IR 05000250/1985033
| ML17342A292 | |
| Person / Time | |
|---|---|
| Site: | Turkey Point  |
| Issue date: | 11/13/1985 |
| From: | Brewer D, Elrod S, Peebles T NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML17342A291 | List: |
| References | |
| 50-250-85-33, 50-251-85-33, NUDOCS 8511250278 | |
| Download: ML17342A292 (17) | |
Text
gpss REGII~
MpO co
'pi cs C
O I
++*+~
UNITED STATES NUCLEAR REGULATORY COMMISSION
REGION II
101 MARIETTASTREET, N.W.
ATLANTA,GEORGIA 30323 Report Nos.:
50-250/85-33 and 50-251/85-33 Licensee:
Florida Power and Light Company 9250 West Flagler Street Miami, FL 33102 Docket Nos.:
50-250 and 50-251 Facility Name:
Turkey Point 3 and
License Nos.:
DPR-31 and DPR-41 Inspection Conducted:
Sep ember 9 -. October 10, 1985 Inspectors: W6~
T. A. Peebles, Senior Resident Inspector D.
RE Brewer, Res dent Inspector Approved by:
S. A. Elrod, Section Chief Division of Reactor Projects
~OUI I
9S Date Signed d
I~(
gS Date Signed 0 IS
/9Y>
Date Signed SUMMARY Scope:
This special, unannounced inspection entailed 81 direct inspection hours at the site in the area of independent inspection.
Results:
No violations were identified.
8511250278 851114 PDR ADOCN 05000250 PDR
REPORT DETAILS Licensee Employees Contacted C.
M. Wethy, Vice President-Turkey Point C. J.
Baker, Plant Manager-Nuclear H. T. Young, Acting Plant Manager-Nuclear D.
D. Grandage, Operations Superintendent-Nuclear T. A. Finn, Operations Supervisor K. L. Jones, Technical Department Supervisor D. J. Tomaszewski, Plant Engineering Supervisor R.
G.
Mende, Reactor Engineer D. A. Chancy, Corporate Licensing J. Arias, Regulation and Compliance Supervisor R.
L. Teuteberg, Regulation and Compliance Engineer R. Hart, Regulation and Compliance Engineer J.
W. Kappes, Maintenance Superintendent-Nuclear P.
W. Hughes, Health Physics Supervisor J.
M. Donis, Site Engineering Supervisor M. J. Crisler, equality Control Supervisor D.
W. Hasse, Safety Engineering Group Chairman Other licensee employees contacted included engineers, technicians, and document control personnel.
Exit Interview On September 11, 1985, the Acting Plant Manager-Nuclear was notified of the potential violations concerning the non-reporting and adequacy of
CFR 50.59 reviews dealing with the turbine runback system modifications.
An exit meeting was held on September 24, 1985, with the Acting Plant Manager-Nuclear and the Regulation and Compliance Supervisor.
The pending enforcement conference was discussed concerning the turbine runback system modifications.
The inspector requested that a discussion be held to assure that all pertinent facts were known.
These discussions were held over the next several days with the reactor engineer and licensing personnel.
The adequacy of the
CFR 50.59 review of this modification is an unresolved item (URI 250,251/85-33-01).
The non-reporting of the plant operating outside of its analysis is an unresolved item (URI 250, 251/85-33-02).
Both are pending Office of Nuclear Reactor Regulation (NRR)
review.
The licensee did not identify as proprietary any of the materials provided to or reviewed by the inspectors during this inspectio Enforcement Conference An enforcement conference was held with the persons listed below in attendance on October 9,
1985, in the Region II office.
The topic was the events surrounding:
the requ'est submitted to the NRC for a license change to allow modifications to the turbine runback system; the subsequent plant modifications; the later deletion of the modifications.
Licensee Personnel Attending C. 0. Woody, Vice President-Nuclear Operations C.
M. Wethy, Vice President-Turkey Point J.
K. Hays, Director of Licensing W.
H. Rogers, Chief Engineer-Power Plant Engineering D.
Van Tassel, Manager, Plant Electrical Engineering F.
G. Flugger, Manager, Engineering Licensing R.
G.
Mende, Reactor Engineer J
~ Arias, Regulation and Compliance Supervisor NRC Personnel Attending J.
N.
RE D.
A.
F.
G.
R.
S.
A.
B. T.
T. A.
D.
R.
T.
C.
and L. P.
