IR 05000336/2003006
ML031810805 | |
Person / Time | |
---|---|
Site: | Millstone |
Issue date: | 06/30/2003 |
From: | Blough A Division Reactor Projects I |
To: | Christian D Dominion Resources |
References | |
IR-03-006 | |
Download: ML031810805 (34) | |
Text
une 30, 2003
SUBJECT:
MILLSTONE POWER STATION UNIT 2 - NRC SPECIAL INSPECTION REPORT 50-336/03-06
Dear Mr. Christian:
On March 7, 2003, you experienced a reactor trip at your Millstone Unit 2 facility during reactor protection system testing. This reactor trip was complicated by subsequent failures of the Unit 2 charging system and a control circuit for the atmospheric and condenser steam dump systems. The NRC conducted a special inspection from March 11, 2003 to March 28, 2003, to review and assess the initiating event, operator actions, station procedural guidance, and equipment response related to this event. On May 16, 2003, the results of the NRC teams inspection were discussed with Mr. J. Alan Price and other members of your staff. The enclosed report presents the results of the inspection.
The NRC team examined activities related to reactor safety and compliance with the Commissions rules and regulations, and with the conditions of your operating license. The inspection consisted of selected examination of procedures, representative records and equipment, interviews with personnel, and observations of on site activities.
This report documents one finding concerning modifications to the charging system that prevented the system from performing its design function during the March 7 event. This finding has potential safety significance greater than very low significance. While this finding initially presented a safety concern, the team verified that compensatory measures were implemented to mitigate the safety concern while long-term corrective measures are being implemented. In addition, the report documents three findings of very low safety significance (Green), of which two were determined to be violations of NRC requirements. However, because of the very low safety significance and because they are entered into your corrective action program, the NRC is treating these two findings as non-cited violations (NCVs)
consistent with Section VI.A of the NRC Enforcement Policy. If you contest any NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region I; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at Millstone.
Mr. D. In accordance with 10 CFR 2.790 of the NRCs "Rules of Practice," a copy of this letter, its enclosures, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA/
A. Randolph Blough, Director Division of Reactor Projects Docket No.: 50-336 License No.: DPR-65
Enclosure:
NRC Inspection Report 50-336/03-06
Mr. D.
REGION I==
Docket No.: 50-336 License No.: DPR-65 Report No.: 50-336/03-06 Licensee: Dominion Nuclear Connecticut, Inc.
Facility: Millstone Power Station, Unit 2 Location: P. O. Box 128 Waterford, CT 06385 Dates: March 11, 2003 - March 28, 2003 Inspectors: S. M. Schneider, Senior Resident Inspector, Team Leader D. L. Pelton, Senior Resident Inspector, Vermont Yankee P. D. Kaufman, Senior Reactor Inspector, Division of Reactor Safety (DRS)
E. W. Cobey, Senior Reactor Analyst, DRS J. C. Jang, Senior Health Physicist, DRS F. W. Jaxheimer, Reactor Inspector, DRS Observer: D. A. Galloway, Supervising Radiation Control Physicist, State of Connecticut, Department of Environmental Protection, Division of Radiation Approved by: Brian J. McDermott, Chief Projects Branch 6 Division of Reactor Projects
SUMMARY OF FINDINGS
IR 05000336/2003-006; 03/11/2003 - 03/28/03; Dominion Nuclear Connecticut, Inc.; Millstone
Power Station; Unit 2; Special Inspection for March 7, 2003 event; Event Follow up The NRC special inspection was conducted by a six-person team comprised of resident inspectors, regional inspectors, and a regional senior reactor analyst. The team was accompanied by a radiation control physicist from the State of Connecticut, Department of Environmental Protection. The inspection identified one violation for which the safety significance has not yet been determined, and three Green issues, two of which were non-cited violations (NCVs). The significance of most findings is indicated by the color (Green, White,
Yellow, Red) using Inspection Manual Chapter 0609, "Significance Determination Process" (SDP). Findings for which the SDP does not apply may be "Green" or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.
NRC-Identified and Self-Revealing Findings
Cornerstone: Mitigating Systems
- TBD. The team identified a violation of 10 CFR 50, Appendix B, Criterion III,
Design Control, for two design changes which adversely affected the charging system and for which post-modification testing was not specified, or performed, to ensure that the charging system could fulfill its design function under anticipated conditions. This violation was determined to have potential safety significance greater than very low significance because it adversely affected the capability of the charging system to respond to initiating events.
This finding is unresolved pending completion of a significance determination.
(Section 4OA3.1)
- Green.
