IR 05000247/2004004

IR 05000247-04-004, on 11/10/03 Through 1/30/04, for Indian Point Energy Center, Unit 2; IP 71111.11B Licensed Operator Requalification Program Inspection

ML040370032
Person / Time
Site:	Indian Point
Issue date:	02/05/2004
From:	Conte R NRC/RGN-I/DRS/OSB
To:	Dacimo F Entergy Nuclear Northeast
References
IR-04-004
Download: ML040370032 (20)

Text

ary 5, 2004

SUBJECT:

INDIAN POINT ENERGY CENTER UNIT 2 - NRC INSPECTION REPORT 05000247/2004004

Dear Mr. Dacimo:

On January 30, 2004, the US Nuclear Regulatory Commission (NRC) completed an inspection at the Indian Point Energy Center, Unit 2. The enclosed inspection report documents the inspection findings, which were discussed with Mr. L. Cortopassio and other members of your staff on February 4, 2004.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, and interviewed personnel associated with the performance and testing of the Unit 2 simulator.

The purpose of the inspection was to follow-up on an unresolved item identified by the Special Team Inspection, conducted between August and October 2003 (reference NRC Inspection Report 50-247/2003-013 and 50-286/2003-010, dated December 22, 2003) involving the modeling of the Unit 2 plant specific simulator. Based upon the results of this inspection, two findings were identified. One finding involved a violation of 10 CFR 55.46(c)(1) for the failure to properly model key reactor plant parameters, which contributed to the errors made by control room operators in stabilizing the plant following the August 3, 2003, reactor trip. The second finding involved performance deficiencies in the Unit 2 simulator testing program. Both of these findings are of very low safety significance (Green). The violation of 10 CFR 55.46(c)(1) has been entered into your corrective action program and is being treated as a non-cited violation, consisted with Section VI.A of the NRC Enforcement Policy. If you deny this non-cited violation, you should provide a response with the basis for your denial, within 30 days of the receipt of this letter, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555-001; with copies to the Regional Administrator, Region 1; the Director, Office of Enforcement; and the NRC Resident Inspector at the Indian Point 2 facility.

Mr. Fred Dacimo 2 In accordance with 10 CFR 2.790 of the NRCs "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room). Should you have any questions regarding this report, please contact Mr. Richard Conte at 610-337-5183.

Sincerely

/RA/

Richard J. Conte, Chief Operational Safety Branch Division of Reactor Safety Docket No. 50-247 License No. DPR-26

Enclosure:

Inspection Report 05000247/2004004 w/Attachment: Supplemental Information

REGION I==

Docket No: 50-247 License No: DPR-26 Report No: 05000247/2004004 Licensee: Entergy Nuclear Operations, Inc.

Facility: Indian Point Energy Center Unit 2 Location: Buchanan, New York 10511 Dates: November 10, 2003 - January 30, 2004 Inspectors: A. Blamey, Senior Operations Engineer D. Jackson, Operations Engineer P. Presby, Operations Engineer Accompanied by: L. Vick, Reactor Engineer, NRR Approved by: Richard J. Conte, Chief Operational Safety Branch Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000247/2004-004; on 11/10/03 - 1/30/04; Indian Point Energy Center, Unit 2; IP 71111.11B Licensed Operator Requalification Program Inspection.

The report covered an announced inspection by three region-based inspectors, and one Headquarters-based simulator specialist. Two Green findings, of which one was a non-cited violation, were identified. The significance of the findings are indicated by their color (Green,

White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 3, dated July 2000.

NRC-Identified and Self-Revealing Findings

Cornerstones: Mitigating Systems

Green.

The inspectors identified a non-cited violation of 10 CFR 55.46(c)(1),

involving the failure of the simulator to correctly replicate key parameters such as steam generator pressure and cold leg temperature (Tcold) during a loss of all reactor coolant pumps. Additionally, the plant decay heat load was not correctly modeled which contributed to inappropriate operator actions during the August 3, 2003, plant trip.

This finding is more than minor because it affected the human performance (human error) attribute of the mitigating systems cornerstone. Not correctly replicating the plants response on the simulator provides the potential for negative operator training. The finding is of very low safety significance (Green)because the discrepancy did not have an adverse impact on operator actions such that safety related equipment was made inoperable during normal operations or in response to a plant transient.

Green.

The inspectors identified that simulator performance testing did not meet the standards as specified in ANSI/ANS 3.5-1985 in that: (1) best estimate data for the simulator testing was not used; (2) all required key parameters during the simulator test were not recorded; and (3) simulator differences identified during testing were not documented and justified.