Grace, Region II Administrator Walker, Director, Division of Reactor Projects Gibson, Director, Division of Reactor Safety Jenkins, Director of Enforcement Elrod, Chief, Reactor Projects Section 2C Debs, Chief, Operational Programs Section Peebles, Senior Resident Inspector Brewer, Resident Inspector Poindexter, Enforcement Specialist, Office of Inspection Enforcement Modenos, Enforcement Specialist The licensee began the discussions by stating that: the original licensing basis for the plant did consider diversity and redundancy in the turbine runback system; the original licensing analysis for the plant considered a
drop of only one reactor control rod; and that drop of only one control rod is still the licensing basis of the plant.
The licensee stated that their letter request, L-82-343, to NRC to delete the flux rate input from the turbine runback system clearly discussed a drop of only one rod.
The Westinghouse analysis, that was submitted as an attachment to that letter, was submitted without changes though it did include statements which were not pertinent to the facility.
These statements concerned the analysis of more than one rod dropping-which was beyond the licensing basis for the plant.
The licensee stated that the inclusion of non-pertinent material without explanation was because NRR is required to know the licensing basis of the various plant The licensee further stated that the subsequent letters from 'Westinghouse concerning modifications to the dropped rod analysis and recommendations for changes to the turbine runback system were evaluated and found to be overly conservative for the licensing basis and therefore not reportable.
However, the changes were initiated for conservatism.
Subsequent to the licensee being notified of the potential violations, an analysis was performed by Westinghouse which states that, for this fuel cycle, turbine runback is not required for the analysis results to remain within limits for either a dropped rod or a dropped bank.
The meeting concluded with discussions which were beneficial to the understanding of the events and the licensee's actions.
4.
Unresolved Items Unresolved items are matters about which more information is required to determine whether they are acceptable or may involve violations or deviations Unresolved items are identified in paragraph 5.
t 5.
Independent'nspection a.
Summary A portion of the turbine runback system (TRS)
was disabled, per licensee approved design changers This design change deleted the diversity from the system and concurrently modified, by adding an appendix, the analyses in the Final Safety Analysis Report (FSAR).
Both units were operated in this condition.
b.
Description of the Original System for Rod Drop Initiation of Turbine Runback/Cutback The 1968 logic designs for the two portions of TRS were provided by the Nuclear Steam System Supplier (NSSS)
on sheet
of Westinghouse drawing 883D988,
"Turkey Point No.
& 4, Rod Stop 5 Turbine Load Cutback Logic." It describes the turbine-load-reference-reduction portion of TRS as not redundant and as being activated by either a
negative flux rate signal or an overtemperature/overpower high signal.
It also described the turbine-load-limit-reduction portion of TRS as not redundant and as activated by either a negative flux rate signal or a
rod bottom signal.
This drawing is also identified as FPL drawing 5610-M-0401-0126, sheet 15.
-(1)
The individual rod position indication (IRPI) system includes one rod bottom sensor per individual reactor control rod (rod cluster control assembly or RCCA)
which then activates its on-off controller (bistable).
A rod bottom logic signal from any bistable then activates the TRS through the turbine load limiter
'
until the main turbine unit is below 70 percent power.
This system was not designed to be fail-safe or redundant.
(2)
The negative flux rate logic inputs to the turbine runback logic are sensed by the four power range nuclear instruments (PRNI).
The negative flux rate logic signal from the PRNI divides into train A
and train B.
These logic inputs go through a
one-out-of-four coincidence logic to form an initiating signal to the TRS
~
The train A signal activates the TRS by reducing the load reference setpoint of the turbine governor speed changer at a
constant rate for a preset time.
The train B signal activates the TRS through the load limiter, until the main turbine unit is below 70 percent power.
The PRNI and high negative flux rate inputs to each train were designed to be fail-safe and redundant.
(3)
Load cutback is also shown to be initiated by an approach to an overpower or overtemperature condition, but this would not occur in most scenarios as part of a dropped RCCA events c. Introduction to the Initial FSAR Analysis Turbine runbacks are part of a control system intended to keep the nuclear plant operating following a
transient by automatically maintaining the necessary parameters within controlled limits.
The main transients which would result in a turbine runback are the loss of a main feedwater pump or the drop of one or more RCCAs.
The FSAR, Section 7,
titled Instrumentation and Control, and Section 14, titled Safety Analysis, describe the initial analysis for the dropped rod event.
Section 7 states that TRS action compensates for possible adverse core power distributions.
Section 14 states that TRS action prevents core damage.
Therefore, TRS is a
system designed'o mitigate a serious safety event.
