IR 05000245/2015012
| ML16005A343 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 01/05/2016 |
| From: | Jackson D E Operations Branch I |
| To: | Heacock D Dominion Resources |
| Jackson D E | |
| References | |
| IR 2015012 | |
| Download: ML16005A343 (34) | |
Text
January 5, 2016
Mr. David Heacock President and Chief Nuclear Officer Dominion Resources Millstone Power Station 5000 Dominion Boulevard Glen Allen, VA 23060-6711
SUBJECT: MILLSTONE POWER STATION UNIT 2 - SPECIAL INSPECTION REPORT 05000336/2015012
Dear Mr. Heacock:
On November 24, 2015, the U.S. Nuclear Regulatory Commission (NRC) completed a special inspection at your Millstone Power Station, Unit 2, in response to the October 4, 2015, loss of reactor coolant system inventory in Mode 4 due to a shutdown cooling system relief valve lifting and remaining open. The enclosed report documents the results of the inspection, which were discussed on November 24, 2015, with Mr. John Daugherty, Site Vice President, and other members of your staff.
The special inspection was conducted in response to the loss of reactor coolant system inventory which resulted in the declaration of an Unusual Event. The NRC's initial evaluation of this event satisfied the criteria in NRC Inspection Manual Chapter 0309, "Reactive Inspection Decision Basis for Reactors," for conducting a special inspection. The basis for initiating this special inspection is discussed in the inspection team's charter that is included in the enclosed report as Attachment B.
This inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license.
The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel. In particular, the team inspected post-event reviews, causal evaluations, and the extent-of-condition review to assess the significance and potential consequences of this event. Two NRC-identified findings, one self-revealing finding, and a licensee-identified violation are listed in this report. The enclosed inspection report documents these findings as violations of NRC requirements which were of very low safety significance (Green). However, because of the very low safety significance and because they were entered into your corrective action program, the NRC is treating these findings as non-cited violations, consistent with Section 2.3.2.a of the NRC Enforcement Policy. If you contest any non-cited violation in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region I; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at Millstone Power Station. In addition, if you disagree with the cross-cutting aspect assigned to any finding, or a finding not associated with a regulatory requirement in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region I, and the NRC Resident Inspector at Millstone Power Station.
In accordance with 10 CFR 2.390 of the NRCs "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,/RA/ Donald E. Jackson, Chief Operations Branch Division of Reactor Safety Docket No. 50-336 License No. DPR-65
Enclosure:
Inspection Report 05000336/2015012 w/Attachment A, Supplementary Information Attachment B, Special Inspection Team Charter Attachment C, October 4, 2015, Event Timeline cc w/encl: Distribution via ListServ
SUMMARY
IR 05000336/2015012; 10/07/2015 - 11/24/2015; Millstone Power Station Unit 2; Special Inspection Team Report, Inspection Procedure 93812.
This report covered two on-site inspection visits by a special inspection team consisting of two resident inspectors and two senior operations engineers from Region I. Three Green non-cited violations (NCV) were identified by the team. The significance of most findings is indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) and determined using Inspection Manual Chapter (IMC) 0609, "Significance Determination Process (SDP)," dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310, "Aspects Within the Cross-Cutting Areas," dated December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRC's Enforcement Policy, dated February 4, 2015. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 5, dated February 2014.
Cornerstone: Mitigating Systems
- Green.
The NRC identified a Green NCV of Millstone Power Station Unit No. 2 Technical Specifications (TS) 6.8.1, "Procedures" involving Dominion's failure to implement procedural steps when prompted by plant conditions to mitigate the event. Specifically, when pressurizer (PZR) level began to decrease while placing the shutdown cooling (SDC) system in service, the crew did not implement procedural guidance in OP-2207, "Plant Cooldown," nor enter AOP 2568A, "RCS Leak, Mode 4, 5, 6, and Defueled," as these procedures would have directed operators to locate the source of the leak. Later in the event, once the procedural guidance was implemented, action was taken to identify the location of the leak and it was isolated. After the event, selected crew members were removed from watch standing duties pending remediation. Dominion entered this issue into their corrective action program as CR1012358. The finding was more than minor because it is associated with the human performance attribute of the Mitigating Systems cornerstone and adversely affected its objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, when entry conditions were met, operators did not implement procedural guidance that would have directed them to locate the source of the leak. The finding screened to very low safety significance (Green) using Manual Chapter 0609, Appendix G, Attachment 1, "Shutdown Operations Significance Determination Process Phase 1 Screening and Characterization of Findings," Exhibit 3 - Mitigating Systems Screening Questions. Specifically, the finding did not represent a loss of system safety function. This finding had a cross-cutting aspect in the area of Human Performance, Procedure Adherence, in that licensed operators are expected to implement processes, procedures, and work instructions. Specifically, Dominion operators did not implement procedural guidance when prompted by plant conditions immediately after starting the "A" Low Pressure Safety Injection Pump (LPSI). [H.8] (Section 2.2.b.1)iii
- Green.
The NRC identified a Green NCV of Millstone Power Station Unit No. 2 TS 6.8.1, "Procedures" involving the shift technical advisor's (STA's) failure to follow position-specific procedural guidance, to support all phases of plant operation. Specifically, the STA was not involved in providing independent, objective, and technical assessment of plant conditions when PZR level began to decrease when SDC was being place in service and during the subsequent cooldown. Later in the event, the STA did provide support to the crew to confirm the existence of a leak. After the event, the STA was removed from watch standing duties pending remediation. Dominion entered this issue into their corrective action program as CR1012358. The finding was more than minor because it is associated with the human performance attribute of the Mitigating Systems cornerstone and adversely affected its objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, during the initiation and operation of the SDC system, the STA did not provide sufficient technical input to aid the crew in the determination of the existence of a reactor coolant system leak. The finding screened to very low safety significance (Green) using Manual Chapter 0609, Appendix G, Attachment 1, "Shutdown Operations Significance Determination Process Phase 1 Screening and Characterization of Findings," Exhibit 3 - Mitigating Systems Screening Questions. Specifically, the finding did not represent a loss of system safety function. This finding had a cross-cutting aspect in the area of Human Performance, Teamwork, in that individuals and work groups communicate and coordinate their activities within and across organizational boundaries to ensure nuclear safety is maintained. Specifically, the STA did not fulfill his responsibilities to support the crew by assessing plant conditions during the initiation and operation of the SDC system during the plant cooldown. [H.4] (Section 2.2.b.2)
Cornerstone: Initiating Events
- Green.
A self-revealing Green NCV of Millstone Power Station Unit No. 2 TS 6.8.1, "Procedures," was identified because the procedure used by Dominion to place the SDC system in service did not verify that the SDC suction line to the LPSI pumps was filled and vented prior to placing the system in service which appears to be the likely cause for opening SDC suction Relief Valve (RV) 2-SI-468. To address this issue, Dominion revised the procedure to include venting at SI-075 as part of step 4.12.2 of OP 2207. Dominion entered this issue into their corrective action program as CR1011898. The finding was more than minor because it was associated with procedure quality attribute of the Initiating Events cornerstone and affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown operations. Specifically, the finding identifies an increase in the likelihood of a loss of SDC resulting from the unexpected opening of RV 2-SI-468. Using a bounding and conservative quantitative detailed risk analysis, coupled with deterministic risk-informed defense-in-depth considerations, the finding was determined to be of very low risk significance (Green).
iv This finding had a cross-cutting aspect in the area of Human Performance, Resources, because Dominion did not ensure procedures were adequate to support nuclear safety. Specifically, the plant cooldown procedure did not ensure that the SDC suction line to the LPSI pumps was full of water prior to placing the system in service [H.1]. (Section 2.4.b.1)
Other Findings
A violation of very low safety significance that was identified by Dominion was reviewed by the inspectors. Corrective actions taken or planned by Dominion have been entered into Dominion's corrective action program. This violation and corrective action tracking number are documented in Section 4OA7 of this report.
