ML20214V236
| ML20214V236 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 11/19/1986 |
| From: | Haynes J ARIZONA PUBLIC SERVICE CO. (FORMERLY ARIZONA NUCLEAR |
| To: | Kirsch D NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION V) |
| References | |
| REF-PT21-86-384-000 ANPP-39105-JGH, DER-86-25, PT21-86-384, PT21-86-384-000, NUDOCS 8612090582 | |
| Download: ML20214V236 (12) | |
Text
.
e Arizona Nuclear Power Project P.O. BOX 52034 o PHOENIX, AFtIZONA 85072-2034 November 19. 1986 ANPP-39105-JGH/DJW/DRL-92.11 U. S. Nuclear Regulatory Commission g
Region V 'y 1450 Maria Lane - Suite 210 0 Walnut Creek, California 94596-5368 y j4 E: L i f2 Attention: Mr. D. F. Kirsch, Director C N :j a Division of Reactor Safety and Projects .
r- 9 Palo Verde Nuclear Generating Station (PVNGS) . E Units 1, 2, 3 9 Docket Nos. 50-528, 529, 530 3
Subject:
Final Report - DER 86-25 A 50.55(e) and 10CFR21 Condition Relating to Wrong Conversion Factors used in Radiation Monitor RU-l File: 86-006-216; D 4.33.2
Reference:
(A) Telephone Conversation between R. C. Sorenson and D. R. Larkin on July 29,1986 (Initial Notification -
(B) Telephone Conversation between R. C. Sorenson and D. R. Larkin on July 30,1986 (Update to Initial Notification - DER 86-25)
(C) ANPP-38019, dated August 27,1986 (Interim Report -
(D) ANPP-38860, dated October 27,1986 (Time Extension -
(E) ANPP-38853, dated October 24,1986 (Notice of Violation 50/528/86-28-01)
Dear Sir:
Attached, is our final written report of the deficiency under 10CFR50.55(e) referenced above. The 10CFR21 evaluation is also included. This report provides additional detailed information not included in reference E, above, but is consistant with the overall response.
Very truly yours, 8612090582 861119 8 DR ADOCK 0500 J. G. Ilaynes Vice President Nuclear Production JGil/DRL:kp cc: See Page 2
'h
~
22 -%l
DER 86 Final Report Mr. D. F. Kirsch Director Page Two November 19, 1986 ANPP-39105-JGH/DJW/DRL-92.11 cc: J. M. Taylor Office of Inspection and Enforcement U. S. Nuclear Regulatory Commission Washington, D. C. 20555 A. C. Gehr (4141)
R. P. Zimmerman (6295)
Records Center Institute of Nuclear Power Operations 1100 Circle 75 Parkway - Suite 1500 Atlanta, Georgia 30339 1
t
_ . ~ . . - _ . _ _ _ _ _
. - , c, - . r FINAL ~ REPORT - DER 86-25
-DEFICIENCY EVALUATION 50.55(e)
ARIZONA NUCLEAR POWER PROJECT (ANPP)
PVNGS UNITS 1, 2, 3' i
i I. Description of-Deficiency A. Monitor (RU-1) Function i RU-1 is a non-redundant ESF containment building atmosphere monitor supplied by Kaman Instrumentation Corporation. The principal function of the monitor is to measure four containment atmosphere 4- parameters that give indication of reactor coolant pressure boundary ~
(RCPB) leakage. These parameters are: particulate, iodine, and i gaseous. radioactivity, and dew point temperature. The particulate
- and gas channels provide two of the three ccumitted means of detecting increased leakage from the RCPB in accordance with Regulatory Guide 1.45. The third means is the sump level and flow
!. monitoring system. . The dew point and iodine channels are corroborative means of identifying leaka8e.
1 The RU-l particulate channel monitors atmosphere particulate activity j- concentration in the containment, and is required to alarm at the Technical Specification (Table 3.3-6) setpoint of less than or equal
, to 2.3E-6 microcuries/cc (uCi/cc).