This finding is more than minor because it affects the human performance (human error) attribute of the mitigating systems cornerstone. More specifically, improperly conducted simulator testing resulted, in part, in not identifying replication issues for steam generator pressure and cold leg temperature. The finding is of very low safety significance (Green) because the discrepancy did not have an adverse impact on operator actions such that safety related equipment was made inoperable during normal operations or in response to a plant transient.

ii

Summary of Findings (contd)

B. License-Identified Violation None.

iii

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Mitigating Systems

1R11 Licensed Operator Requalification Program

Background During a special inspection to assess the August 3, 2003, loss of offsite power (LOOP)and reactor trip (IR 05000247/2003013; 05000286/2003010) an unresolved item was created to review the simulator decay heat model (Unresolved Item 05000247/2003013-03). The purpose of this inspection was to follow-up the unresolved item and determine if the simulator modeling discrepancy was the result of a human performance problem or simulator / training program deficiency as it relates to 10 CFR 55.46 and to determine if it was possible to identify this modeling issue during simulator performance testing.

Conformance With Simulator Requirements Specified in 10 CFR 55.46

a. Inspection Scope

The inspectors assessed the adequacy of the Indian Point Energy Center (IPEC) Unit 2 simulation facility (simulator) for use in operator licensing examinations and training as prescribed in 10 CFR 55.46, Simulation Facilities. The inspectors also reviewed a sample of simulator performance test records (i.e., transient tests and discrepancy resolution validation tests), simulator discrepancy and modification records, and the process for ensuring continued assurance of simulator fidelity in accordance with 10 CFR 55.46. Open simulator discrepancies were reviewed for importance relative to the impact on 10 CFR 55.45 and 55.59 operator actions as well as on nuclear and thermal hydraulic operating characteristics. Furthermore, the inspectors conducted interviews with the licensees simulator staff to discuss the configuration control process and used the IP 71111.11, Appendix C, checklist to evaluate whether or not the licensees plant-referenced simulator was operating adequately as required by 10 CFR 55.46(c),

(d) and ANSI/ANS-3.5-1985, Nuclear Power Plant Simulators for Use in Operator Training.

1. Failure of the Simulator to Demonstrate Expected Plant Response to Transient

Conditions

Introduction.

A Significance Determination Process (SDP) Green Non Cited Violation (NCV) was identified for failure of the Unit 2 simulator to replicate expected plant response to the post-trip decay heat load and other key plant parameters as required by 10 CFR 55.46(c)(1), Plant-referenced simulators.

Description.

The NRC identified that the Unit 2 simulator did not accurately model the cooling effects of auxiliary feedwater injection during the August 2003 reactor trip. The simulator did not exhibit a reactor coolant system cooldown with maximum auxiliary feedwater injection with a LOOP following a reactor trip, at any modeled time in core life.

The actual plant experienced a significant cooldown until auxiliary feedwater flow was reduced in accordance with Emergency Operating Procedures (EOPs). The inspectors compared actual plant performance graphs with the controlled simulator runs and observed significant differences in the response of wide range cold leg temperatures (Tcold) over a 40-minute period following the LOOP and reactor trip. The simulator decay heat load was too high to allow any cooldown from the auxiliary feedwater injection. This condition contributed to the inappropriate operator actions which delayed stabilizing the reactor cooldown following the August 3, 2003, reactor trip.

During the week of November 10, 2003, a follow-up inspection was performed to evaluate the simulators ability to correctly model the known plant response. IPEC noted that the cooldown issue revealed following the August 2003 reactor trip had been resolved by recent upgrades to the simulator software and hardware. The existing simulator models were replaced with new higher fidelity models for the reactor coolant system, steam generator and core models. The new models were used for operator training at the end of October 2003. However, when the August 2003 reactor trip was recreated on the simulator, using the new models and compared to the actual plant response, there were still significant differences in several key parameters (pressurizer pressure, pressurizer level, hot leg temperature (Thot)). The thermal-hydraulic model deficiency appeared to relate mainly to improper response of Thot, which, on the simulator, initially dropped to 552°F, rose to 574°F and then dropped to 560°F. This differed from plant response where Thot dropped to 561°F, rose to 565°F and then remained within the 4°F band between these two values for about 20 minutes. This issue has been documented in the Unit 2 simulator deficiency reporting system.

During the Follow-up inspection the Unit 2 simulator staff ran Performance Test 14.3.9.11, Loss of All Reactor Coolant Pumps (RCPs) using the new simulator models.

