4,1997,Instrun%t Maintenance replaced two modules in Cluster V and the cluster was returned to an operable status at 2330.

' 3. On March 7,1997, Lutrument Maintenance returned three detector modules to the veu r for further diagno-ic tests and evaluation.

4. On March I 8,1997, Instrument Maintenance replaced two modules in Cluster N and the cluster was returned to an operable status at 1710

4 Docket No. 70-7001 l

'Attachinent 1 L

Page 6 of 7

5. On April 6,1997, Engineering completed Engineering Evaluation EV-C-822-97-008 to i

support a change in CAAS detector module setpoints.

6. On M.ny 23,1997, Engineering generated required documentation to support procedure l

changes associated with Engineering Evaluation EV-C-822-97-008.

l

'/. On July I r, '997, Instrument Maintenance completed changes on setpoints of all CAAS l

cluster &c N modules as dermed in the Engineering Evaluation EV-C-822-97-008.

l Instrumni M.;intenance procedure CP4-GP-lM6272TMP,"CAAS Set Point Change,"

was iwud pnor to changing setpoints.

8. On December 15,1997, Engineering completed an end point assessment to determine I

the effectiveness of the corrective actions.

Es. Corrective Actions Planned

1. By February 18,1998, Engineering will re-examine the items that did not meet the 1996 l

criteria for setpoint control, but which would be covered under the broader CM program l

criteria as dermed in Section 4.2.11 of the CM Program Manual. This evaluation will l

determine whether a setpoint calculation is required and initiate corrections based on I

fmdings.

l l

2. By February 16,1998, the CAAS setpoints will be included as part of the Setpoint l

Control Program.

I EXIENT OF EXPOSURE OF INDIVIDUALS TO RADIATION OR TO RADIOACTIVE MATERIALS No criticality accident occurred during the time period that the two detector modules were reading low. Therefore, there was no exposure ofindividuals to radiation as a result of this event.

NUCLEAR S AFETY SIGNIFICANCE A low backgrond reading on a detector module could prevent the module from alarming at a 10 mR/hr radir. ion increase. Two modules in a cluster with low background readings could prevent the cluster from alarming at a 10 mR/hr iadiation increase. To reach the alarm setpoint of the cluster, the detector would have to receive radiation which exceeded 10 mR/hr by an l

.t Docket No. 70-700l' Attachinent' 1 -

Page 7 0f 7 amount that would offset the low background reading. - While the cluster may still detect and --

- alarm upon a criticality, the distance at which it will detect the minimum criticality is reduced if-.;

- the background reading drifts down.

- LESSONS LEARNED.

' The selection of the proper values for the fault and the alarm setpoints is necessary to ensure that the CAAS can (a) adequately detect the required radiation level; (b) pmvide indications when it 1

.cannot perform its intended function; and (c) minimize the number of false alami activations.

Proper values for fault and alarm setpoints must adequately consider equipment / calibration constraints and limits oferror, h

s

-:a

=

Docket No. 70-7001

' Attach' ment 2 ~

Page1(f1-Corrective Actions Planned 1.

By February 18,1998, Engineering will re-examine the items that did not meet the 1996 criteria for setpoint control, but which would be covered under the broader CM program -

L criteria as' defined in Section 4.2.11 of the CM Program Manual. This evaluation will -

determine whether a setpoint calculation is required and initiate corrections based on -

findings.

2.~

" By February 16,1998, the CAAS setpoints will be included as part of the Setpoint Control Program.

4 4

+

r b

N

.