REPORT DETAILS
1. INTRODUCTION 1.1 Background and Event Description On October 4, 2015, with Millstone Unit 2 operating in Mode 4, the shutdown cooling (SDC) system suction Relief Valve (RV) 2-SI-468, lifted and stayed open (unknown to the operators) at 6:41 a.m. when the crew started the 'A' Low Pressure Safety Injection (LPSI) Pump. This RV remained open throughout the duration of this event. Operators had no direct indication of the valve position and had attributed the initial lowering of pressurizer (PZR) level to shrinkage caused by reactor coolant system (RCS) temperature initially dropping several degrees when relatively cold SDC water entered the RCS upon SDC injection. Further lowering of PZR level was attributed to the subsequent 8°F/hour cooldown of the RCS caused by known leakage past the closed SDC Temperature Control Valve, 2-SI-657. Based on the review of plant process computer traces, PZR level began to decrease at 6:41 a.m., approximately 40 minutes prior to the operators commencing a controlled cooldown via SDC system at approximately 25-30°F/hour. The cooldown rate was reduced to about 13°F/hour at 8:40 a.m. when operators conducted the first brief to address indications of a possible RCS leak by assessing changes in PZR level. Operators then entered Abnormal Operating Procedure (AOP) 2568A, "RCS Leak, Modes 4, 5, 6, and Defueled," at 8:53 a.m., and stopped the cooldown at 8:54 a.m. At 9:32 a.m., the Shift Manager (SM) declared an Unusual Event (UE) based on RCS Identified Leakage exceeding 25 gallons per minute (gpm). At 9:47 a.m. a plant equipment operator identified the location of the leak by reporting that the RV 2-SI-468 was hot to the touch. Operators secured the 'A' LPSI Pump at 9:51 a.m. and then isolated the SDC cooling system from the RCS at 9:55 a.m. The station exited the UE at 11:00 a.m.
Millstone Unit 2 remained in Mode 4 and maintained RCS temperature using the steam generators. The SDC suction RV was replaced on the morning of October 5, 2015. The SDC system was subsequently returned to service, and Unit 2 reached cold shutdown conditions (Mode 5) at 12:49 p.m. The leak had been in progress for a total of three hours and 14 minutes. Following the event, the licensee estimated that approximately 16,570 gallons of reactor coolant were discharged to the equipment drain sump tank (EDST). Thus, the average leak rate was about 85 gpm. All RCS leakage was contained in the EDST and the radioactive waste system. Dominion had RV 2-SI-468 sent offsite for diagnostic testing to assess its condition to explain its performance during the event. Also, Dominion completed a root cause evaluation (RCE) of this event, performed a reasonable assurance of safety (RAS) evaluation for the adequacy of EDST to support the function of RV 2-SI-468, and an engineering technical evaluation (ETE) for the failure modes for RV 2-SI-468.
1.2 Special Inspection Scope The NRC conducted this inspection to expand on the inspection activities started by the resident inspectors immediately after the event to gain a better understanding of the circumstances involving the lifting of RV 2-SI-468 on October 4, 2015. The inspection team used NRC Inspection Procedure 93812, "Special Inspection," as a guide to complete their review. Additional inspection and review activities were outlined in the special inspection team (SIT) charter, provided as Attachment B. The SIT interviewed station personnel; assessed plant process computer data and trends; reviewed procedures, corrective action documents, work orders, engineering evaluations, and the interim RCE prepared by Dominion. A list of site personnel contacted, and documents reviewed, are provided in Attachment A to this report. 1.3 Preliminary Conditional Risk Assessment The risk evaluation considered both an Event Assessment associated with a loss of inventory while in a shutdown condition and a Condition Assessment estimating the impact of a potentially degraded SDC suction RV which could impact the risk in other at-power events. The estimated conditional core damage probability (CCDP) was determined to be mid E-6 and placed the risk in the range of the overlap region between baseline inspection and special inspection. The final risk analysis is discussed below in Sections 2.4 and 2.5. 2. SPECIAL INSPECTION AREAS The objectives of the SIT were to review Dominion's organizational and operator response to the event; review equipment performance and design; and review the licensee's immediate corrective actions, as applicable. Team objectives also included collecting data, as necessary, to refine the preliminary risk analysis and assessing whether the SIT should be upgraded to an Augmented Inspection Team (AIT).
To accomplish these objectives, the team was directed to: (1) develop a complete sequence of events including subsequent actions taken by Dominion; (2) review and assess operator performance in monitoring and assessing plant response during transition to shutdown cooling, as well as, actions taken when diagnosing the cause for decreasing PZR level; (3) review and assess Dominion's decision-making process for emergency action level (EAL) entry, including determination of whether the entry was timely and appropriate; (4) review and assess any equipment issues during the event, including SDC system RV performance; and (5) collect data necessary to refine the existing risk analysis and document the final risk analysis in the SIT report.
2.1 Event Timeline
a. Inspection Scope
The team gathered information to generate a complete timeline of events which identified operator actions and equipment responses related to the lifting of RV 2-SI-468, including subsequent actions taken by Dominion. The team also reviewed timelines documented in Dominion's RCE associated with this event. The NRC-developed timeline is included in Attachment C of this inspection report.
b. Findings
No findings were identified. 2.2 Organizational and Operator Response to the Event
a. Inspection Scope
The inspectors reviewed and assessed operator performance regarding the monitoring of the plant response during the transition to initiating SDC, as well as actions taken when diagnosing the cause for decreasing PZR level. This assessment also included the timeliness of entry into the AOP.
b.1 Findings
Introduction:
The inspectors identified a Green (very low safety significance) non-cited violation (NCV) of Millstone Power Station Unit No. 2 (MPS2) Technical Specifications (TS) 6.8.1, "Procedures," involving Dominion's failure to implement procedural steps when prompted by plant conditions to mitigate the event. Specifically, when PZR level began to decrease while placing the SDC system in service, the crew did not implement procedural guidance in OP-2207, "Plant Cooldown," nor enter AOP 2568A, "RCS Leak, Mode 4, 5, 6, and Defueled," as these procedures would have directed operators to locate the source of the leak.
Description:
On October 4, 2015, while placing SDC in service in accordance with OP-2207, PZR level immediately began to decrease when "A" LPSI Pump was started at 6:41 a.m. At approximately 6:50 a.m., the reactor operator (RO) who was monitoring and controlling RCS inventory informed the unit supervisor (US) that PZR level was lowering out of the established band. He had expressed concerns about the possible existence of a leak as he began to reduce letdown flow to maintain level. After some discussion, the operators erroneously attributed the decrease in PZR level to shrinkage caused by RCS cooldown due to temperature initially dropping several degrees in response to cool SDC flow being introduced to the RCS and due to the subsequent small cooldown rate (~8°F/hour) caused by known leakage past the closed SDC Temperature Control Valve, 2-SI-657. The US then established a new operating band for PZR level for the RO to maintain. The crew proceeded with taking actions to put the SDC system in service.