Inspectors reviewed the simulator test data and compared it to the actual plant response during the August 2003 reactor trip. The comparison showed that replication discrepancies still existed on other key parameters. These discrepancies are listed below:

(a) Steam generator pressure in the plant rose from 750 psi to 950 psi in the first minute of the event, then dropped to 830 psi before rising again. The simulator initially rose from 700 psi to 900 psi then decreased to 740 psi. See Figure 1 below.

Figure 1 - SG Pressure SG Pressure - Simulator Vs Plant 950 900 Pressure (psig)850 800 750 700 60 120 180 240 300 360 420 480 Time (sec)

Simulator Plant

(b) Loop Tcold instruments on the simulator showed an initial decrease of 2°F over the first twenty seconds of the event, followed by a return to the initial Tcold of 534°F. At approximately two and a half minutes into the event, Tcold decreased 20°F to 513°F. The reference plant showed an immediate, but gradual increase in Tcold following event initiation, raising Tcold from 534°F to 538°F over the first two minutes of the event. For the first 15 minutes of the event, the lowest temperature recorded in the plant was approximately 523°F while the simulators lowest temperature was approximately 513°F. See Figure 2 below.

Figure 2 - Cold Leg Temperature Tcold - Simulator Vs Plant 540 535 530 Temp (°F)525 520 515 510 120 240 360 480 600 720 840 Time (sec)

Simulator Plant The improper simulator reactor coolant system cooldown response due to excessive decay heat from the previous core model and the existing issues with the response of the new models (Thot, Tcold, and steam generator pressure) both demonstrate an unexpected response to a transient condition to which the simulator has been designed to respond.

Analysis.

The inspectors determined that the failure to ensure that the Unit 2 simulator correctly replicates expected plant response to transient conditions is a performance deficiency because IPEC is expected to meet the requirements of 10 CFR 55.46(c)(1),

Plant-referenced simulators. Traditional enforcement does not apply because the issue did not have any actual safety consequences or potential for impacting the NRCs regulatory function and was not the result of any willful violation of NRC requirements or IPECs procedures. This finding is more than minor because it affects the human performance (human error) attribute of the mitigating systems cornerstone.

This finding was evaluated using the Operator Requalification Human Performance SDP (MC 0609 Appendix I) because it is a requalificaiton training issue related to simulator fidelity. The SDP, Appendix I, Block 12, requires the inspector to determine if deviations between the plant and simulator could result in negative training or could have a negative impact on operator actions. Negative Training is defined, in a later version of the standard (ANSI 3.5-1993), as Training on a simulator whose configuration or performance leads the operator to incorrect response or understanding of the reference unit. The Office of Nuclear Reactor Regulation, (NRR) was requested to review and clarify the requirement that negative training could have occurred verses did occur.

Based on the review, NRR determined that negative training did not have to occur but, there had to be a potential for negative training based on the difference between the simulator and plant. Therefore, based on this clarification, if differences between the simulator and plant could negatively impact operator actions or potentially result in negative training then the finding is Green. Specifically, in this case the simulator had a higher decay heat load than the plant and the operators did not expect the initial plant cooldown using auxiliary feedwater. This discrepancy between the plant and simulator was determined to be a contributing cause to the operators delay in stabilizing the reactor cooldown following the August 2003 reactor trip. Therefore, the answer to the Block 12 question is yes which resulted in a finding of very low safety significance (Green). The finding is of very low safety significance (Green) because the discrepancy did not have an adverse impact on operator actions such that safety related equipment was made inoperable during normal operations or in response to a plant transient.

Enforcement.

10 CFR 55.46(c)(1) requires, in part, that the simulator must demonstrate expected plant response to transient conditions. Contrary to this requirement, the Unit 2 simulator did not demonstrate expected plant response to the August 3, 2003, reactor trip. Specifically, the decay heat load appeared higher in the simulator than the plant. The failures of the simulator to accurately replicate and model plant response can result in negative operator training and, as in the case of the August 2003 reactor trip contribute to inappropriate operator actions. The failure to ensure that the simulator correctly replicates expected plant response to transient conditions is of very low safety significance and has been entered into the CAP (IP2-2003-06892), this violation is being treated as an NCV, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000247/2004004-01, Failure of the Simulator to Demonstrate Expected Plant Response to Transient Conditions.

2. Failure to Conduct Simulator Testing in Accordance With ANSI/ANS 3.5-1985

Introduction.

The inspectors identified a Green finding with three examples of failing to conduct simulator performance testing in accordance with the standards of ANSI/ANS 3.5-1985. The examples are:

(a) IPEC compared the current year simulator transient test data to the previous year simulator transient test data rather than to best estimate data,

(b) the annual simulator transient performance tests did not record all required parameters, and

(c) differences in key parameters were not documented or justified.