- B. Potentially Deficient Conditions In June 1986, it was determined that incorrect conversion factors (detector efficiency and flow conversion factor) were being used in l the particulate channel of RU-1. The use of. incorrect conversion F
factors caused erroneous particulate radioactivity concentration readings, and could have allowed containment particulate activity to exceed the technical specification setpoint without an alarm in the
- control room. Uncertainty about the values displayed in the control room for the particulate monitor may. have reduced its usefulness as a 4
RCS leakage indicator.
C. Unit 1 Operating Esta and Radioactivity Measurements Some current Unit 1 operating data and radioactivity measurements are given in Table 1. This data is used in evaluating the potentially ,
deficient conditions.
l~
Evaluation A. Governing Licensing Commitments For convenience, the licensing commitments are summarized here:
i the containment building atmosphere monitor (RU-1) is to provide two of the four methods of reactor coolant pressure boundary i (RCPB) leak detection in accordance with Regulatory Guide 1.45, I
~ .
4 I
" Reactor Coolant' Pressure Boundary Leakage Detection Systems."
The four methods that PVNGS uses to detect RCPB unidentified leakage are (1) reactor coolant system (RCS) inventory, (2) sump level, (3) containment air particulate concentration (RU-1), and (4) containment gaseous concentration (RU-1). The containment air particulate concentration and gaseous channels have sensitivities of 1.0 E-9 uC1/cc and 1.0 E-6 uCi/ce, respectively. These are the sensitivities recommended by Regulatory Guide 1.45.
"Available monitor sensitivities allow-the particulate and Iodine-131 (I-131) channels of the monitor to detect maximum permissable concentrations allowed by 10CFR20 in the containment-building within one hour for Cesium-137 (CS-137) and within eight hours for 1-131." (FSAR Section 11.5.2. 1.3. 13)
- 2. PVNGS Technical Specifications (per Sections 3/4.3.3 and 3/4.4.5).
- a. The following RCS leakage detection systems shall be operable in modes 1, 2, 3 and 4: (a) containment air particulate monitoring system, (b) containment sump level and flow monitoring system, and (c) containment gaseous monitoring system. When the required gaseous or particulate radioactivity monitoring system is inoperable, plant operation may continue for 30 days provided grab samples of containment atmosphere are obtained and analyzed once every 24 houra. (If the containment sump level and flow monitoring syster. is inoperable, plant operation may continue for up to 30 days).
- b. The RCS leakage is limited to (a) one gpm unidentified leakage and (b) ten gpm identified leakage in modes 1, 2, 3 and 4. The operator determines that RCS leakages are within these limits by monitoring the containment atmosphere gaseous and particulate radioactivity at least once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, and by using the other leakage detection methods,
- c. The particulate channel alarm / trip setpoint shall be less than or equal to 2.3E-6 uCi/cc with a measurement range of 1.0E-9 to 1.0E-4 uC1/cc. The gaseous channel alarm / trip setpoint shall be less than or equal to 6.6E-2 uCi/cc with a measurement range of 1.0E-6 to 1.0E-1 uC1/cc.
B. Particulate Channel Evaluation
- 1. History ,
RU-l was procured through project specification NM-997. Sections l 4.2.7.2.9 and 4.2.8 specified the filter stepping and calibration procedures. RU-l was delivered in late 1982 with the stepping time defaulted to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
In November 1984, a new set of erasable programmable read only memory (EEROMs) were installed in RU-1. Work request 91035 was-written on May 30, 1985, to investigare discrepancies between the count rate indicated locally at RU-1 and those in the control room. In reply to the work request, operations engineering letter PVEGS-LGP-H85-99, of June 4,1985, stated that the difference exists because different parameters are being displayed locally, at .the microcomputer, compared to the control room.
At this time, the particulate channel was declared operable based on successful performance of the I&C surveillance' test procedure. The very low readings in containment were attributed to the low levels of activity normally experienced during early start-up testing. These levels were below the minimum detectable levels of the radiation monitor and grab' sample analysis capability.
The stepping interval for the particulate channel filter paper was also addressed in this letter. It noted "this algorithm ignores the decay of the particulates as the half-life of the accumulation is considered long compared to the changeout time of the filter." It also stated that "Since the radiation monitor calculates the activity in containment by the use of the change in counts on the filter it is felt by engineering that frequent (each hour) stepping of the filter is unnecessary and that the stepping time of the filter may be increased." At this time the dominant particulate activity was not identified.