Over approximately the next two hours, the RO continued to reduce letdown flow (which initially was about 80 gpm when "A" LPSI Pump was started) to try to control and maintain PZR level. However, PZR level continued to decrease. Several times during this period some crew members had discussions about PZR level and the possibility of RCS leakage. Complicating the crew's ability to identify the existence of a leak was the fact that the RCS cooldown rate had been increased to approximately 25°F/hour at 7:30 a.m. This cooldown rate was in effect until approximately 8:40 a.m. when the rate was lowered to about 13°F/ hour. The cooldown was stopped at 8:54 a.m. as a result of the crew entering AOP-2568A at 8:53 a.m. At about this time, letdown flow from the RCS had been secured, charging flow into the RCS was about 88 gpm, and PZR level was essentially stable at approximately 41%. This mis-match would indicate an ongoing loss of RCS inventory in excess of 80 gpm.
The SM declared a UE at 9:32 a.m. because of Identified Leakage being greater than 25 gpm. At 9:47 a.m., a plant equipment operator reported that the LPSI pumps' Suction RV 2-SI-468 was hot to the touch and appeared to be lifting. "A" LPSI Pump was secured at 9:51 a.m. At 9:58 a.m., Isolation Valves 2-SI-651 & 652 were closed and PZR level began to rise as a result of isolating the leak. During this event, the RCS cooldown rate was initially about 8°F/hour and then was later increased to about 25°F/hour. OP-2207 directs establishing a cooldown rate no greater than 40°F/hour. NRC calculations indicated that operators should have been able to maintain a stable pressurizer level during these three cooldown rates (assuming no RCS leak) by adjusting letdown flow. The calculations indicated that for cooldown rates of 8, 25 and 40°F/hour, PZR level would remain steady with charging/letdown mis-matches of 12, 34, and 53 GPM, respectively. If this information had been known, or calculated, by the crew, then the abnormal nature of the PZR level response could have been properly diagnosed. Furthermore, at the beginning of the event with PZR level decreasing after starting the LPSI pump, conditions existed for the crew to have implemented step 4.18.11 in OP-2207 and/or AOP-2568A to take action to identify the source of the leakage sooner than they eventually did. In total, approximately 16570 gallons of RCS inventory leaked into tanks in the auxiliary building over a 194 minute period prior to the leak being isolated. Thus, the average leak rate during this period was about 85 gpm. After the event, selected crew members were removed from watch standing duties pending remediation. Dominion entered this issue into their corrective action program as CR1012358.
Analysis:
The failure of the crew to implement procedural steps based upon decreasing PZR level was a performance deficiency that was within Dominion's ability to foresee and correct and should have been prevented. The finding was more than minor because it is associated with the human performance attribute of the Mitigating Systems cornerstone and adversely affected its objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, because the operators did not implement procedural guidance when PZR level began to lower, approximately 16570 gallons of RCS inventory leaked into tanks in the auxiliary building over a 194 minute period.
The inspectors evaluated the finding using Manual Chapter 0609, Appendix G, Attachment 1, "Shutdown Operations Significance Determination Process Phase 1 Screening and Characterization of Findings," Exhibit 3 - Mitigating Systems Screening Questions. The finding was determined to be of very low risk significance and screened to Green because the finding did not represent a loss of system safety function. The licensee's recovery actions terminated and mitigated the loss of inventory event.
This finding had a cross-cutting aspect in the area of Human Performance, Procedure Adherence, in that licensed operators were expected to implement processes, procedures, and work instructions. Specifically, Dominion operators did not implement procedural guidance when prompted by plant conditions immediately after starting the "A" LPSI Pump. [H.8]
Enforcement:
The MPS2 TS 6.8.1 requires, in part, that "Written procedures shall be established, implemented, and maintained covering the activities referenced in Appendix A of Regulatory Guide (RG) 1.33, Revision 2, February 1978." Appendix A, paragraph 2.j and 6.a of RG 1.33 requires procedures for plant operations during hot standby to cold shutdown and for combating emergencies such as loss of coolant, respectively. Contrary to the above, on October 4, 2015, Dominion operators did not implement OP-2207, step 4.18.11 or AOP 2568A to locate the source of the leak early in the event when prompted by plant conditions. As a result, approximately 16570 gallons of RCS inventory leaked to tanks in the auxiliary building for a total of 194 minutes. Later in the event, once the procedural guidance was implemented, action was taken to identify the location of the leak and it was isolated. After the event, selected crew members were removed from watch standing duties pending remediation. Because this violation was of very low safety significance (Green), was not repetitive or willful, and Dominion entered this issue into their corrective action program (CR1012358), this violation is being treated as an NCV, consistent with Section 2.3.2.a of the Enforcement Policy. (NCV 05000336/2015012-001, Failure to Implement Procedural Guidance During a Loss of RCS Inventory) b.2 Findings
Introduction:
The inspectors identified a Green (very low safety significance) NCV of MPS2 TS 6.8.1, "Procedures," involving the shift technical advisor's (STA) failure to follow position-specific procedural guidance to support all phases of plant operation. Specifically, the STA was not involved in providing independent, objective, and technical assessment of plant conditions when PZR level began to decrease when SDC was being place in service and during the subsequent cooldown.
Description:
On October 4, 2015, while placing SDC in service in accordance with OP-2207, PZR level immediately began to decrease after "A" LPSI Pump was started at 6:41 a.m. Several minutes later, the RO, who was monitoring and controlling RCS inventory by reducing letdown flow, informed the US that PZR level was lowering out of the established band and had expressed concerns about the possible existence of RCS leakage.
The operators then erroneously attributed the decrease in PZR level to shrinkage caused by RCS temperature initially dropping several degrees in response to cool SDC flow being introduced to the RCS and the subsequent small cooldown. The US established a new operating band for PZR level for the RO to maintain. The crew then proceeded with taking actions to put the SDC system in service. The STA was initially not consulted nor involved in the assessment of a possible RCS leak.
During interviews, the STA stated that he had been involved in other activities such as performing shutdown risk evaluations and responding to telephone calls from the field pertaining to plant rigging activities. Procedure OP-AA-500, "Conduct of Shift Technical Advisor," Section 1 states, in part, "The principal role of the STA is to provide independent, objective, and technical assessment of all phases of plant operation with a dedicated concern for the safety of the plant. In support of this, the STA will take action to review plant conditions during off-normal conditions to provide recognition of unusual situations, and provide engineering and accident assessment advice to the Shift Manager and the Unit Supervisor to ensure safe operation of the plant." Section 3.4.1 states, in part, "At no time should collateral roles, duties, or responsibilities interfere with or distract from the principal role of the STA."
Over approximately the next two hours, the RO continued to reduce letdown flow (which initially was about 80 gpm) to try to control and maintain PZR level. However, PZR level continued to decrease. Several times during this period some crew members had discussions about PZR level and the possibility of an RCS leak. The cooldown was subsequently stopped at 8:54 a.m. as a result of the crew entering AOP-2568A at 8:53 a.m. Around this time, the STA became aware of the existence of a possible RCS leak. During post-event reviews, NRC calculations indicated that operators should have been able to maintain a stable PZR level during the cooldown (without a leak), at the cooldown rates maintained throughout the event. (See Section 2.2.b.1 above.) After the event, inspectors interviewed the STA. The STA demonstrated that in about five minutes, he could perform the necessary calculations to account for the effects of the cooldown on PZR level and, by comparing the calculated level with the actual level, determine a leak rate. Thus, if the STA had been actively engaged with the crew during the initiation of SDC and the subsequent cooldown, then the PZR level response could have been assessed to diagnose the existence of a leak. With the leak confirmed, the crew could have implemented step 4.18.11 in OP-2207 or AOP-2568A to have taken action earlier in the event to locate and isolate the source of the leak. After the event, the STA was removed from watch standing duties pending remediation. Dominion entered this issue into their corrective action program as CR1012358.