FSAR page 7.2-25 describes Rod Drop Detection:
"Two independent systems are provided to sense a dropped rod, (1)
a rod bottom position indication system and (2)
a system which senses sudden reduction in out-of-core neutron flux.
These systems are not reactor protection systems.
Both systems initiate action in the form of a
turbine load cutback and blocking of automatic rod withdrawal.
This action compensates for possible adverse core power distributions and permits an orderly retrieval of the dropped RCCA.
A dropped RCCA would be detected by the rod bottom signal derived for each rod from its individual position indication system.
With the position indication system, initiation of action is not dependent on location, reactivity worth or power distribution change Backup is provided by use of the out-of-core power range nuclear detectors and is particularly effective for larger nuclear flux reductions occurring in the region of the core adjacent to the detectors."
FSAR 14. 1.4 describes the abnormality analysis for ROD CLUSTER CONTROL ASSEMBLY (RCCA)
DROP as follows:
"A rod drop signal from any rod position indication channel, or from one or more of the four power range channels, initiates protective action by reducing turbine load by a
preset adjustable amount and blocking of further automatic rod withdrawal.
Either action indivi-dually prevents core damage.
The turbine runback is redundantly obtained by acting upon the turbine load limit and on the turbine governor control system."
The Method of Analysis section states,
"The most negative values of moderator and Doppler temperature coefficients of reactivity were used and resulted in the highest heat flux during the transient."
The Conclusions state,
"Protection for a dropped RCCA is provided by automatic turbine power cutback and blocking of automatic rod with-drawal....
As the analyses presented show, the protection system, in conjunction with the load cutback, protects the core from DNB for a power tilt of 12 per cent at maximum full power conditions...."
d.
Sequence of 'Events (1)
Turkey Point Nuclear Plant had a series of maintenance problems which led to turbine runbacks.
The majority of the spurious runbacks were associated with the fai lure of one of the flux rate inputs to the TRS.
A failure of one IRPI or one PRNI could cause a spurious runback.
(2)
The licensee, Florida Power and Light Company (FPL), requested and received an analysis from the NSSS, Westinghouse, to delete the flux rate input from the turbine runback logic.
The results of the analysis were forwarded by the NSSS to FPL on June 22, 1982.
The attachment to that letter, titled Modification of the Turbine Runback System, stated:
"The automatic turbine runback feature of Turkey Point Units 3 and 4 is designed to provide protective action in the event of a
dropped RCCA or dropped bank.
...
The rod-on-bottom signal provides separate indication for each RCCA in the core and one signal is sufficient to initiate the turbine runback.
In any accident analysis, a limiting single failure for
that transient is assumed.
In the event of a dropped bank (assuming the flux rate input has been deleted),
between four and eight rod-on-bottom signals will be generated, one for each rod in the bank.
A failure of any one signal has no
.
impact, since there are still several other signals available, and only one is needed to initiate the turbine runback.
Therefore, the dropped bank analysis is not affected by this change to the turbine runback logic, and the FSAR analysis presented in Section 14. 1.4 remains applicable."
The conclusions of the analysis were:
"In summary, Westinghouse finds that it is acceptable to delete the flux rate portion of the turbine runback system provided the plants remain in manual rod control.
The detection and analysis of dropped banks are not affected by this change.
A dropped RCCA which does not result in a
runback is bounded by static RCCA misalignment."
Summarizing, this dropped RCCA analysis assumed a single failure-that a single dropped RCCA might not be detected.
This scenario was found to be bounded by previous analysis, assuming the control rods were operated in manual.
(3)
Per letters of August 10 and September 7,
1982, FPL requested the NRC Office of Nuclear Reactor Regulation (NRR) to review and approve their submittal for modification of the TRS to delete the flux rate input.
They stated that the modification would significantly reduce the probability of spurious runbacks without compromising plant safety and that the consequences of a single dropped RCCA with no runback was bounded by previous analysis.
The analysis attached to the title letter was the NSSS analysis of June 22, 1982.
(4)
On January 6,
1983, NRR responded.
NRR concluded that the proposed revision to the TRS was acceptable provided the reactor remains in the manual control mode.
The attached Safety Evaluation (SE) stated that the single rod drop event had been reanalyzed assuming that no TRS occurs.
The single rod drop event was assumed to be bounded by previous analysis with acceptable consequences.
Protection for a rod bank drop was assumed to still be provided since there are multiple rod bottom signals.
(5)
Independent of sequence ( l)-(4) above, on August 23, 1983, the NSSS notified FPL of the potential
'of an unreviewed safety question concerning the safety analysis of the dropped control rod
event.