On November 12,1985, EER-85-SQ-144 was issued. The correctness of the flow conversion factor used in the algorithms was questioned. However, it was not until June,1986 that the vendor brought the software listings to the site. On June 5, 1986 the algorithm and flow conversion f actor as listed in the sof tware listings, were reviewed with the supplier and were considered to be correct. The use of incorrect detector efficiency values were identified at this time.
On January 21,1986. EER-86-SQ-008 was written requesting a methodology for setting alarm setpoints which would detect a one gpm increase in RCPB leakage. The preliminary response to this EER indicated that RU-1 met its licensing commitments, but further evaluation of the setpoints was continued.
On June 24, 1986, the operability of the RU-1 particulate channel came into question, and EER-86-SQ-117 was written. The response to this EER pointed out that the sump level indication and the RU-1 gas channel were working. A calculation was presented in the response to the EER to show the RU-l gaseous channel was ope rable. The particulate channel was declared inoperable on June 25, 1986 due to the inconsistent readings between containment grab sample analysis and RU-1 readings. ~ This became evident with the higher containment particulate activity and the correction of the detector efficiency factor identified by EER-85-SQ-144.
EER 86-SQ-113 was written on June 27, 1986, identifying a discrepancy in the particulate channel's flow conversion factor.
The vendor was contacted and a corrected flow conversion factor i was confirmed. Consequently, the EER was closed and the particulate channel declared operable on June 27, 1986, after insertion of the correct conversion factors.
- The RU-l particulate channel reading, af ter filter stepping, correlated well with the grab sample analysis. In a memo received from the vendor on July 30, 1986, an omission in the reconfiguration of the EPROM installed in November,1984 was identified as the reason for the problem with the flow conversion factor.
These above experiences established that significant uncertainties existed with the particulate channel operation.
Because of these uncertainties this deficiency evaluation was initiated.
4
- 2. Particulate Channel Theoretical Evaluations
- As pointed out in FSAR Section 5.2.5.1.1.3 "The sensitivity of-the air particulate monitor to an increase in reactor coolant
- leak rate is dependent upon the magnitude of the normal baseline leakage into the containment and the reactor coolant activity."
In order to determine under what conditions the pad hbulate channel would give significant indication of RCS leakage, the relationship between Reactor Coolant activity and containment 4
activity was analyzed.
Figure 3-1 (taken from Reference 1) shows what level of RCS
- particulate activity will cause a 10% increase in containment activity with a one gpm leak over a period of one hour. A 10%
I increase in activity is expected to be discernable by the j operator. The area to the left of the solid line represents initial levels of RCS and containment activity where the increases in containment activity will allow the detection of a one gpm leak within one hou r, j Also indicated on Figure 3-1 are several Unit I current operating conditions of RCS activity and containment concentration. This shows that the current conditions are located in a region where RCS leakage determination within one hour is possible with the particulate channel, i
w ~ - , . , . - - - - - - , - . . . - , .,-.,,-,--,-n-- ,.----..,--n n.- n----., -- - -- ,,.. .- -- n.-.~-.~, ,,-..,--,----,en
~-,,v. -,-m , - - - , , . , - -
. 2; .
Figure 3-2 (taken from Reference 1) shows what level of RCS gaseous activity will cause a 10% increase in containment activity following a' one gpa leak for one hour. It also shows
~ that: for the operating conditions recently experienced in Unit 1, it .would have taken 23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br /> to reach a 10% increase. This indicates 'that the gas channel does give indication of RCS leakage, however, the gas channel is less sensitive than the particulate channel in indicating RCS . leakage.
- 3. Current Operation of RU-l Particulate. Channel A nominal 3 cubic feet per minute (cfa) sample of containment atmosphere is constantly drawn through RU-1 and passes 'first
- through the particulate channel,. where the particulates are deposited on a moving (stepped) paper filter. A beta scintillation detector measures gross activity deposited on this paper. This measurement is transmitted to a microprocessor which is pre programmed with the flowrate and detector efficiency. The.
algorithm in the RU-1 microprocessor then calculates the-containment atmosphere particulate activity concentration based on the build-up of particulate activity on the filter paper.
