05000286/LER-2009-008

LER-2009-008, Technical Specification Prohibited Condition Due to Exceeding the Allowed Completion Time for an Inoperable Over Power Delta Temperature (OPDT) Bistable

Indian Point 3
Event date:	10-06-2009
Report date:	12-02-2009
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v), Loss of Safety Function
2862009008R00 - NRC Website

Note:� The Energy Industry Identification System Codes are identified within the brackets ().

DESCRIPTION OF EVENT

On September 17, 2009, while at 100% reactor steady state power, during performance of surveillance 3-PT-Q87D (Channel Functional Test of Reactor Coolant Temperature Channel 441) Instrumentation and Control (I&C) Technicians discovered bistable 3TC­ 441C/D (TS) As-Found test readings out of specification for the Over Power Delta Temperature (OPDT) reactor trip and OPDT Rod Stop function (JC). The bistable was adjusted in accordance with the procedure and all readings were left in specification. Bistable TC-441C/D is the loop 4 OPDT trip and OPDT Rod Stop duplex alarm bistable. The bistable is a NUS (N430} Duplex Difference Alarm module, Model DAM 502-03.

An assessment of the condition determined that bistable 3TC-441C/D had been found out of specification on the previous quarterly surveillance on June 26, 2009.

Technical Specification (TS) 3.3.1 (Reactor Protection Instrumentation), Table 3.3.1-1, Function 6 has an Allowable Value per Note 2 for OPDT Loop of 1.8% of delta.

Temperature span, which for bistable TC-441C/D correlates to a 0.144 Volts DC (Vdc) deviation from the nominal value, as long as no other components in the Loop show significant drift. The OPDT Trip test criteria is 6.60 (6.56 to 6.64) Vdc. The As- Found OPDT value was 6.86 Vdc which exceeded the TS allowed value. TS 3.3.1 requires the reactor protection system (RPS) (JC) instrumentation of each function in Table 3.3.1-1 to be operable. Condition A requires entry into Condition E immediately with one or more functions with one or more required channels or trains inoperable. Condition E.1 requires the inoperable channel to be placed in trip within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> or be in Mode 3 in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP3-2009-03817.

The surveillance test allows for manipulation of the bistable dial settings if the As-Found settings are not within the desired tolerance. If the bistable dial settings are manipulated, it changes what the bistable uses as a basis for what the difference is between the reference value and its Delta T input value in order to trip. The performance of surveillance 3-PT-Q87D on June 26, 2009 found both the Rod Stop and Reactor Trip (RT) As-Found trip points out of specification low; as a result, an adjustment in the bistable dial settings for both functions was made.

The change in the bistable dial settings allowed the As-Left trip points to be satisfactory (SAT) because by manipulating the dial settings, the reference value did not change, but the bistable was now sensing a larger difference between its reference and input Delta T. This increase on the bistable dial settings shifted up the trip points. The failure of the As-Found values during the June 26, 2009 surveillance can be attributed to a faulty reference input sensed by the bistable.

The subsequent quarterly surveillance on September 17, 2009, found high As-Found trip points for both Rod Stop and Reactor Trips compared to the As-Left values from the June 26, 2009 surveillance. By having the nominal reference value at the bistable input, and the dial settings set up for the bistable to trip at a larger difference between inputs, the high As-Found trip points can be seen to have been accurate according to what the bistable dial settings were from the previous surveillance. A review was performed of the last six completed surveillances of 3- PT-Q87D. The review determined there has been no significant drift associated with bistable TC-441C/D.

The extent of condition review determined the condition may occur when testing Delta Temperature T(average) Loops I, II, III, and IV of the reactor protection system There was no safety system functional failure reportable under 10CFR50.73(a)(2)(v) as the OPDT function has four channels arranged in a two out of four logic configuration where the trip of two channels results in a OPDT trip. Any of the remaining two operable channels would have generated the trip signal to satisfy the safety function. In accordance with reporting guidance in NUREG-1022, an additional random single failure need not be assumed in that system during the condition.

PAST SIMILAR EVENTS

A review was performed of the past three years of Licensee Event Reports (LERs) for events that involved a TS violation due to a safeguards actuation device degrading and exceeding its TS limit. LER-2009-005 reported a 480 volt bus undervoltage relay drifting and exceeding its TS value twice in addition to previous drifting outside its calibration limits. The test results for this event provided evidence that the relay drifted outside its calibration acceptance criteria and therefore was inoperable during past operation. The condition of inoperability exceeded the TS allowed completion time. The cause of the condition reported in LER-2009-005 was personnel error due to inadequate knowledge of the drift monitoring program and component drift performance. The CAs of the event reported in LER-2009-005 would not have prevented this event as the causes were different.

SAFETY SIGNIFICANCE

This event had no effect on the health and safety of the public. There were no actual safety consequences for the event because there have been no conditions during past operation during the time the bistable exceed its TS limit requiring the actuation of OPDT or Rod Stop. During this time period the unit had two RTs: one RT on August 10, 2009, due to a turbine generator trip as a result of a lightning induced generator lockout relay trip, and one RT on August 27, 2009, due to a turbine autostop oil trip.

The RPS monitors parameters related to safe operation and trips the reactor to protect the reactor core against fuel rod cladding damage caused by departure from nucleate boiling (DNB) and to protect against reactor coolant system (RCS) damage caused by high system pressure. The RPS automatically trips the reactor under the following primary system conditions: 1) reactor power, as measured by neutron flux, reaches a pre-set limit, 2) temperature rise across the core, as determined from RCS loop differential temperature (DT), reaches a limit either from OPDT set point or an overtemperature DT (OTDT) setpoint, 3) pressurizer pressure reaches an established minimum limit, 4) loss of reactor coolant flow as sensed by low flow, loss of pump power or pump breaker opening, 5) pressurizer pressure or level trip the reactor to protect the primary coolant boundary when pressurizer pressure or level reaches an established maximum limit. The OPDT function is part of the RPS to initiate a RT.

The RPS is designed on a channelized basis to achieve separation between redundant protection channels.

The OPDT trip prevents power density, anywhere in the core, from exceeding 118% of design power density and prevents fuel pellet melting. The OPDT function has four channels arranged in a two out of four logic configuration where the trip of two channels results in an OPDT trip. Any of the remaining two operable channels would have generated the trip signal to satisfy the safety function. The OPDT actuation logic is designed to withstand an input failure to the control system, which may require the protection function actuation, and a single failure in the remaining channels providing the protection function actuation.