The unreviewed safety question was that the FSAR scenario for the transient was not the most limiting-as was stated in the FSAR.
This is the scenario presented in the FSAR:
A dropped rod causes an initial reduction in nuclear power which corresponds to the reactivity worth of the rod.
In addition, a turbine runback to a preset level is actuated by a rod-on-bottom signal.
A dropped rod typically does not cause a large enough reduction in nuclear power such that the nuclear power exactly matches or falls below the turbine power at the runback setpoint.
However, with sufficient reactivity feedback, the nuclear power will decrease to match the turbine power and the plant will stabilize at the runback setpoint.
The NSSS had previously used the most negative values of moderator and Doppler temperature coefficients as stated in FSAR Section 14. 1.4.
However, the NSSS now stated that with no reactivity feedback (i.e.,
moderator temperature coefficient (MTC) worth
pcm/F.),
nuclear power will stabilize at the power level corresponding to that caused by the dropped rod.
Two scenarios were presented that were both more limiting that the scenario presented in the FSAR.
(6)
In November of 1983, FSAR Appendix 14C, Rev.
, titled Modification of The Turbine Runback System, was issued by the licensee based on the the 1982 analysis by the NSSS [(2) abovej.
The document was not updated to discuss the potential for more limiting scenarios per the August 1983 letter.
(7)
On May 21, 1984, the NSSS notified FPL that the transient scenarios discussed as potential unreviewed safety questions in-the August 1983 letter [(5) above]
were verified to be more limiting than that presented in the FSAR.
The NSSS revised their procedures to be consistent with the new transient scenario.
The analysis with the new scenarios showed that the DNB design basis was still met.
Thus, it was stated that no unreviewed safety question existed.
(8)
In December of 1984, Design Changes (Plant Change/Modifications or PC/M), titled Deletion of Flux Rate Input to Turbine Runback, PC/M 83-88 for Unit 3 and PC/M 83-89 for unit 4, were implemented.
These PC/Ms installed key lock switches to allow the disabling of the neutron flux rate inputs to the TRS.
The PC/Ms referenced the analyses and approvals from the NSSS and NRR.
Single failure analysis addressed the consequences of only one RCCA being dropped and not being sensed and the design TRS actuation not occurring for this one even (9)
The flux rate signals to the TRS were disabled by use of the installed key lock switches on Unit 4 on December 14, 1984, and on Unit 3 on January 31, 1985.
(10)
On February 20, 1985, a plant reactor engineer questioned the design changes.
On February 20, 1985, following telephone conversations with the NSSS, FPL re-enabled both unit's flux rate inputs to the TRS.
(11)
On February 21, 1985, a
telecopy was received by FPL from the NSSS.
It stated that they had analyzed the deletion of the flux rate runback from the TRS for its effect against the rod drop accident scenario.
However, the FPL PC/Ms had removed the required diversity.
Therefore, a single fai lure anywhere in the not redundant IRPI initiated turbine load limit circuitry could keep a dropped RCCA or dropped bank of RCCAs from being sensed and a accident mitigating circuit would not function.
Additional evaluation was to be pursued.
( 12)
On March 18, 1985, the NSSS sent a letter to FPL stating that further analysis of the dropped rod event had been conducted.
The conclusion was that the method of deleting the flux rate runback had made the circuitry susceptable to single failures, contrary to the design as stated in the FSAR Chapters 7 and 14.
The letter stated that if appropriate changes were made to the design modification, that then the analysis which had been conducted in 1982 and the NRC approval in 1983 would remain valid.
(13)
In June through August 1985, PC/M 84-210 was added to Unit 3 to establish redundancy in the rod bottom input to TRS. It also adds fai lsafe and rod bank drop protection.
Unit 4 modifications are due during the winter 1986 refueling.
(14)
On September 3,
1985, FPL sent to the NRC the yearly status of design changes which had been accomplished per
CFR 50.59.
PC/Ms 83-88 and 83-89 were included.
The descriptions of the design changes were as they were originally installed without amendment or comment.
( 15)
On September 11, 1985, the inspector notified the plant manager of a
potential violation for not reporting to the NRC per
CFR 50.72 (b)(ii) that the plant had been in an unanalyzed condition that significantly compromised plant safety or that the plant had been in a condition that was.outside the design basis.
(16)
On October 9, 1985, an enforcement conference was held with the licensee in the Region II office ~$
Synopsis and Evaluation of Events FPL in letters of August 10 and September 7,
1982, requested NRR to review and approve their submittal for modification of the TRS to delete the flux rate input for the scenario of a single dropped rod event.