Description Use of Previous Year Simulator Data Instead of Best Estimate Data The inspectors reviewed three annual simulator transient performance test procedures:

• Test 14.3.9.9 Simultaneous Trip of Both Main Feed Pumps

• Test 14.3.9.11 Simultaneous Trip of All RCPs

• Test 14.3.9.23 Manual Reactor Trip.

Based on this review and interviews with Unit 2 personnel, the inspectors determined that the current year annual simulator transient performance test results were compared to the previous year test results instead of using the best estimate data required by ANSI/ANS 3.5-1985 as endorsed by Regulatory Guide 1.149 Revision 1. The Unit 2 testing methodology was based on the simulator benchmark that was completed during the site acceptance testing in 1994. The benchmark was performed by comparing the simulator performance tests to either a plant event (of which there were a few, including reactor trips) or best estimate data when available. For transients without actual or predicted plant data, a tabletop evaluation of simulator test results was performed with knowledgeable plant staff members.

For all transient tests, these initial simulator test runs became the "best estimate" data for the next performance of transient tests. Annually, the tests would be rerun, data would be evaluated by comparison to the previous year test data and, if needed, corrective actions would be implemented on the simulator. Following approval of that year's annual tests, those test results became the baseline for the next test performance. This methodology for continually updating the comparison baseline is not described in the station simulator test program documentation and is contrary to ANSI/ANS-3.5-1985, which defines best estimate as reference plant response data based upon engineering evaluation or operational assessment. IPEC did not perform any comparison of current years data to actual or predicted plant performance.

Comparison of test data to previous test data can highlight differences in simulator performance year-to-year for the purposes of revealing unanticipated effects of recent modeling changes. However, small changes in simulator performance over several years could lead to unacceptable differences in performance between the simulator and the expected reference unit response. Proper verification of simulator fidelity is not assured without direct comparison of simulator transient test data to the reference unit best estimate.

Simulator Transient Performance Tests Do Not Record All Required Parameters ANSI/ANS 3.5-1985 Appendix B lists the parameters to be recorded during the performance of each specific annual transient performance test. Many of these key parameters are not recorded during the Unit 2 transient tests. The following list documents the three transient tests that were reviewed and the parameters that were missing from each of the tests.

 Test 14.3.9.9, Simultaneous Trip of Both Main Feed Pumps, is missing 9 of 11 parameters listed in the standard, specifically neutron flux, average temperature, pressurizer pressure, pressurizer level, pressurizer temperature, steam flow, Thot, Tcold, and steam generator pressures.

 Test 14.3.9.11, Simultaneous Trip of All RCPs, is missing 10 of 11 parameters listed in the standard, specifically neutron flux, pressurizer pressure (lists RCS pressure instead), pressurizer level, pressurizer temperature, steam flow, feed flow, Thot, Tcold, steam generator pressure, and steam generator level.

 Test 14.3.9.23, Manual Reactor Trip, is missing 4 of 11 parameters listed in the standard, specifically average temperature, pressurizer temperature, Thot and Tcold.

The purpose of Appendix B to ANSI/ANS 3.5-1985 is to clarify the scope and intent of simulator operability testing. To accomplish this purpose, the appendix lists a set of transients to be performed and specifies those key parameters that should be recorded for each particular transient for comparison with reference plant data.

Contrary to the ANSI standard, the sampled Unit 2 simulator test procedures only include a limited subset of these required parameters. Comparison of simulator transient performance to reference unit performance did not meet the standard because key parameters were not recorded, evaluated and assessed.

Key Parameter Differences Are Not Documented or Justified The Unit 2 simulator test data showed differences in key parameters from year-to-year.

No documentation was available to explain or justify these differences.

The ANSI/ANS 3.5-1985 standard requires that the observable change in parameters correspond in direction to those expected from a best estimate for the simulated transient. Contrary to this standard, test data showed observable changes in parameters that do not correspond in direction to those of the same parameter in data used as the comparison reference. Relative magnitude of parameter response is also different in some instances from the comparison reference.

An example of an undocumented difference in trend data from a simulator transient test in one year to the same simulator transient test performed in the previous years is illustrated graphically in Figure 3 below. This figure compares the Reactor Coolant System (RCS) pressure graphs for the simultaneous trip of all RCPs in calendar years 2001, 2002 and 2003. The figure showed a different simulated pressure response in each case with no documentation to explain the differences. The figure is a graph of RCS pressure in psi (vertical axis) versus time in seconds (horizontal axis). Note that this figure reflects a comparison of simulator to simulator data, rather than to reference plant data.