A violation of Technical Specification 6.8.1, "Procedures" occurred on March 7, 2003, when operators gagged charging pump relief valves without procedural controls or proper authorization. During efforts to restore flow from the charging system, a senior reactor operator in the field directed a plant equipment operator to install the relief valve gagging devices. Subsequently, the "C" charging pump was started and run with its discharge relief valve gagging device installed.
This finding was more than minor because it affected the human performance and equipment performance attributes of the Mitigating Systems Cornerstone objective. This finding was considered to have very low safety significance (Green) using NRC Inspection Manual Chapter 0609, Appendix A, SDP Phase 1 screening, because the installation of the gagging devices did not result in damage to, or unavailability of, the charging system. (Section 4OA3.4)ii
- Green.
The team identified a lack of adequate corrective action for a longstanding problem with the Unit 2 condenser steam dump valve control circuit. In May of 2000 and in April of 2002, the licensee identified problems with the configuration and performance of condenser steam dump control wiring.
These problems remained uncorrected up to the time of the March 7, 2003, reactor trip and resulting transient. Although problems with the control signal and valves were repeatedly entered into the corrective action program, the cause was not determined and effective actions were not taken to correct this equipment problem. A primary cause of this finding was related to the cross-cutting area of Problem Identification and Resolution.
This finding is associated with both the Design Control and Equipment Performance attributes of the Mitigating Systems Cornerstone. The finding is more than minor because it affects the mitigating systems objective of ensuring the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. The finding was considered to be of very low safety significance (Green) because it did not result in a loss of safety function of the system. (Section 4OA3.6)
Cornerstone: Barrier Integrity
- Green.
The team identified a non-cited violation for the failure of Unit 2 operators to enter the abnormal operating procedure (AOP) for reactor coolant system (RCS) leakage when confronted with plant conditions that were consistent with the procedure entry conditions. A primary cause of this finding was related to the cross-cutting area of Human Performance.
This finding was more than minor because it affects the RCS Barrier performance attribute of the Barrier Integrity Cornerstone objective, in that, failure to enter the applicable AOP and perform a timely containment entry to identify the source of RCS leakage reduced the assurance that the RCS barrier would protect the public from radionuclide releases. The finding is of very low safety significance because it did not increase the likelihood of any initiating events and it did not adversely impact any mitigating equipment. (Section 4OA3.5)
Licensee Identified Violations
None.
iii
SUMMARY OF UNIT 2
PLANT STATUS
On March 7, 2003, with the Millstone Unit 2 reactor at 100% power, a reactor trip occurred due to a switch failure during reactor protection system testing. This reactor trip was complicated by subsequent failures of the Unit 2 charging system and a control circuit for the atmospheric and condenser steam dump systems. Following an event investigation by Dominion and system repairs, Unit 2 was restored to 100% power on March 28, 2003.
BACKGROUND The charging portion of the Chemical Volume and Control System (CVCS) at Millstone Unit 2 is comprised of three positive displacement pumps that discharge into a common header. The piping immediately downstream of each pump is protected by a pressure relief valve that discharges to the suction line of its respective pump. During plant operation, one charging pump is normally in service. The "lead" standby charging pump receives an automatic start signal at -2.5% deviation from the pressurizer level program band and the second standby charging pump will automatically start at a -3.6% deviation. A third control signal will simultaneously start both standby charging pumps at a -4.6% deviation from the pressurizer level program band. Two recent modifications to the charging system affected the systems response to the March 7 event.
In April 2002, the licensee installed new relief valves on the discharge piping of the positive displacement charging pumps. The licensee considered the new relief valves to be a "like for like" replacement and therefore the valves were only bench tested by the vendor prior to installation. The previously installed relief valves had exhibited a history of setpoint drift and failing as-found set point verifications during In-Service Testing (IST). In addition, these valves had exhibited a tendency to lift and, at times, remain open during system testing with one pump in operation and a simultaneous start of the two standby pumps. Following the installation of the new relief valves, the engineering organization did not specify testing that included a simultaneous start of two standby charging pumps.
In May 2002, the licensee implemented a design change to the pressurizer level control circuitry to address pressurizer level fluctuations. After evaluation of the level fluctuations, the licensee decided to modify the pressurizer level control circuitry by installing a three-second time delay on the start signals for the standby charging pumps. Specifically, the licensee installed this time delay on the signals that sequentially start the standby charging pumps. However, the third control signal, the signal which simultaneously starts both backup charging pumps, was not modified due to an error in the design of the modification.
CHRONOLOGY AND DETAILS On March 7, 2003, a reactor trip occurred due to the failure of a test switch during Reactor Protection System (RPS) testing. This reactor trip was complicated by the failure of the charging system to provide pressurizer level control and a failure of the atmospheric and condenser steam dumps to quick open.