Analysis:
The failure of the STA to follow his procedure, by allowing collateral duties to interfere with his responsibility to assess plant conditions during the off normal conditions of this event, was a performance deficiency that was within Dominion's ability to foresee and correct and should have been prevented. The finding was more than minor because it is associated with the human performance attribute of the Mitigating Systems cornerstone and adversely affected its objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, during the cooldown evolution, the STA did not provide sufficient technical input to aid the crew in the determination of the existence of an RCS leak. This resulted in approximately 16570 gallons of RCS inventory leaking into the auxiliary building over a 194 minute time period. The inspectors evaluated the finding using Manual Chapter 0609, Appendix G, Attachment 1, "Shutdown Operations Significance Determination Process Phase 1 Screening and Characterization of Findings," Exhibit 3 - Mitigating Systems Screening Questions. The finding was determined to be of very low risk significance and screened to Green because the finding did not represent a loss of system safety function. The licensee's recovery actions terminated and mitigated the loss of inventory event. This finding had a cross-cutting aspect in the area of Human Performance, Teamwork, in that individuals and work groups were expected to communicate and coordinate their activities within and across organizational boundaries to ensure nuclear safety is maintained. Specifically, STA did not fulfill his responsibilities to support the crew by assessing plant conditions during the initiation of the plant cooldown. [H.4]
Enforcement:
The MPS2 TS 6.8.1 requires, in part, that "Written procedures shall be established, implemented, and maintained covering the activities referenced in Appendix A of RG 1.33, Revision 2, February 1978." Appendix A, paragraph 1.b. of RG 1.33 requires procedures for authorities and responsibilities for safe operation and shutdown. License procedure OP-AA-500, "Conduct of Shift Technical Advisor," Section 1.0 states, in part that "The principal role of the STA is to provide independent, objective, and technical assessment of all phases of plant operation with a dedicated concern for the safety of the plant. In support of this, the STA will take action to review plant conditions during off-normal conditions to provide recognition of unusual situations, and provide engineering and accident assessment advice to the Shift Manager and the Unit Supervisor to ensure safe operation of the plant." Section 3.4.1 states, in part, "At no time should collateral roles, duties, or responsibilities interfere with or distract from the principal role of the STA." Contrary to the above, on October 4, 2015, the STA failed to implement this procedure such that he was distracted from providing technical assessment to the crew to confirm the existence of a leak when PZR level began to decrease when the SDC system was being placed into service. As a result, the crew incorrectly attributed RCS cooldown and shrinkage as the cause of decreasing PZR level and thus continued with the cooldown. This resulted in approximately 16570 gallons of RCS inventory leaking to tanks in the auxiliary building for over a 194 minute period. Once the STA was involved, he confirmed the existence of a leak and the crew took action to identify the location of the leak and isolate it. After the event, the STA was removed from watch standing duties pending remediation. Because this violation was of very low safety significance (Green), was not repetitive or willful, and Dominion entered this issue into their corrective action program (CR1012358), this violation is being treated as an NCV, consistent with Section 2.3.2.a of the Enforcement Policy. (NCV 05000336/2015012-002, Failure of the STA to Support the Crew During a Plant Cooldown)2.3 Emergency Plan Implementation
a. Inspection Scope
The inspectors reviewed and assessed Dominion's decision-making process for EAL entry, including determination of whether the entry was timely and appropriate.
b. Findings
By the time that the crew determined that an RCS leak existed and had entered AOP 2568A at 8:53 a.m., charging flow exceeded letdown flow by approximately 80 gpm, the cooldown had been stopped, and PZR level was essentially stable. For event classification purposes, the NRC considered that the 15 minute clock began for declaring the event to be when the AOP was entered at 8:53 a.m. The SM delayed declaring the event because he was trying to confirm that the source of the leak was from the RCS and not from the chemical volume control system (CVCS). Leakage from the CVCS, although not a declarable event, could have produced the same plant conditions. Absent indications of a rise in containment or auxiliary building sumps or in plant radiation levels, the SM concluded that the leakage was going into a tank (although not specifically identified at that point) and therefore the leakage was Identified Leakage. (Eventually, the crew identified the source of the leak was into the EDST and thus confirmed it as Identified Leakage.) The SM then made an EAL entry to declare a UE because of Identified Leakage greater than 25 gpm (EAL BU2.3) at 9:32 a.m. The licensee communicated the UE to offsite agencies within the required 15 minutes of the UE declaration at 9:42 a.m. The licensee provided one update notification to offsite agencies at 10:32 a.m. The licensee terminated the event at 11:00 a.m. and notified the offsite agencies at 11:05 a.m. The Dominion determined the event classification as accurate but untimely. Given the plant conditions and the fact that the leakage was Identified Leakage, the inspectors concurred with the licensee's assessment that the emergency declaration was accurate but untimely. A licensee-identified violation regarding the late declaration is documented in Section 4OA7. 2.4 Equipment Issues
a. Inspection Scope
The inspectors reviewed and assessed equipment issues related to the event, including SDC system and RV performance. This assessment also included the adequacy of the system configuration and procedures used to conduct the evolution.
b. Findings and Observations
b.1 Findings
Introduction:
A self-revealing Green (very low safety significance) NCV of MPS2 TS 6.8.1, "Procedures," was identified because the procedure used by MPS2 to place the SDC system in service did not verify that the SDC suction line to the LPSI pumps was filled and vented prior to placing the system in service.
Description:
Following the initiation of the SDC system on October 4, 2015, the licensee identified that RV 2-SI-468 had lifted and did not reseat. Operators took action to isolate the SDC system from the RCS. This valve was replaced and the SDC system was returned to service without incident to complete the cooldown to commence refueling. During the inspection, the inspectors learned that RV 2-SI-468 had been replaced during the previous Unit 2 refueling outage in 2014. In 2008, the NRC issued Generic Letter (GL) 2008-01, "Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems" (ADAMS accession number ML072910759), which requested addressees to submit information to demonstrate that the subject systems are in compliance with the current licensing basis and design bases and that suitable operational measures are in place for maintaining compliance. Dominion responded to GL-2008-01 on October 14, 2008, (ML082890266), which stated in Section A.4.9 that the SDC suction line to the LPSI pumps is procedurally verified to be filled and vented prior to placing the system in service. Dominion's response also identified three vent valves that are strategically located at the piping system high points in Table 3 of their response. These valves are 2SI-102A, 2-SI-075, and 2-SI-043A.
The inspectors reviewed the licensee's procedure for placing SDC in service, OP 2207, and noted that Section 4.12, Initial SDC Preparations for Concurrent RCP Operation, only requires venting the SDC system using 2-SI-073 ("B" LPSI Pump discharge vent) and 2-SI-067 (SDC heat exchanger discharge header to SDC system vent). Relief Valve 2-SI-468 is located at the system high point for the SDC common suction coincident with vent valve 2-SI-075 (Drawing 25203-20126, Sheet 32). Without venting through 2-SI-075, any entrapped air would remain in the inlet piping to RV 2-SI-468.
During Unit 2's 2014 refueling outage, RV 2-SI-468 was replaced which required the SDC system to be drained. Because RV 2-SI-468 was installed with the system drained, the RV inlet piping was also completely drained. Filling and venting the system piping would have removed air from the 14" header below the piping tee for the RV inlet piping. However, because there was no indication that operations vented the system using vent valve 2-SI-075, the RV inlet piping would have remained full of air since it is a local high point in the piping. As stated in GL 2008-01: "Gas accumulation can result in water hammer or a system pressure transient, particularly in pump discharge piping following a pump start, which can cause piping and component damage or failure. Gas accumulation in the Decay Heat Removal (DHR) system has resulted in pressure transients that have caused DHR system relief valves to open. In some plants, the relief valve reseating pressure is less than the existing RCS pressure, a condition that complicates recovery."