RU-l operates only when the containment pressure is less than 3 psig . When the filter paper is stepped, a clean section of filter paper is exposed to the detector.- Immediately the particulate activity in the sample being drawn through the monitor begins to be deposited on the filter paper. As the activity on the paper increases, the count rate from the detector also increases. The algorithm in the microprocessor of RU-l calculates the slope of the increase in counts per unit time, and uses this slope to calculate the containment particulate activity 1 according to the following equation:
dC(t) e Containment Activity = dt f Where: C(t) = number of counts as a function of time e = detector efficiency f = sample flow conversion factor.
The above equation does not take into account the decay of the particulate on the filter paper, and therefore is only valid when the stepping time of the filter paper is short compared to the half-life of the particulates being monitored. When the half-life of the particulate is shorter than the stepping time, then the algorithm only calculates the containment activity accurately immediately after the filter is stepped.
Currently RU-1 is being operated with a stepping time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> but the half-life of the dominant particulate, Rubidium-88 (Rb-88), is approximately 18 minutes. So when the filter is stepped and the Rb-88 begins to build up on the filter paper, the algorithm begins to calculate lower values for containment concentration. When Rb-88 reaches equilibrium on the filter paper (the amount being deposited equals the amount decaying),
then the algorithm will be giving an indication of the concentration of longer lived particulates, but not the short half-life isotopes such as Rb-88.
- . .? -
A This-causes the particulate channel display in the control room to decrease by more than a factor of 10 from the time it is
- stepped until it is stepped again.- It also causes the daily average RU-1 particulate concentration to be nearly a factor of
- 10 below the grab sample analysis concentration of Rb-88 (Refer i .to Table.1).
1 However, if there is an increase in RCS leakage, there will be a
, rapid increase in Rb-88 activity in containment, and a corresponding increase of activity on the filter paper. So the algorithm of RU-1 will indicate an increase in the displayed value in the control room.
i-As a result, RU-1 only gives a correct indication of total _
containment particulate concentration once every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, when the filter is automatically stepped, or on demand, when the filter is manually stepped.
The monitor will indicate a change in leakage that -increases the i airborne particulate concentration, but will only accurately estimate 'short lived particulate concentrations and, therefore, -
provide an accurate alarm at the- technical specification setpoint -
l when the filter paper is stepped. At other times, RU-1 will
' alarm before it reaches the technical specification setpoint of Cesium-137 because of the presence of other short lived isotopes.
- 4. Detector Efficiency and Flow Conversion Factor
] The vendor supplied a figure with the detector efficiency for a monitor with a moving filter. This value was used to program the microprocessor at the site. It was later discovered that the efficiency on the figure was for a' continuously moving filter detector and not for a stepped filter detector, as is the case i for RU-1. This error was discovered and corrected by EER-85-S Q-144. However, the monitor was still not in agreement with the grab sample analysis of the containment. It was subsequently determined that a. flow conversion factor for flow input in cfm had been incorrectly programmed into an EPROM at the j factory, and then installed in the monitor at PVNGS.
In addition, af ter the installation of the EPROM, the surveillance test to declare the monitor operable was inadequate to detect the software error. This inadequacy resulted in the i
continued use of an incorrect flow cot...ursion factor and incorrect values of containment particulate activity.
l S. Summary i
In summary, RU-1 gives accurate indication of total airborne j particulate activity in containment only immediately af ter the
- filter paper has been stepped, but will give indication of RCS leakage increases at all times even af ter Rb-88 has reached equilibrium. This is an acceptable mode of operation because the ,
i primary function of this monitor is to indicate increases in RCS leakace, and the containment particulate activity can be determined by looking at the last time the filter paper was j stepped, or by stepping the filter paper.
t - - - , - _ - - - - - - - - - - . - - . - - _ . - _ - . . . . - - - - - . . -
~. .-- - - - . -
,, _s ! . .
j Based on the grab sample analysis listed in Table 1, the particulate ectivity is four orders of magnitude smaller than .the e gaseous (Xe-133) activity, and the actual gaseous activity is displayed correctly at all times..