Following the reactor trip, the resultant (and expected) rapid decrease in pressurizer level caused a simultaneous start of the two standby charging pumps. The initial pressure surge created by the pump starts caused the relief valves for all three pumps to open and recirculate water from each pumps discharge line to its suction line. The bellows (internal seals) in all three relief valves were also damaged at this time, allowing water to flow from the relief valve bonnet vent onto the floor of the charging system cubicles.
After several unsuccessful attempts to restore the charging system via the normal charging flow path, operators reasoned that the charging system discharge header was blocked. In order to restore normal pressurizer level, the operators decided to use the alternate charging flow path through the High Pressure Safety Injection (HPSI) system. This alternate charging flow path was ultimately successful for two of the three charging pumps. Operators restored pressurizer level and pressure to within procedural limits and then commenced a cooldown of the plant.
An additional complication for operators following the reactor trip was the failure of both the atmospheric steam dumps and the condenser steam dumps to quick open on the loss of turbine load. As a result, six of sixteen steam generator relief valves lifted to relieve steam generator pressure. Approximately two minutes into the event, the condenser steam dumps modulated open in response to other control signals.
Following the plant shutdown, the licensees Event Review Team (ERT) determined the causes for the unexpected plant responses. The licensees investigation found that the two standby charging pumps simultaneously started on March 7 because their sequential start signals were essentially bypassed due to the rapid decrease in pressurizer level and the three-second time delay in the sequential starting circuit. The simultaneous charging pump start caused the recirculation of water from the discharge line relief valves to the pump suction lines, heating the water and creating voids in the system. The rapid collapse of voids in the charging system caused several water hammer events, evidenced by significant pressure fluctuations in the discharge header approximately nine minutes after the reactor trip. The operators initial attempts to restore the charging pumps to service were unsuccessful due to voids that remained in the pumps and the charging system piping. The licensees investigation also found that the "quick open" signal for the atmospheric and condenser steam dumps was not initiated as the result of a failed relay.
OTHER ACTIVITIES
[OA]
4OA2 Problem Identification and Resolution
Two findings identified in this inspection report involve the cross-cutting issue of Problem Identification and Resolution.
- A finding discussed in Section 4OA3.1 involves two charging system design changes that were implemented to resolve identified problems and instead adversely affected the charging system's ability to perform its intended design function under anticipated conditions.
- A finding discussed in Section 4OA3.6 concerns the licensee's failure to correct a long standing condenser steam dump control issue. The failure to correct this problem placed an additional burden on control room operators during the March 7 event.
- Observations discussed in Section 4OA3.4 note two examples where the licensee failed to enter operator performance issues into the corrective action process until prompted by the team and one example where operators did not promptly correct a procedural violation after it was discovered.
4OA3 Event Follow-up
.1 Loss of Charging System Capability
a. Inspection Scope
The inspectors reviewed the design of the charging system and the impact of the pressure transient on charging system piping and components. Attachment 1 contains a list of documents reviewed during this inspection.
b. Findings
Introduction:
The inspectors identified a violation of 10 CFR 50, Appendix B, Criterion III, Design Control, for two design changes which adversely affected the charging system and for which post-modification testing was not specified, or performed, to ensure that the charging system could fulfill its function under the conditions for which it was designed. As a result, a charging system pressure transient, component damage, and loss of the charging system function occurred following a reactor trip on March 7.
This issue will be tracked as an unresolved item (URI) pending completion of the significance determination process (SDP).
Description:
The licensee formed an event review team to determine the root cause for the loss of charging which occurred following the reactor trip on March 7. The charging system piping and components were examined and evaluated following the abnormal system pressure transient.
The licensee reviewed several root cause possibilities for the pressure transient including the introduction of air or inadequate venting following prior maintenance activities, hydraulically unstable relief valves, hydrogen gas stripping from Volume Control Tank liquid, and the lifting of charging pump discharge reliefs resulting in recirculation of charging pump liquid. The licensee concluded that the system response was most likely caused by all three relief valves lifting following the simultaneous start of both standby charging pumps with one pump running.
The licensee determined that the initial pressure surge created by the simultaneous pump starts caused the relief valves for all three pumps to open and recirculate water from each pump's discharge line to its suction line. The bellows (internal seals) in all three relief valves were also damaged at this time, allowing water to flow from the relief valve bonnet vent onto the floor of the charging system cubicles. As the charging water was recirculated through the pumps, the water temperature increased due to pump heat and creating voids in the water. The rapid collapse of these voids in the charging system resulted in a water hammer effect. Consequently, approximately nine minutes into the event significant pressure pulsations and fluctuations occurred in the charging system discharge header.
Operators were unable to use the charging system for high pressure RCS makeup for approximately two hours during the March 7 event. Two charging system design changes implemented in 2002 contributed to the charging systems functional failure during the event.