Figure 3 - Reactor Coolant System Pressure (from three consecutive annual simulator transient tests)

Pressurizer Pressure - Simulator Year to Year 2350 2300 Pressure (psi 2250 2001 2200 2002 2150 2003 2100 2050 A

2000 n

60 120 180 240 300 360 al ys Time (sec)is.

T he inspectors determined that this finding is a performance deficiency because IPEC has committed to conduct simulator testing in accordance with the ANSI/ANS 3.5-1985 standard as endorsed by Regulatory Guide 1.149, Revision 1 (November 15, 1995, letter from Consolidated Edison Company of New York Vice President to the NRC).

Specifically, the simulator performance testing did not meet the standards specified in ANSI/ANS 3.5-1985 in that:

(1) best estimate data for the simulator testing was not used;

(2) all required key parameters during the simulator test were not recorded; and

(3) simulator differences identified during testing were not documented and justified.

Traditional enforcement does not apply because the issues did not have any actual safety consequence or potential for affecting the NRCs regulatory function and were not the result of any willful violation of NRC requirements or licensee procedures. The performance deficiency is more than minor because it affected the ability of the Unit 2 simulator transient tests to detect replication problems and affects the Human Performance (Human Error) attribute of the Initiating Events and Mitigating Systems cornerstones.

This finding was evaluated using the Operator Requalification Human Performance SDP (MC 0609 Appendix I) because it is a requalificaiton training issue related to simulator fidelity. The SDP, Appendix I, Block 12, requires the inspector to determine if deviations between the plant and simulator could result in negative training or could have a negative impact on operator actions. Negative Training is defined, in a later version of the standard (ANSI 3.5-1993), as Training on a simulator whose configuration or performance leads the operator to incorrect response or understanding of the reference unit. The Office of Nuclear Reactor Regulation, (NRR) was requested to review and clarify the requirement that negative training could have occurred verses did occur.

Based on the review, NRR determined that negative training did not have to occur but, there had to be a potential for negative training based on the difference between the simulator and plant. Therefore, based on this clarification, if differences between the simulator and plant could negatively impact operator actions or potentially result in negative training then the finding is Green. Specifically, in this case the failure to correctly perform simulator testing resulted in not identifying the year-to-year differences in reactor coolant system pressure following a trip of all reactor coolant pumps, and in the case of steam generator pressure and Tcold it resulted in not identifying replication issues. This reduced the overall simulator fidelity and as a consequence, has the potential to result in negative operator training and improper operator response to a plant transient. Further the failure to correctly conduct simulator testing could result in not identifying other simulator repetition issues. Therefore, the answer to the Block 12 question is yes which resulted in a finding of very low safety significance (Green). The finding is of very low safety significance (Green) because the discrepancy did not have an adverse impact on operator actions such that safety related equipment was made inoperable during normal operations or in response to a plant transient.

Enforcement.

No violation of regulatory requirements occurred. The inspectors determined that the finding did not represent a noncompliance because IPEC performed testing; however, the testing was not sufficient in scope, as specified in ANSI/ANS-3.5-1985 to identify potential discrepancies and repetition issues. FIN 05000247/2004004-002, Failure to Conduct Simulator Testing in Accordance With ANSI/ANS 3.5-1985.

4OA6 Meetings, Including Exit

The inspectors met with Entergy representatives on December 11, 2003, to review the purpose and scope of the inspection and to discuss the teams preliminary findings. The exit meeting was conducted on February 4, 2004. Entergy acknowledged the teams preliminary inspection findings and did not take issue with the findings preliminary characterizations.

The inspector asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was reviewed during this inspection.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

L. Cortopassio, IPEC Training Manager

R. Christman, Operations Training Supervisor

W. Robinson, Simulator Maintenance Supervisor

K. Curran, Unit 2 Simulator Test Operator

J. Roland, Simulator Instructor

R. Robenstein, Simulator Instructor

NRC Personnel

A. Blamey, Senior Operations Engineer, Region I

D. Jackson, Operations Engineer, Region I

P. Presby, Operations Engineer, Region I

L. Vick, Reactor Engineer, NRR

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Open and

Closed

05000247/2004004-001 NCV Failure of the Simulator to Demonstrate Expected Plant Response to Transient Conditions

05000247/2004004-002 FIN Failure to Conduct Simulator Testing in Accordance With ANSI/ANS 3.5-1985

Closed

05000247/2003013-003 URI Acceptability of the Unit 2 simulator modeling of decay heat load and auxiliary feedwater cooldown.