The licensee stated that a portion of the submittal discussing a dropped rod bank was considered by the licensee to be not pertinent but was submitted because the NSSS analysis was submitted totally.
The licensee stated that this was not pointed out to NRR because NRR is aware of the plant licensing basis.
(2)
(3)
(4)
On January 6,
1983, NRR approved the change because FPL had stated that the previous analysis remained valid and bounding and that protection against a rod bank drop was still available.
Independent of (1)
and (2) above, on August 23, 1983, the NSSS notified FPL of the potential of an unreviewed safety question concerning the safety analysis of the dropped control rod event.
In November of 1983, FSAR Appendix 14C, Rev.
, titled Modifi-cation of the Turbine Runback System, was issued based on the the 1982 analysis by the NSSS and was not updated to discuss the potential for more limiting scenarios per the August 1983 letter.
The licensee states that this was an appendix as the modification had not yet been installed and updating of the FSAR main text was not yet required.
On May 21, 1984, the NSSS notified FPL that the transient scenarios discussed as potential unreviewed safety questions in the August 1983 letter [(3)
above]
were verified to be more limiting than those presented in the FSAR.
Therefore, what was submitted to NRR for approval was not the most limiting conditions as stated in their submittal.
The licensee stated that this was not reported because the letter clearly stated that the design basis was still met
~
(6)
In December of 1984, Design Changes were implemented.
These PC/Ms installed key lock switches to allow the disabling of the neutron flux rate inputs to the TRS.
The changes may be inadequate in that:
(a)
The PC/M refer ences or analysis did not evaluate the original NSSS logic design.
The analysis of other potential single failures or their consequences in the remaining non-redundant IRPI load limit TRS was not addressed.
The units were changed to rely on a non-diverse TRS-which invalidated the FSAR dropped rod analysi (b)
By making the TRS susceptible to complete malfunction due to a
single failure, the consequences of a
malfunction of equipment increased thus creating an unreviewed safety question.
The licensee has stated that the original licensing basis was for detection of only one dropped RCCA.
The licensee also stated that NRR reviewed and approved this change and that this license change approval from NRR allowed the modification to not detect the one dropped RCCA and that protection for more than one dropped RCCA is beyond the plant design basis.
The adequacy of the
CFR 50.59 review of this modification is an Unresolved Item (250,251/85-33-01)
pending resolution from NRR.
I The flux rate signals to TRS were disabled by use of the installed key lock switches on Unit 4 on December 14, 1984, and on unit 3 on January 31, 1985.
They were re-enabled on both units on February 20, 1985 following discussions with the NSSS.
On February 21, 1985, a telecopy was received by FPL from the NSSS stating that a
single failure anywhere in the not redundant IRPI-initiated turbine load limit circuitry could keep a dropped RCCA or dropped bank of RCCAs from being sensed and an accident mitigating circuit would not function.
On Narch 18, 1985, the NSSS sent a letter to FPL stating that further analysis concluded that the method of deleting the flux rate runback was contrary to the design as stated in the FSAR Chapters
and 14.
The letter concluded that the analysis which had been conducted in 1982 and the NRC approval in 1983 had been made invalid by the licensee's method of making the change.
During the enforcement conference, the licensee stated that: the original licensing basis for the plant did consider diversity and redundancy in the turbine runback system; however, the original licensing analysis for the plant considered a drop of only one reactor control rod and that drop of one control rod is still the licensing basis of the plant.
The licensee has stated that the NSSS is wrong in the assumption that more than one dropped RCCA should be considered as part of the analysis; and therefore, the original analysis and NRR approval were always valid.
The licensee stated that their letter request to NRC to delete the flux rate input from the turbine runback system clearly discussed a drop of only one rod'.
The Westinghouse analysis was submitted as an attachment to that letter without changes and it did include statements which were not pertinent to the facility.
These statements concerned the analysis of more than 'one rod dropping-
which was beyond the licensing basis for the plant.
The licensee stated that this was not pointed out to NRR because NRR is aware of the plant licensing basis.
The licensee further stated that the subsequent letters from Westinghouse concerning modifications to the dropped rod analysis and recommendations for changes to the turbine runback system were evaluated and found to be overly conservative for the licensing basis and therefore not reportable.
However, the changes were initiated for conservatism.
The non-reporting of the operation of the plant outside of its analysis is considered an Unresolved Item (250,251/85-33-02)
pending review by NRR.