In April 2002, the licensee installed Crosby (JRAK-BS-Type E) relief valves on the discharge lines of all three charging pumps in order to resolve several problems. The previously installed Lonergan relief valves had a history of set point drift problems and failures during as-found set point verification tests. The Crosby relief valves were installed as a "like for like" replacement and were bench tested prior to installation. The inspectors determined that the licensees justification to replace the relief valves as a "like for like" change was insufficient to compare all relevant performance characteristics of the two relief valve designs. Specifically, the licensee failed to identify the need for travel limiting devices on the Crosby relief valves.
In May 2002, the licensee implemented a charging system design change to limit pressurizer level sensing line transient effects on the operation of the charging pumps.
This change installed two time delay filters in the pressurizer level backup charging pump sequential start circuitry. These filters added three-second time delays to the signals for sequential starting of the standby pumps. However, the licensee did not install a filter on the third starting circuit which simultaneously starts the two standby charging pumps. As a result, when pressurizer level dropped rapidly following the reactor trip on March 7, the two sequential standby charging pump start signals were effectively bypassed (due to the three-second time delays) and the third pressurizer level program band deviation signal simultaneously started the two standby charging pumps. The inspectors determined that the licensee failed to implement adequate design controls during modification of the charging pump start circuitry and, failed to specify and perform adequate post-modification testing.
During the April and May 2002 charging system design changes the licensee missed several opportunities to properly test and evaluate the hydraulic and pressure response of the charging system under design basis conditions.
Analysis:
The inspectors determined that this issue was a performance deficiency since the charging system modifications were not properly designed, evaluated, or tested for design conditions.
The performance deficiency represented multiple failures of the design change process and resulted in a failure of the charging system which complicated operator response to a reactor trip. The finding is more than minor because it affected the mitigating systems cornerstone as related to the availability, reliability, and capability of the charging system to respond to initiating events to prevent undesirable circumstances.
This finding was determined to have potential safety significance greater than very low significance because it adversely affected the capability of the charging system to respond to initiating events. This finding will be tracked as an unresolved item pending the completion of the Significance Determination Process.
Enforcement:
10 CFR 50 Appendix B, Criterion III, "Design Control," requires, in part, that design control measures be established and implemented to assure that applicable regulatory requirements and the design basis for structures, systems, and components are correctly translated into specifications, drawings, procedures, and instructions.
Contrary to the above, in April and May of 2002, two design changes were implemented that adversely affected the charging system and for which post-modification testing was not specified, or performed, to ensure that the charging system could fulfill its design function under anticipated conditions. As a result, a charging system pressure transient occurred following the reactor trip on March 7 causing component damage and a loss of the charging systems ability to perform its intended design function.
The significance of this design control issue has not yet been determined. Pending determination of the violations safety significance, this issue will be tracked as an unresolved item (URI). This violation has been entered into the licensees corrective action program as Condition Report (CR) 03-03359. (URI 50-336/03-06-01 Failure to Implement Adequate Design Control and to Perform Adequate Post-Modification Tests for Changes to the Charging System)
.2 Charging System Operability Evaluation
a. Inspection Scope
The inspectors reviewed the adequacy of the licensees restoration of charging system operability for plant restart following the March 7 event. Specifically, the inspectors reviewed the licensee's evaluation for the degraded charging system and components documented in operability determination MP2-043-03, Revision 0 & Revision 1, "Charging System Response With Three Operable/Available Charging Pumps Challenges the Discharge Relief Valves and Consequently the Entire System." In addition, technical evaluation M2-EV-03-0025, "Charging System Engineering Review of March 7, 2003, Loss of Charging Event," and resulting corrective actions associated with the charging system were reviewed by the inspectors. The following related licensee documents were reviewed:
- M2 Design Bases Summary, DBS-2304, "Chemical and Volume Control System"
- ANSI Standard B16.5, Specification 7604-M-290
- Design Specification for Nuclear Piping System
- Technical Specification (TS) Limiting Conditions for Operation (LCO)
The licensee's structural integrity evaluation analyzed the charging system piping and components using an estimated maximum dynamic pressure of 3500 psig. The maximum pressure was estimated based on hydraulic modeling because the peak transient pressure exceeded the range of available instrumentation. The piping components were evaluated with respect to the estimated maximum pressure and temperature.