The post-event evaluation did not identify any significant deficiencies regarding RV-2-SI-486. Therefore, the conclusion was that the valve operated properly in that it opened due to a pressure transient that was initiated when "A" LPSI Pump was started. Given the lack of documentation showing that the SDC system was vented through 2-SI-75, either during the 2014 outage or prior to system startup on October 4, 2015, it can be deduced that the presence of an air pocket in the vicinity of RV 2-SI-486 was the likely cause of the pressure transient which opened the valve. To address this issue, Dominion revised the procedure to include venting at SI-075 as part of step 4.12.2 of OP 2207. Dominion entered this issue into their corrective action program as CR1011898.
Analysis:
Failing to verify that the SDC suction line to the LPSI pumps was filled and vented prior to placing the system into service was a performance deficiency that was within Dominion's ability to foresee and correct and should have been prevented as described in their response to GL 2008-01. The finding was more than minor because it was associated with procedure quality attribute of the Initiating Events cornerstone and affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown operations. Specifically, the finding identifies an increase in the likelihood of a loss of SDC resulting from the unexpected opening of RV 2-SI-468. The team evaluated this finding using Manual Chapter 0609, Attachment 4, and determined this finding is associated with the Initiating Events Cornerstone. However, because the finding occurred while the Unit was shutdown and in the process of cooling down, the inspectors evaluated the finding using Manual Chapter 0609, Appendix G, Attachment 1, "Shutdown Operations Significance Determination Process Phase 1 Screening and Characterization of Findings." When applying "Exhibit 2 - Initiating Events Screening Questions," this loss of inventory event required a detailed risk evaluation using the Appendix G, Attachment 2, "Phase 2 Significance Determination Process Template for PWRs during Shutdown." A bounding and conservative quantitative risk analysis, coupled with deterministic risk informed defense-in-depth considerations, resulted in a determination that the finding was of very low risk significance (Green). The Region I Senior Reactor Analyst (SRA) determined that Worksheet 5, "Loss of Inventory in POS 1 (RCS Closed)," was the most appropriate characterization of the shutdown risk associated with this finding. Loss of reactor inventory (LOI) events typically involve loss of RCS inventory that eventually lead to a loss of residual heat removal (RHR) due to loss of the RHR pump suction. The SRA made the following assumptions regarding the LOI initiating event likelihood, modeled mitigation systems, and associated operator actions: The LOI initiating event likelihood was set to 0 (probability of 1.0), using Attachment 2, Table 3, representing the actual loss of inventory due to the shutdown cooling relief valve lifting; RCS injection (FEED) was assigned a value of four because it was constrained by "full operator credit (4)" and not equipment because all ECCS trains were available at the time of the event; Leak path termination prior to refueling water storage tank (RWST) depletion (LEAK-STOP) was assigned a value of three because it was constrained by "full operator credit (3)" because RWST level afforded greater than 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> of make-up prior to depletion; Leak Path termination prior to core uncovery (LEAK-STOP2) was assigned a value of two because it was constrained by "operator credit (2)" based upon operator identification and isolation actions being the most limiting; Steam generator cooling (SG) was assigned a value of three based upon both SGs being available for decay heat removal; RCS vent path (BLEED) was assigned a value of four based upon both PORVs being available; Decay heat removal recovery prior to RWST depletion (RHR-R) was assigned a value of three based on an operator credit because there was greater than 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> to RWST depletion; Borated water make-up before core damage (RWSTMU) was assigned a value of two based on operator credit as there was greater than 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> to core damage (CD).
Based upon the above assumptions and associated LOI core damage sequences from Worksheet 5, the dominant relevant core damage sequence was LOI (0) + FEED (4) + LEAKSTOP2 (2), with an initial core damage risk estimate in the very low E-6 range. The remaining LOI sequences were of less significance. The Phase 2 risk analysis performed using IMC 0609 Appendix G is intended to be a conservative analysis. Recognizing this conservatism, the SRA used the following qualitative inputs for the detailed analysis: Substantial defense-in-depth existed: Extensive mitigation capability with three trains of charging pumps, two trains of high pressure injection (HPI) and two trains of low pressure injection (LPI) available for RCS injection if required; Significant capability to delay core uncovery with two fully functional and in-service steam generators; Multiple redundant RCS level indication for detecting and correcting the LOI; Substantial margin to core damage existed; Extensive time margin (greater than five hours) before the LOI would cause a loss of shutdown cooling; Additional time margin (greater than one hour) from loss of shutdown cooling to core uncovery (i.e., NRC's typical definition of core damage during shutdown) which itself is conservative as core damage will not occur until a much lower core water level; The degradation existed in only one component, the RHR relief valve which limited the leak rate based on its capacity and flow characteristics; Exposure time was short - the loss of inventory was identified within two hours of valve failure and the source isolated in an additional hour. The Phase 2 dominant core damage sequence assumes level reaching the top of active core which would be preceded by the PZR losing level and a subsequent significant reduction in RCS pressure. Based on post-event as-found open and close testing and inspection of the affected RV, this postulated sequence of events would have terminated the LOI event without operator action required due to the reduction in RCS pressure seating the RV.
Consequently, the SRA determined that the above bounding quantitative estimate and additional qualitative insights results in a minimal increase in core damage frequency associated with this finding and substantiates an order of magnitude reduction in risk from the conservative Phase 2 estimate. Accordingly, this self-revealing finding was of very low risk significance (Green).
This finding had a cross-cutting aspect in the area of Human Performance, Resources, because Dominion did not ensure procedures were adequate to support nuclear safety (H.1). Specifically, the plant cooldown procedure did not ensure that the SDC suction line to the LPSI pumps was full of water prior to placing the system in service.
Enforcement:
The MPS2 TS 6.8.1 requires, in part, that "Written procedures shall be established, implemented, and maintained covering the activities referenced - in Appendix A of RG 1.33, Revision 2, February 1978." Appendix A, Section 3.c of RG 1.33 requires procedures for filling, venting, and startup of the SDC system. Contrary to the above, OP 2207, did not properly maintain the subject procedure to include steps to verify the SDC suction line to the LPSI pumps was filled and vented prior to placing the system into service which likely resulted in a system pressure transient due to the start of the 'A' LPSI Pump, which caused RV 2-SI-468 to lift. To restore compliance, Dominion revised the procedure to include venting at SI-075 as part of step 4.12.2 of OP 2207. Because this violation was of very low safety significance, was not repetitive or willful, and was entered into their corrective action program (CR1011898), this violation is being treated as a NCV consistent with Section 2.3.2.a of the Enforcement Policy. (NCV 05000366/2015012-03, Procedure Failed to Direct Adequate Venting of SDC System) b.2 Observations The lift set point for RV 2-SI-468 was approximately 300 psia and the reseat value was approximately 270 psia. The design purpose of this valve according to MPS2 "Final Safety Analysis Report," Section 9.3.4.1, Special Features, is to protect the SDC system from the simultaneous injection of all three charging pumps into a solid system. Solid plant condition would exist when the plant is in Mode 5 (<200°F).
