05000298/LER-2006-003

LER-2006-003, Both Diesel Generators Inoperable Due to Voltage Regulator Design Results in Loss of Safety Function

Docket Number
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat
Initial Reporting
2982006003R00 - NRC Website

PLANT STATUS

At the time of the event, Cooper Nuclear Station (CNS) was in Mode 1 at approximately 100% power.

BACKGROUND

During surveillance testing, when the diesel generator (DG) is aligned parallel to the grid, the DG voltage regulator droop setting is not bypassed upon receipt of an emergency signal from, for example, a loss of voltage or a loss of coolant accident (LOCA). Because the voltage regulator remains in droop mode, and because existing analysis of the condition described above does not bound the condition, the DG is inoperable by definition.

Due to voltage regulator droop mode operation, prior to 1998, the DG's were declared inoperable whenever they were aligned parallel to the offsite power grid (grid) during surveillance tests. To reduce the accumulation of out-of-service time related to the inoperability requirement, a modification to enhance the DG circuitry was undertaken in early 1998. Because the initial work scope was insufficient to accomplish the original goal, a second work scope was proposed and approved. The modification was completed according to the second work scope but the need to declare the DG inoperable when aligned to the grid remained.

The key difference between the various DG operating mode responses is the logic of the unit, which for a LOCA (regardless if a concurrent loss of offsite power exists or not), causes most of the logic to appropriately change to an Emergency Start mode. Specifically, the following actions occur upon receipt of an Emergency Start Signal:

• The Non-Essential DG trips are bypassed.

• The Digital Reference Unit (speed input device) reverts to 60.0 Hz (removes the Engine Speed Droop function).

• The Engine Speed Governor reverts to a "high responsiveness" mode (the governor has the capability to operate in two modes. The two modes can be used to provide greater stability when operating in parallel to the grid (i.e., it is less responsive to step changes).

In contrast to these three logic changes, one other required change does not occur. This latter change relates to the voltage droop function. This function is enabled anytime the DROOP/PARALLEL switch is placed in the PARALLEL position, which is required for operating in parallel with the grid. The voltage droop function allows for stability while operating in parallel with the grid. This function is not disabled in response to an Emergency Start Signal.

While some circuitry changes were accomplished in 1998, the original need to declare the DG's inoperable remained. Consequently, all procedure changes resulting from the completion of control circuitry enhancement modification still contained this requirement. Six weeks after the modification was closed out and new procedures had been implemented, new procedure change requests (PCR's) were submitted that removed the inoperability requirement in DG surveillance tests. Because the new PCR's were processed as instant changes, there was no review by anyone directly involved in the modification.

Under the procedure change process in use at that time an instant change was required to be a "non­ intent" change, meaning that the procedure change would not change the intent of the procedure. This included what the procedure could be used to accomplish, the level of nuclear safety, or the design or licensing basis.

The justification for the new PCR's incorrectly presumed that the modification had been completed as described in the original work scope. Consequently, from December 12, 1998 to April 21, 2006, diesel generators were not declared inoperable as they should have been during surveillance testing when they were aligned parallel to the grid.

Since the DG does not automatically disable the voltage droop function, which is not accounted for in the applicable analyses, the DG must be declared inoperable whenever this function is utilized. This function is only utilized in support of DG parallel operation with the grid.

EVENT DESCRIPTION

Records review identified one occasion during the past three years, March 23, 2004, when both DG's were inoperable at the same time. DG #1 was inoperable due to maintenance being done at the same time that a surveillance procedure was being performed on DG #2. Because DG #2 was aligned parallel to the grid, it was inoperable.

During surveillance testing, when the DG is aligned parallel to the grid, the DG voltage regulator droop setting is not bypassed as it should be upon receipt of an emergency signal from, for example, a loss of voltage or a LOCA. Because the voltage regulator remains in droop mode, and existing analysis does not bound the condition, the DG is inoperable.

BASIS FOR REPORT

Both DG's simultaneously inoperable is a condition that could prevent fulfillment of a safety function that mitigates the consequences of an accident and is reportable under 10 CFR 50.73 (a)(2)(v).

SAFETY SIGNIFICANCE

This condition is not risk significant, because both offsite power sources remained available to support safety functions for the duration of this condition. In addition, the combination of equipment out of service at the time of the parallel operation did not create a configuration with unacceptable consequences.

This condition is limited in time frame in that the surveillance test duration for the configuration is approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> in length. It is judged that the short time frame in which the condition existed has negligible impact on core damage frequency. The incremental core damage probability for the short time period in which the diesel generator function was found to be degraded is well below the 1.0E-06 threshold established as significant by the industry.

This condition did not challenge a fuel, reactor coolant pressure, primary containment, or secondary containment boundary. The condition did not impact the plant's ability to safely shut down or maintain the reactor in a safe shutdown condition.

Therefore, the impact of this configuration is considered negligible. As a result, the event is bounded by the baseline Plant Specific Analysis model and has negligible risk significance.

This is a Safety System Functional Failure.

CAUSE

The cause of this event was the use of inaccurate information to justify a procedure change. Inappropriate application of the procedure change process resulted in inadequate reviews such that the inaccurate information in the justification section of the procedure change request was not challenged and compared to the base documents. Reviewing work completion records would have identified the use of original scope information instead of work completion records to justify the procedure change.

CORRECTIVE ACTION

The following corrective action has been completed.

1. CNS procedures related to DG that include aligning the DG to the grid during surveillance testing were identified. These procedures have either been revised to require declaring the DG inoperable when aligned in parallel with the grid, or already contained the requirement to declare the DG inoperable.

The following corrective actions have been entered into the CNS corrective action program.

1. The procedure change process will be revised to provide a list of conditions that meet the requirements of "non-intent.

2. A sample of non-administrative instant procedure changes implemented using the instant change process that was in use between 1998 and 2000 will be reviewed to ensure that the information upon which the change was based is accurate and the instant change met the requirements to qualify as an instant change.

3. Determine the availability of the DG's between December 12, 1998 and April 21, 2006. Determine the impact on performance indicators reported to the Nuclear Regulatory Commission during the same period.

4. The DG control circuitry will be modified so that it is not necessary to declare a DG inoperable when it is aligned parallel to the grid during DG surveillance testing.

PREVIOUS EVENTS

A review of CNS LERs since 2000 was conducted. There were no reportable events similar to this event.