The inspectors reviewed the following aspects of the licensees operability evaluation for the charging system, through review of plant documentation, interviews with cognizant licensee personnel, and in-plant observations:
- Post-event walkdowns of the charging system inside and outside the containment
- Post-event non-destructive examination of socket welds susceptible to low cycle fatigue
- Structural integrity evaluations for system piping and components
- Repair of the damaged Crosby relief valves and piping socket weld
- Installation of lift stops in the Crosby relief valves
- Reinforcement of socket welds
- Maintenance activities accomplished on all three charging pumps
- Removal of the pressurizer level control signal filter modification
- Post-maintenance/modification testing
- Compensatory measures restricting the number of charging pumps in service/available in standby
b. Findings and Observations
No findings of significance were identified.
.3 Event Causal Factors, Root Causes and Corrective Actions for Loss of Charging
System
a. Inspection Scope
The inspectors reviewed the licensees in-process event investigation activities to determine the root cause of the loss of charging system on March 7, and assess the adequacy of the licensees root cause evaluation. The inspectors also independently assessed the causal factors for the event and the appropriateness of the licensees initial corrective actions. The inspectors reviewed procedures, records, data, condition reports, conducted system walkdowns, and interviewed personnel, including station management.
b. Findings and Observations
No findings of significance were identified.
While no findings were identified, the team observed that the Dominion Event Review Team (ERT) did not consistently probe to a sufficient level of detail to gain a complete understanding of all potential contributing causes for the event. For example, the ERT did not aggressively pursue the reason why post-modification testing was not performed following the two charging system design changes made in 2002. The team also noted that there were delays in gathering some information following the event. For example, key personnel involved in the event were not interviewed for several days. The team did not identify any impact on the completeness of the ERT's evaluation that was attributable to these delays.
.4 Operator Event Response and Follow-up Actions
a. Inspection Scope
The inspection team discussed the operator response noted below with the resident inspectors. The inspection team also reviewed licensee documents, interviewed licensee personnel, and attended several licensee meetings which discussed the event, the event response, and necessary corrective actions. The inspection team conducted these activities at the site during the week of March 12, 2003 and then again during the week of March 24, 2003. In-office reviews were also conducted.
The resident inspectors observed the licensees response to the reactor trip on March 7, which was complicated by charging system and secondary plant problems. The inspectors observed the licensees implementation of emergency operating procedures, as well as the Emergency Plan following the declaration of an Unusual Event (UE). An UE was first declared due to indications and diagnosis of a reactor coolant system (RCS) leak. A second UE entry criteria was later met when the charging system complication prevented operators from completing a plant cooldown to the Hot Shutdown mode within the time required by Technical Specification 3.0.3 (see Section 4OA3.9 of this report).
The inspectors reviewed licensee event notification information, observed several shift briefs during the event, observed the transition to an alternate charging flowpath for RCS makeup, and reviewed the licensees response to the radiological conditions resulting from the event. The inspectors also evaluated the licensees transition to plant cooldown and compliance with applicable cooldown rates.
b. Findings and Observations
Introduction:
A violation of Technical Specification 6.8.1, "Procedures" occurred when operators installed gagging devices on charging pump relief valves without procedural controls or proper authorization.
Description:
Following the reactor trip, control room operators identified that all three charging pumps were running but no flow was reaching the RCS based on available indications. A licensed senior reactor operator (SRO) and a primary equipment operator (PEO) were dispatched to the charging pump cubicles to investigate the problem. In an effort to reseat the relief valves, the SRO directed the PEO to install the relief valve gagging devices. Later in the event, the "C" charging pump was started and run with its discharge relief valve gagging device installed. The licensee has no approved procedure or engineering analysis that supports the use of gagging devices for reseating charging system relief valves or the operation of charging pumps with their discharge relief valves gagged. Additionally, the in-field SRO did not contact the control room to obtain approval for his actions prior to directing the PEO to install the gagging devices.
Analysis:
The inspectors determined that this issue involved a performance deficiency because the charging system design was changed by the operators action to gag the relief valve, without required design controls or procedural guidance. This finding revealed itself to the NRC through discussions with licensee personnel during the NRCs event response activities on March 7.
This finding was more than minor because it affected the human performance and equipment performance attributes of the Mitigating Systems Cornerstone objective.
This finding was considered to have very low safety significance (Green) using NRC Inspection Manual Chapter 0609, Appendix A, SDP Phase 1 screening, because the installation of the gagging devices did not result in damage to, or unavailability of, the charging system.
Enforcement:
TS 6.8.1 requires that the licensee establish, implement, and maintain written procedures as recommended in Regulatory Guide 1.33, "Quality Assurance Program Requirements." Regulatory Guide 1.33 includes procedures for combating emergencies and other significant events, including those associated with a loss of coolant. Millstone station procedures do not address the use of gagging devices to reseat the charging pump relief valves. Contrary to the above, on March 7, operators in the plant installed gagging devices on the charging pump relief valves, without a procedure and without appropriate authorization. The alteration of the charging systems configuration without procedures or authorization is considered a violation of TS 6.8.1. Because this violation is of very low safety significance and has been entered into the licensees corrective action program (CR 03-02598), this violation is being treated as a non-cited violation consistent with Section VI.A of the NRC Enforcement Policy.