In a Mode 5 high pressure event, liquid water would be relieved from the SDC system, through the RV to the EDST. Two pumps inside the EDST, controlled via float switches, would pump the water to a coolant waste receiver tank. On October 4, 2015, RV 2-SI-468 opened when "A" LPSI Pump was started, and then remained open throughout the event. Although LPSI pump suction pressure was approximately 272 psia when the pump was started, in appears from a review of the related facts that a pressure transient exacerbated by an air pocket beneath this valve was the likely cause for it to open. The valve remained open because system pressure remained above the re-seat pressure. The SDC system pressure was being maintained around 270 psia throughout the event by liquid in the PZR flashing to steam as RCS inventory was lost through the open RV. After the event, the valve was removed for testing. The valve was found to be in the closed position. The valve likely closed when the SDC Isolation Valves 2-SI-651 & 652 were closed to secure the leak which caused SDC system pressure to drop below the valve re-seat value. A vendor evaluation of the valve did not identify any significant deficiencies that would indicate that the valve had malfunctioned during the event.
The reason for system pressure being relatively close to the lift set point for RV 2-SI-468 was because the reactor coolant pumps (RCPs) were being operated concurrently with the LPSI pump. Prior to 1998, the licensee began the RCS cooldown with the RCPs. At a predetermined point, the licensee would then secure the RCPs and establish natural circulation prior to placing the SDC system in service. This allowed for a lower RCS pressure to exist when Isolation Valves 2-SI-651 & 652 were opened to allow the SDC system to continue with the remainder of the cooldown. Thus, there was a greater margin between the RCS pressure and the relief valve lift set point.
When the RCPs are running concurrently with LPSI pumps, RCS pressure needs to be above a minimum value to ensure sufficient flow up through the RCP seal package for adequate cooling. Thus, at the point in the cooldown when SDC is being placed into service, operators are procedurally directed to control RCS pressure within a narrow band of approximately 230 - 265 psia to maintain a minimum pressure for adequate RCP seal cooling while not challenging the RV lift set point.
As mentioned above, RV 2-SI-468 was replaced during the May 2014 outage with a different model valve. The prior RV did not have a bellows whereas the new one did. During the October 4, 2015 event, the hot pressurized RCS inventory created a back pressure in the system downstream of the RV. The presence of the bellows on the new valve caused the re-seat value to remain as it was designed (~270 psia). The LPSI pump suction pressure was about 272 psia when the pump was started. Thus, the valve remained opened following the pressure transient. If the prior valve would have experienced the same set of conditions that occurred on October 4, 2015, due to the absence of a bellows, the prior valve's re-seat value would have been higher due to the back pressure downstream of the valve acting on the back side of the valve. This higher re-seat value would likely have resulted in the prior relief valve closing after a pressure transient dissipated.
b.3 Observations During this event, hot pressurized RCS inventory that exited through RV 2-SI-468 was directed to the EDST. This tank was intended to function at an operating pressure of 20 psig and had a design pressure of 67 psig. After it was initially installed, it was hydrostatically tested to 100 psi. During this event, the EDST pressurized to approximately 59 psig with a brief (approximately five minutes) peak pressure of 69 psig. This pressure exceeded its design pressure of 67 psia. However, the ASME code allows for limited pressure excursions for short periods of time. For this event, no ASME codes were violated regarding the EDST.
Because the EDST was designed to receive RCS inventory from RV 2-SI-468 during Mode 5 conditions, the pressure and level instrumentation associated with the tank was also designed for the same conditions. Because of the design of the level detector (a nitrogen gas bubbler type), level indication failed off-scale low when the tank pressurized during this event. This provided erroneous information (e.g., -9%) to the operators when they checked EDST level on the plant process computer prior to implementing AOP 2568A around 8:53 a.m. The US noted this reading but continued on with the procedure without diagnosing that the leak to the EDST would have caused the erroneous indication. (The location of the leak was later determined by a plant equipment operator at 9:47 a.m.) Thus, due to the type of level indicator in the EDST, the source of the leak was not identified during this Mode 4 event for at least an additional 54 minutes. The limitation of this level indicator could have been compensated by a procedural note explaining that hot pressurized water relieving through RV 2-SI-468 during Mode 4 conditions could affect EDST level indication. This issue was determined to be not more than minor because the EDST, and associated instrumentation, was designed for Mode 5 operations and was not intended for Mode 4 conditions. Furthermore, adequate procedures exist to direct operators to search for and isolate a leak when there are indications of RCS inventory loss while in Mode 4. 2.5 Collection of Data for Refining the Risk Analysis
a. Inspection Scope
During the inspection, the inspectors collected data, such as plant design, procedural guidance, and system response, to refine the existing risk analysis. Also, during the early phases of the inspection, the inspectors considered overall post-event plant conditions to assess the need to upgrade the SIT to an AIT. b.1 Observations Risk Significance of the Conditions Initial Assessment The initial risk assessment, used to inform the IMC 0309 Reactive Inspection process and as documented in the enclosed SIT Charter, was based on the best available information at the time. It estimated the impact of a degraded suction RV within the SDC system during at-power postulated events such as steam generator tube ruptures and loss-of-coolant accidents. The estimated CCDP was conservatively determined to be in the mid E-6 range and assumed to have been degraded for an entire year. Specifically, the RV was assumed to lift anytime SDC would have been placed into service within the last year. Final Assessment During the special inspection, the team determined that the system alignment used when placing SDC in operation for postulated accident mitigation was not the same as the alignment used for placing SDC in operation for a normal plant cooldown, as was the case during this event. Specifically, accident mitigation procedures trip the RCPs prior to placing SDC in service to maintain RCS within pressure/temperature limits. A LPSI pump would then be started, and be operating, prior to opening the RCS suction path per emergency operating procedure direction. This accident mitigation system response alignment reduces the instantaneous pressure surge at RV 2-SI-468 and maintains a greater margin to the RV lift set point. Therefore, it was determined that the most appropriate method to evaluate the risk of the loss of inventory event associated with the SDC suction RV opening was within IMC 0609 Appendix G, "Shutdown Operations Significance Determination Process." A bounding quantitative estimate and additional qualitative insights gathered from the inspection, resulted in a determination that the risk significance of this loss of inventory event was more appropriately in the low E-7 range, or of very low risk significance (Green). See Section 2.4 of this report for additional details.
b.2 Observations After considering the post-event plant conditions, the team reviewed the deterministic criteria in IMC 309 and concluded that an AIT was not necessary.
4OA6 Meetings, Including Exit
On November 24, 2015, the inspectors presented the inspection results to Mr. John Daugherty, Site Vice President, and other members of the Millstone staff. The inspectors verified that no proprietary information was retained by the inspectors or documented in this report.
4OA7 Licensee-Identified Violations
The following violation of very low safety significance (Green) was identified by Dominion and is a violation of NRC requirements which meets the criteria of the NRC Enforcement Policy for being dispositioned as an NCV. 10 CFR Part 50.54(q), states that power reactor licensees shall follow and maintain in effect emergency plans which meet the standards in 10 CFR Part 50.47(b) and Appendix E to Part 50. 10 CFR Part 50.47(b)(4) requires, in part, that the nuclear facility licensee have a standard emergency classification and action level scheme in use, and state and local response plans call for reliance on information provided by facility licensees for determinations of minimum initial off-site response measures.