The following deficient conditions have been identified:
, a. Incorrect conversion factors were used in RU-1.
1 1. An incorrect detector efficiency was entered into RU-1 at the site because of misleading vendor documentation.
- 11. An' incorrect flow conversion factor was programmed into RU-1 at the factory when the EPROM's were being revised.
, b. The documentation supplied by the vendor was inadequate because it did not clearly identify the correct detector efficiency factor that should be used for the RU-1 particulate channel, i c. Inadequate testing and application of a verification and validation program by the vendor allowed EPROM's to be supplied to the field that did not conform to the required design.
Y
- d. Incomplete testing in the field following the replacement of EPROM's did not validate the complete channel from detection to display in the control room. This allowed the incorrect.
< conversion factors to remain undetected until there was significant activity in containment. Analysis of grab samples compared to RU-1 readings identified the deficiency of the particulate channel.
C. Root Cause
- 1. Conversion Factors
- a. Misicading vendor documentation led to the use of the j incorrect detector efficiency. The vendor provided a figure i with the detector efficiency for the moving filter
- particulate monitor, but this figure applied to a continuous
- moving filter particulate monitor, and not to a stcpped moving filter particulate monitor (RU-1).
1 I
- b. The root cause of the use of the incorrect flow conversion factor was the incorrect EPROM supplied by the vendor.
- 2. Documentation
)
i The root cause of the wrong detector efficiency being taken from
- vendor documentation, was inadequate documentation control. The documentation used was for the same model of detector as RU-1, but with a different filter assembly.
f _- _
. L. .
~
- 3. Testing
- a. Inadequate software control by the. vendor caused them to supply incorrect EPROM's.
- b. Incomplete procedures and validation test of the complete channel allowed the incorrect conversion factors to go undetected in the' field until grab sample analysis gave significant data for comparison.
i D. Operation of Units 1 and 2 These problems were detected in Unit 1 and confirmed in Unit 2. The
- correct conversion factors have now been incorporated into both Units 1 and 2. The other described corrective actions are also being implemented in Units 1 and 2.
E. Transportability 1
- i. The problem of having an incorrectly programmed EPROM could occur in l
other microprocessor controlled equipment. Radiation monitors and
!- other systems with safety functions were reviewed to verify which l
equipment is controlled by EPROM's and programmable read only memory (PROM's) in their microprocessors.
[
As a result of a review and investigation, it was determined that the following additional equipment should be examined:
- 1. Radiation Monitors:
i-l a. RU-29 (control room vent A)
- b. RU-30 (control room vent B) l c. RU-31 (fuel pool area)
- d. RU-37 (power-access purge area A)
- e. RU-38 (power-access purge area B)
- f. RU-145/146 (fuel building vent exhaust, low and high ranSe) -
- g. RU-51, 52, 53 (backup to RU-1, movable and not normally l
f connected)
The above radiation monitors provide input signals to BOP ESFAS, l except for RU-51, 52, 53 and RU-146.
A validation and verification program for these monitors is j required to establish that the same problems do not exist with them.-
The BOP ESFAS system uses two PROM's in their ESF load sequencer / auto test module. There is one module in each cabinet. The PROM's are programmed at the factory. All modules are tested at the factory before being sent to the jobsite using test equipment that verifies the correct operation as specified on the Acceptance Test Procedure No. J104-112.
.? .
As a result of ' the corrective action for DER 86-19, a retest program for the BOP ESFAS modules was conducted at the vendor's facility (Sorrento Electronics) in 1986. Since this retest has recently confirmed the operation of the modules installed in Units 1, 2 and 3, a high degree of confidence exists that no incorrectly programmed EPROM's exist.