(NCV 50-336/03-06-02 Charging Pump Relief Valves Gagged Without Procedures or Authorization)
Additional Team Observations The team made three additional observations regarding the operators response to this event that did not rise to the level of findings. NRC Inspection Procedure 93812, "Special Inspection," states that areas where no findings are identified should be documented in greater detail than is required by NRC Inspection Manual Chapter 0612 due to the nature of special inspections.
- During the Unit 2 cooldown, a control room operator failed to perform a procedural step to turn the safety injection tank injection override selector switch to the "OVERRIDE" position. Although the keys had been inserted into the switches, they were not turned to the OVERRIDE position. The control room operators detected and corrected the error in a short time. However, this error was not documented in the licensee's corrective action program until questions were raised by the team.
- During operation of the charging system using the alternate charging flow path in accordance with OP 2304A, Volume Control Portion of CVCS, operators failed to record all of the required charging system data. The required data is used to support thermal stress analyses on the temperature-sensitive portions of the alternate charging flowpath. After being told of this oversight, the operators did not record the data for approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. However, the inspectors noted that the data is also available from the plant process computer and would therefore still be available for later analyses.
- During attempts to recover the charging pumps, operators did not vent the A Charging Pump in accordance with established venting procedure SP 2663. In addition, operators manipulated the discharge spool piece drain for the "A" Charging pump outside of the requirements of the procedure. These actions could have reduced the chance of operators recovering the pump. However, this was not the most likely reason why the "A" Charging Pump could not be recovered. In addition, the actions taken did not effect the recovery of the other two charging pumps. This deficiency was not documented in the licensee's corrective action program until the issue was raised by the team.
These observations involve minor issues but were considered important from the perspectives of human performance and problem identification. Although these observations should be corrected, they constitute violations of minor significance that are not subject to enforcement action in accordance with Section VI of the NRC's Enforcement Policy.
.5 Operator Response to Indications of Reactor Coolant System (RCS) Leakage
a. Inspection Scope
The inspectors reviewed actions taken by operators in response to indications of increasing RCS leakage into the containment during the plant cooldown on March 7 and 8. The inspectors reviewed event chronology information developed by the licensee, applicable plant process computer data, process radiation monitoring data, and control room operator logs. The inspectors also conducted interviews with operations department personnel on shift during plant cooldown activities. The inspectors compared actions taken by control room operators to requirements contained in the following licensee documents.
- Millstone 2 Technical Specification 3.4.6.2., "Reactor Coolant System Leakage"
- Abnormal Operating Procedure (AOP) 2568, "Reactor Coolant System Leakage," Revision 7
- Millstone Surveillance Procedure (SP) 2675, "Containment Entry for Reactor Coolant System Leakage Investigation"
- Millstone Health Physics Operations Procedure (RPM) 2.7.1, "Entry into Unit 2 Containment"
b. Findings
Introduction:
The inspectors identified a violation of Technical Specification 6.8.1, "Procedures" for the failure of Unit 2 operators to enter the abnormal operating procedure (AOP) for RCS leakage when confronted with plant conditions that were consistent with the applicable AOP entry conditions. The finding was determined to be of very low safety significance (Green) and is being dispositioned as a non-cited violation.
Description:
On March 8, 2003, while performing a cooldown of Unit 2, control room operators received process computer point alarm "SUMP15LK" indicating a rise in containment sump level. Additionally, containment atmosphere process radiation monitors RM 8123A, RM 8123B, RM 8262A, and RM 8262B were all increasing. During this time, the operators quantified the leakage into containment at approximately 1.5 gallons per minute. The operators initially attributed the increase in containment sump level to "expected" condensation encountered during a plant cooldown then later turned their attention to a possible leak from the "C" reactor coolant pump vapor seal.
Regardless, until a containment entry is performed to definitively identify the source of the containment leakage, the leakage should be considered "unidentified" reactor coolant system (RCS) leakage as defined in Millstone 2 Technical Specifications (TS).
AOP 2568, "Reactor Coolant System Leakage," Revision 7, Step 2 lists plant conditions under which the procedure can be entered. These plant conditions include receipt of an alarm on process computer point SUMP15LK as well as receipt of alarms from containment atmosphere process radiation monitors RM 8123A, RM 8123B, RM 8262A, and RM 8262B. Additionally, TS LCO 3.4.6.2, "Reactor Coolant System Leakage,"
establishes a limit for unidentified leakage from the RCS of 1 gallon per minute.