Appendix E,Section IV.C.2 states in part that, "nuclear power reactor licensees shall establish and maintain the capability to assess, classify, and declare an emergency condition within 15 minutes after the availability of indications to plant operators that an emergency action level has been exceeded and shall promptly declare the emergency condition as soon as possible following identification of the appropriate emergency classification level." Contrary to the above, when the crew entered AOP-2568A at 8:53 a.m., charging flow was about 80 gpm greater than letdown flow with PZR level lowering and the RCS cooldown was secured. The SM did not declare a UE (Identified Leakage greater than 25 gpm) until 9:32 a.m. Dominion determined that the event declaration was accurate because the SM ultimately determined that the leakage was Identified Leakage but untimely and entered the issue into the CAP (CR1011949). Because of the UE condition, the inspectors determined that the finding is of very low safety Significance (Green) using IMC 0609, Appendix B, "Emergency Preparedness Significance Determination Process, Attachment 1, "Failure to Implement (Actual Event) Significance Logic." ATTACHMENT A
SUPPLEMENTARY INFORMATION
KEY POINTS OF CONTACT
M. Adams Plant Manager L. Armstrong Director of Safety and Licensing M. Bigiarelli Senior Instructor Operations Training D. Blakeney Director Nuclear Safety & Licensing S. Brabec Manager - Maintenance W. Chesnutt Supervisor Nuclear Shift Operation Unit 2 F. Cietek PRA Specialist T. Cleary Licensing Engineer M. Cote Simulator Supervisor J. Daugherty Site Vice President T. Dubay System Engineer M. Goolsbey Manager - Millstone 3 Operations J. Grogan Nuclear Oversight Specialist J. Magyarik Shift Technical Advisor Unit 2 M. Marino Supervisor Mechanical Design Engineering J. Mozny Plant Equipment Operator J. Nelson Plant Equipment Operator L. Salyards Licensing Lead D. Smith Manager - Emergency Preparedness S. Smith Manager - Operations S. Stanley Director - Engineering E. Treptow Manager - Nuclear Site Engineering C. Walsh Superintendent Operations Training J. Wasylik Unit Supervisor Unit 2 B. Willkens Manager - Organizational Effectiveness W. Woolery Shift Manager Unit 2
LIST OF ITEMS OPENED, CLOSED, DISCUSSED, AND UPDATED
Opened/Closed
- 05000336/2015012-01 NCV Failure to Implement Procedural Guidance During a Loss of RCS Inventory
Opened/Closed
- 05000336/2015012-02 NCV Failure of the STA to Support the Crew During a Plant Cooldown
Opened/Closed
- 05000336/2015012-03 NCV Procedure Failed to Direct Adequate Venting of SDC System
LIST OF DOCUMENTS REVIEWED
Condition Reports
(CRs)
- CR549280
- CR1011898
- CR1011949
- CR1011961
- CR1011963
- CR1011969
- CR1011971
- CR1011986
- CR1012099
- CR1012358*
- CR1012535
- CR1012949
- CR1013503*
- CR1013505
- CR1013508*
- CR1013526*
- CR1013535
- CR1013645*
- CR1013705*
- CR1015158*
- CR1019079*
- CR1019082 *NRC Identified during inspection
Procedures
- AD-AA-102, Procedure Use and Adherence, Revision 10
- ARP 2593C-014, Equipment Drain Tank T-75 Pressure HI/LO, Revision 000
- ARP 2593D-007, Waste Gas Surge Tank Pressure HI/LO, Revision 000-01
- ER-AA-IST-103-1001, ASME IST Program - In-service Testing of Pressure Relief Devices Guideline, Revision 1 - I-11567, Anderson Greenwood Crosby Installation Manual, Revision 0
- MP-26-EPI-FAP06, Classification and PARs, Revision 10 Millstone Unit 2 Emergency Action Levels, Revision 10
- OP-AA-100, Conduct of Operations, Revision 29
- OP-AA-500, Conduct of Shift Technical Advisor, Revision 6
- OP 2207, Plant Cooldown, Revision 30
- OP 2310X00, SDC Suction Relief 2-SI-468 Isolation and Restoration, Revision 000-06
- SP 2604Z, Surveillance Form: Gas Accumulation Verification, Facility 1 and Common Header, Revision 2
- SP 2619A, Control Room Daily Surveillance, Modes 3 & 4, Revision 36 Technical Specifications, Section 6.8, Procedures
Work Orders
- 53102215326 53102360181 53102881791
Drawings
- Liquid Radwaste Processing System 25203-20126, Drain Header to Equipment Drain Sump Tank, Revision 22 25203-26015, Sheet 1, L.P. Safety Injection System, Revision 46 25203-26020, Sheet 5, Clean Liquid Radwaste System, Revision 16 25203-26021, Sheet 2, Gaseous Radwaste System, Revision 31
- 25203-26024, Sheet 3, Auxiliary Building Drains 25203-28500, Sheet 995, L-9736 Equipment Drain Sump Tank Level Loop Diagram, Revision 2 25203-29060, Sheet 99, Pressure Relief Valve, Revision 0, 7604-M235-6, Sheet 5, Composite Drawing D-10/S4 D-20/S4 Series Relief Valves for Nuclear Service, Revision 0
Other Documents
- Control Room Log Entries for 10/04/2015 Dominion response to Generic Letter 2008-01 dated October 14, 2008, ML082890266 Lesson Plan
- MB-00775,
- OP 2207 Plant Cooldown
- OP 2207 Plant Cooldown Briefing, R23 JITT Prompt Issue Review Team Report (CR1011898) Regulatory Guide 1.33, February 1978 Training Presentation, Introduction to EALS Training Presentation
- AOP 2568, Reactor Coolant System Leak
- Evaluations Reasonable Assurance of Safety (CR1015158 CA3013674)
- ETE-MP-2015-1159, Engineering Probable Cause of Relief Valve 2-SI-468 Lift, Revision 0 N-PENG-ER-005, Evaluation of Concurrent Operation of Reactor Coolant Pumps and the Shutdown Cooling System at Millstone Point, Unit 2, Revision 1
Miscellaneous
- 97-ENG-01836M2, Determination of Backpressure for Relief Valve 2-SI-468, Revision 000
- MP2-13-01133, Replacement of Relief Valve 2-SI-468, Revision 000, 98-ENG-02715-C2, Pipe Stress and Support Calculation for Valve 2-SI-468 and Relief Lines 1-1/2"-GCB-1 and
- HSC-112, Revision 000 97-ENG-01768E2, Low Range Pressurizer Pressure Loop Accuracy P-103 and P-103-1, Revision 04 7604-M-235, Specification for Miscellaneous Safety-Relief Valves for Millstone Nuclear Power Station Unit No. 2
LIST OF ACRONYMS
- ATC [[]]
US Unit Supervisor
B
- ATTACH [[]]
MENT B Special Inspection Team Charter Millstone Power Station Unit No. 2 Loss of Reactor Coolant System Inventory in Mode 4 due to Shutdown Cooling System Relief Valve Lift October 4, 2015 Background: On October 4, 2015 at 0641, Millstone Unit 2 was operating in Mode 4 and operators were in the process of placing shutdown cooling in service with the 'A' low pressure safety injection pump. During this process, a relief valve in the shutdown cooling system lifted, resulting in loss of reactor coolant system inventory (at greater than 25 gpm) to the equipment drain sump tank. Based on review of plant process computer traces, pressurizer level began to decrease between 0705 and 0710, approximately 20 minutes prior to a log entry noting that cooldown had commenced via shutdown cooling. According to operator logs, cooldown continued until 0840, when operators conducted the first brief to address indications and possible sources of a reactor coolant system leak, and reduced cooldown rate to assess the change in pressurizer level.
Operators entered Abnormal Operating Procedure 2568A, "RCS Leak, Modes 4, 5, 6, and Defueled," at 0853, and stopped the cooldown at 0854. At 0932, the Shift Manager declared a Notice of Unusual Event based on reactor coolant system leakage exceeding 25 gpm.