- a. J-SAA-C03 (Aux Protective Cabinet A)
- b. J-SAB-C03 (Aux Protective Cabinet B)
- c. J-SAC-CO3 ( Aux Protective Cabinet C)
- d. J-SAD-C03 (Aux Protective Cabinet D)
The DNBR/LPD calculator system uses one PROM in the multiply / divide auto load card assembly on each cabinet. Equipment with PROM's are tested in the factory using approved test procedures as described in Qualification Report No. E2210. Any changes on sof tware are controlled by the vendors QA/QC program. Revised software is tested at the factory and verified at the jobsite following the test and operational procedures for the DNBR/LPD calculator document No.
14273-ICE-3572.
F. Safety Assessment Even when the incorrect conversion factors were being used, the particulate channel of RU-1 was capable of detecting changes in containment concentration, and thus indicating increased RCS leakage. In addition, PVNGS has sufficient alternate means for the detection of leakage from the RCPB to alert operators to the existence of leakage above acceptable levels. The leakage detection systems at PVNGS, as currently designed, are suf ficiently diverse and sensitive to meet PVNGS licensing commitments for RCPB leaks.
If the containment atmosphere particulate channel had failed to indicate increases in containment radiation level as a result of increases in RCS leakage, then either (1) the gaseous channel would have responded to increasing radiation levels and alerted the operators to indicate a potential problem and/or (2) the containment radwaste sump flow alarm would have been initiated in the main control room alerting the operators that the containment sump flow had increased by one gpm above normal flow for one hour.
The containment atmosphere radiation monitor RU-1 is considered an engineering safety feature because it gives the operator indication of increased RCS leakage, however it does not automatically initiate l any plant function. A trip of the particulate channel setpoint initiates an alarm in the main control room. If RU-l indicates significant increase in containment activity, the operators must demonstrate that the RCS leakage is within the limiting condition for operation (LCO 3.4.5.2), or take appropriate action.
II. Analysis of Safety Implications Based on the above, this condition is evaluated as not reportable under
! 10CFR Part 21 and 10CFR Part 50.55(c) since, if lef t uncorrected, it would not constitute a safety-significant condition.
C
- 4 III. Corrective Action A.: Incorrect Conversion Factors.
- 1. A sof tware ' control evaluation program for Kaman radiation monitors has been-initiated in response to CAR CP86-0132. This effort is forecast for completion by January 31, 1987.
- 2. .The detector efficiency and flow conversion f actors have been corrected for Units 1 and 2 and will be implemented in Unit 3 by manual input in accordance with procedure 75RP-9ZZ89.
- 3. The firmware in the EPROM's will be updated by DCP -10J-SQ-043, 20J-SQ-043 & 30J-SQ-043 which is forecast for implementation by February 28, 1987.
B. Incomplete Testing and Calibration Procedures and Validation.
- 1. A station procedure, 77AC-9SQ01, will be written by ANPP to properly document and test software activities in the RMS system. The forecast completion date for this activity is November 30, 1986.
a
- 2. An independent validation and verification on RMS software in use
- has been initiated by EER 86-SQ-217 and is forecast to be ;
- completed by December 31, 1987.
i
! C. RU-l will be used primarily for detection of increased RCS leakage but not the quantification of that leakage. FSAR Seccion 5.2.5.2.3.1 l will be modified by SARCN 2242 to reflect this clarification. The 4 forecast completion for this activity is January 31, 1987.
D. . Operator training regarding RU-l operation will be reviewed and evaluated by EER 86-SQ-218 and is forecast for completion by January 31, 1987.
j i
E. ANFP Vendor Quality will confirm the adequacy of C-E's program to control changes (hardware and sof tware) associated with PROM's and EPROM's prior to January 31, 1987.
IV. References
- 1. Calculation 13-NC-SQ-003 1
V. Attachments i
- 1. Table 1 - Typical radioactivity measurements for reactor coolant and containment atmosphere in Unit 1.
- 2. Figure 3 Calculated increases in containment activity (Rb-88) 4 resulting from 1 gpm RCS leakage.
- 3. Figure 3 Calculated increases in containment activity (Xe-133) resulting from 1 gpm RCS leakage.
1
_ . _ _ . . . . . , _ _ _ . _ _ . _ . - _ _ _ _ . , _ .._ _ _ ._ .- _ _. _ ._.. _ .-- _ _, _ __ _ . _ _ _