Operators continued to observe alarms on process computer point alarm "SUMP15LK,"
elevated levels on the containment atmosphere process radiation monitors, and unidentified leakage of approximately 1.5 gallons per minute, yet made no entry into AOP 2568 or TS LCO 3.4.6.2. Additionally, no containment entry to identify the source of the leak was made until approximately 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> later. Operations Department personnel stated that a containment entry could not be made any sooner due to a lack of procedural guidance and due to limited Radiation Protection Department resources.
The primary cause of this finding was related to the cross-cutting area of Human Performance. Had the crew entered AOP 2568, the procedure would have directed operators to "log" entry into TS 3.4.6.2. Also, AOP 2568 would have directed operators to enter containment to identify and, if possible, isolate the leakage. AOP 2568 references Millstone Surveillance Procedure (SP) 2675, "Containment Entry for Reactor Coolant System leakage Investigation." SP 2675, in turn, references Millstone Health Physics Operations Procedure (RPM) 2.7.1, "Entry into Unit 2 Containment," which includes guidance for the performance of an "expedited" entry into containment which allows for immediate entry into containment for response to plant conditions requiring prompt operator response, prior to establishing radiological conditions.
Analysis:
The inspectors determined that this finding affected the human performance attribute of the Barrier Integrity Cornerstone objective to provide reasonable assurance that physical design barriers protect the public from radionuclide releases caused by accidents or events. Specifically, the finding constituted a human performance error that reduced the assurance that the RCS barrier would protect the public from radionuclide releases and was therefore more than minor. In accordance with NRC Inspection Manual Chapter 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," the inspectors conducted an SDP Phase 1 screening and determined that an SDP Phase 2 evaluation was required because the performance deficiency was associated with the reactor coolant system barrier. The inspectors completed an SDP Phase 2 evaluation and determined that the finding was of very low safety significance (Green) because it did not increase the likelihood of any initiating events and it did not adversely impact any mitigating equipment.
Enforcement:
TS 6.8.1 requires that the licensee establish, implement, and maintain written procedures as recommended in Regulatory Guide 1.33, "Quality Assurance Program Requirements." Regulatory Guide 1.33 includes procedures for combating emergencies and other significant events, including those associated with a loss of coolant. Millstone Procedure MP-14-OPS-GDL02, "Operations Standards," Revision 7, 1 requires operators to frequently monitor control board indications and take actions as specified in applicable procedures including abnormal operating procedures.
Millstone AOP 2568, "Reactor Coolant System Leak," Revision 7, Paragraph 2 lists entry conditions for which the AOP is to be entered including process computer point "SUMP15LK" in alarm. Contrary to the above, the inspectors identified that process computer point SUMP15LK was in alarm, yet operators made no entry into AOP 2568 to investigate the source of the unidentified leakage. The failure to diagnose and enter the AOP for RCS leakage is considered a violation of TS 6.8.1. This violation is associated with an inspection finding that is characterized to be of very low safety significance and is being treated as a non-cited violation consistent with Section VI.A of the NRC Enforcement Policy. This violation is in the licensees corrective action program as CR 03-03295. (NCV 50-336/03-06-03 Failure To Diagnose And Enter The AOP For RCS Leakage)
.6 Atmospheric Dump Valve and Condenser Dump Valve Control
a. Inspection Scope
The inspectors evaluated the licensees use of the corrective action program to resolve previously identified problems with the atmospheric and condenser dump valves.
Problems with the dump valves created additional complications for the operators during their response to the March 7 event. The inspectors evaluated performance issues with the condenser dump valves including the licensees ongoing troubleshooting and root cause team efforts. The inspection team interviewed licensee staff and reviewed plant control transients and upsets for the previous operating cycle.
b. Findings
Introduction:
The inspectors identified a Green finding for the failure to take adequate corrective actions for long-standing problems with the Unit 2 condenser steam dump control system. Numerous condition reports had been initiated over the previous operating cycle to identify and correct these problems. The unexpected performance of the steam dump valves following the March 7, reactor trip was an event complication that would not have existed had the identified deficiencies been corrected.
Description:
The inspectors identified condition reports on the condenser valve control signal configuration that date as far back as May 15, 2000. Condition Report M2-00-1384, indicates that field wiring and labels did not match design drawings. This discrepancy was discovered during instrument loop calibrations and the resulting CR triggered several action requests (AR) to determine cause, initiate a design change notice (DCN) and, to implement the change notice in the field. The licensee indicated that the work request for the implementation of the DCN was canceled and the planned corrective actions were added to a routine instrument calibration activity. The licensee could not find a record of any post maintenance testing that would demonstrate resolution of this CR.