Operators secured the 'A' low pressure safety injection pump at 0951, and isolated the shutdown cooling system from the reactor coolant system at 0955. The station exited the Notice of Unusual Event at 1100 on October 4, 2015.
The station estimated that approximately 4,000 to 10,000 gallons of reactor coolant was discharged to the equipment drain sump tank. All reactor coolant system leakage was contained in the equipment drain sump tank and the rad waste system. Millstone Unit 2 remained in Mode 4 and maintained temperature using steam generators. The
- SDC [[suction relief valve was replaced on the morning of October 5, 2015, shutdown cooling was placed in service, and Unit 2 achieved cold shutdown at 1249. Basis for the Formation of the Special Inspection Team: Brief Description of the Basis for the Assessment: The Inspection Manual Chapter (]]
IMC) 0309 review concluded that one deterministic criterion in Enclosure 1 and one deterministic criterion in Enclosure 2 of IMC 0309 were met. The criterion met in Enclosure 1 was for questions or concerns pertaining to licensee operational performance during the event. The criterion met in Enclosure 2 was for the possibility of a significant failure to implement the emergency preparedness program during an actual event, including the possible failure to classify, notify, or augment onsite personnel. Specific areas for review are listed under the objectives of the special inspection.
The risk evaluation considered both an Event Assessment associated with a loss of inventory while in a shutdown condition and a Condition Assessment estimating the impact of a potentially degraded shutdown cooling suction relief valve which could impact the risk in other at-power events. The estimated conditional core damage probability (CCDP) is mid E-6 and places the risk in the range of overlap between baseline and special inspection. Based upon satisfying two deterministic criteria, and the estimated
- CC [[]]
DP value for Unit 2 being in mid E-6 range, the reactive inspection response is within the "baseline inspection to special inspection" overlap region. A Special Inspection Team is being initiated to gather information available from the event and to verify that immediate corrective actions were appropriate. Objectives of the Special Inspection: The Special Inspection Team will expand on the inspection activities started by the resident and regional inspectors immediately after the event. The team will review Dominion's organizational and operator response to the event, equipment performance and design, and the licensee's immediate corrective actions, as applicable. The team will collect data, as necessary, to refine the preliminary risk analysis. The team will also assess whether the Special Inspection Team should be upgraded to an Augmented Inspection Team.
To accomplish these objectives, the team will: 1. Develop a complete sequence of events including follow-up actions taken by Dominion. 2. Review and assess operator performance in monitoring and assessing plant response during transition to shutdown cooling, as well as actions taken when diagnosing the cause for decreasing pressurizer level. This assessment should include the timeliness of entry into the abnormal operating procedure. 3. Review and assess Dominion's decision-making process for emergency action level (EAL) entry, including determination of whether entry into the EAL was timely and appropriate. 4. Review and assess any equipment issues during the event, including shutdown cooling system relief valve performance. This assessment should also include the adequacy of the system configuration and procedures used to conduct the evolution. and 5. Collect data necessary to refine the existing risk analysis and document the final risk
analysis in the Special Inspection Team report.
Guidance: Inspection Procedure 93812, "Special Inspection," provides additional guidance to be used by the Special Inspection Team. Team duties will be as described in Inspection Procedure 93812. The inspection should emphasize fact-finding in its review of the circumstances surrounding the event. Safety concerns identified that are not directly related to the event should be reported to
the Region I office for action.
The team will conduct an entrance meeting and begin the inspection on October 13, 2015. While on site, the Team Leader will provide daily briefings to Region I management, who will coordinate with the Office of Nuclear Reactor Regulation to ensure that all other parties are kept
informed. A report documenting the results of the inspection will be issued within 45 days following the final exit meeting for the inspection. This Charter may be modified should the team develop significant new information that warrants review.
C
- ATTACH [[]]
- MENT C October 4, 2015, Millstone Unit 2 Shutdown Cooling Relief Valve Event Timeline Time Activity/Event
- IAW [[]]
- IAW [[]]
- OP -2207, Step 4.14.14. 0600 Shift turnover. Plant cooldown is still 'in-progress' with main steam atmospheric dump valves open, but is essentially stopped because of the reduced steaming capability with
- RCS [[temperature <300°F. Pertinent plant conditions:]]
- PZR level is steady, between 80 and 90% actual level Charging Pumps A and C are operating, charging at 88 gpm Letdown flow is steady at approximately 80 gpm
- SDC suction header pressure 39 psia 0613 The control room log records that Shutdown Cooling Suction Isolation 2-
- IAW [[]]
- SDC suction header pressure rises to 272 psia. 0635 The crew conducts a brief for transferring to Shutdown Cooling. 0641 The crew started
- EDST. [[]]
- LPSI pump started then subsequently drops sharply to -9% over the next three minutes. 0641 At the time of the pump start
- PPC over a four minute period. It appears that level indicator was adversely affected by flow of steam into
RCS. Cooldown rate then stabilizes at approximately 8°F/hour,
attributed to known leakage past the closed
US that PZR level has dropped below the established control band of 80% to 90% actual level, corresponding to 68% to 76% indicated level.
0651 The
- ATC [[]]
- ID [[]]
- ATC [[]]
- PZR level decrease and whether or not there might be a leak several times. They attributed the level response to the on-going cooldown. 0720 Letdown flow has been reduced by
- ATC [[]]
- RO [[to 28 gpm, approximately equal to the minimum flowrate that would have been established by the flow limiter when operating at normal operating pressure. Over the next 30 to 60 minutes, reduced letdown flow to 20 gpm, then 15 gpm, then stabilized at 5 gpm. 0730 Cooldown is commenced on]]
- SDC [[]]
- IAW [[]]
OP-2207, Step 4.18.23. Cooldown rate stabilized at approximately 25°F/hour. In interviews after the event, the US recalled
being aware of the change in cooldown rate but the
- ATC [[]]
- US holds a shift brief to address the pressurizer level change and actions to diagnose a possible leak. The cooldown rate is slowed from 25°F/hour to 13°F/hour. 0842 to 0847 During this time period, the
RCS Leak Modes 4, 5, 6 and Defueled". A plant announcement is made. A staff individual from the Oversight Group is already in
control room observing shift activities.
SNSO) are also in the control room. 0854 The cooldown is stopped. PZR level almost stabilized with ~5 gpm letdown and 88 gpm charging. 0858 to
0900 Control Room makes page announcement and sounds alarm to evacuate containment
- IAW [[]]
- IAW [[]]
- IAW [[]]
- OP -2207 is 35%. 0916 Plant Equipment Operators (PEOs) have been dispatched to look for leaks. Report received in control room of
- CR [[]]
- UE [[because of Identified Leakage >25 gpm.]]
- EDST [[pressure observed at >25 psi (EDST pressure is not logged on the]]
- PPC [[) Primary demineralizers currently bypassed Waste Tanks intact Clean Waste Receiver [which receives input from]]
- EDST [[] was at level of 52% at shift turnover and at 86% after]]
- CR [[]]
DSEO Subsequent Licensee Actions after the Event October 4 The Prompt Issue Review Team was initiated.
October 4-5 The licensee replaced
SI-468 and resumed the cooldown to begin refueling operations.
October 6 Qualifications were removed from the shift manager and the unit supervisor.
October 8 Qualifications were removed from the shift technical advisor.
October
- SI -468 was sent to vendor for testing. October 27 The licensee completed an engineering technical evaluation for the failure modes for
- SI -468. October 29 The licensee received the preliminary failure analysis report from the vendor for
SI-468.
October 29 The licensee completed the reasonable assurance of safety evaluation regarding the
- ED [[]]