In April of 2002, when operators were preparing to put the turbine online, the condenser dump valve control signal would not take over control as expected. Operations requested the Instrumentation and Control (I&C) Department to troubleshoot the problem, and I&C technicians removed equipment from the field for calibration. This CR (CR 02-03913) was closed based on a DCN issued by Engineering which was thought to resolve the discrepancies and bring the drawings into agreement with the field conditions. Again, inspectors found no record of any post maintenance or functional testing that could demonstrate resolution of the system performance problem entered into the Corrective Action program. I&C Technician entries in a work package from June of 2002 states that I&C was waiting for conditions to fix the wiring problem on PY-4216 and perform a retest.
Inspectors also identified two CRs that were issued to address performance issues with the response of the condenser dump valves. Each of these CRs was an opportunity to uncover the prior ineffective corrective actions. CR-02-07033, was issued in June of 2002 as a result of condenser dump valve cycling during turbine control valve testing.
Inspectors found that this CR did not result in any additional actions that would determine the cause or restore the equipment to the intended design capability. In August of 2002, the licensee issued CR-02-08188 to address an unplanned entry into a Departure from Nucleate Boiling Technical Specification due to an RCS pressure transient. This CR reported an RCS pressure decrease that was attributed to the unexpected opening of condenser dump valves. This CR specifically asked the question as to whether the steam dump controllers were functioning properly. Inspectors found that the licensee evaluated the pressure transient consequences and initiated actions to increase pressure allowances (operating limits), however, the licensee did not initiate actions to determine the cause or prevent recurrence of the unexpected condenser dump valve response.
The inspection team observed that the condenser dump valve control problems were not resolved despite repeated problems entered into the corrective action program since May of 2000. The Engineering DCN was ineffective and may have perpetuated the problem since the change notice resulted in the issuance of drawings that reflected an incorrect plant configuration. The inspectors observed that these incorrect drawings were the only drawings available for plant staff to validate the configuration following the removal of control modules for calibration. Also, there was no functional test to provide a barrier to discover wire leads that were landed on incorrect terminals. Human errors and drawing errors were not prevented or discovered by the configuration/design control process. The inspection team concluded that the numerous CRs that went to closure without correcting the cause of the deficiency, the failures to investigate causes, and the work order remaining open for nine months with a described plant equipment performance issue, were indicative of several failures of the corrective action process.
Analysis:
The lack of adequate corrective action for the longstanding equipment issues was considered to be more than minor because it adversely affected the equipment performance attribute of the mitigating systems cornerstone objective of ensuring the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. Using Phase 1 of the SDP for Reactor At-Power Situations, the inspectors determined that this finding was of very low safety significance because it did not result in a loss of safety function of the systems.
Enforcement:
There were no violations of NRC regulatory requirements since the condenser steam dump valves are not safety-related. However, the condenser steam dump valve functions have an impact on overall plant risk and the inspection team determined that the licensee was ineffective in taking corrective actions associated with the intended design function of this system. The related inspection issues for this finding were entered into the Millstone corrective action program under CR-03-02395 and CR-03-03083. (FIN 50-336/03-06-04 Inadequate Corrective Actions for Long-Standing Problems with the Unit 2 Condenser Steam Dump Control System)
.7 Radiological Assessment of Event
a. Inspection Scope
The team reviewed the licensees radiological assessment of the March 7 event.
On March 7 liquid from the CVCS system leaked onto the floor of the charging pump cubicles in the auxiliary building. Gaseous radioactive material (noble gases and iodines) from the auxiliary building was released to the environment through the Unit 2 Building Roof Vent. This vent path is equipped with a high efficiency particulate air (HEPA) filter and a radiation monitoring system (RMS). Radiation readings from the RMS (RM-8132 Channels A and B) increased to above normal background levels (but below the RMS alarm setpoint) at shortly after 2:39 p.m. on March 7 and returned to normal background levels at approximately 5:15 p.m. that day.
On March 10, 2003, the licensee commenced the containment purge. Radioactive materials (noble gases and iodines) in the containment were released through HEPA and charcoal beds to the Unit 1 Main Stack. The total amount of released radioactive material was quantified, as required by the Offsite Dose Calculation Manual (ODCM)and the licensees procedures.
The licensee's quantification of the total amount of radioactive materials released during and subsequent to the event was inspected to ensure that the releases were characterized as required by the ODCM and the licensees procedures. Attachment 1 contains a list of documents reviewed during this inspection.
The team performed an independent verification of the licensees capability for calculating projected doses to the public resulting from discharges of radioactive gases.
The team used the NRC PCDose computer code to compare results with those developed by Dominion with its DOSAIR computer code. The team verified that both result sets were consistent and that the projected doses to the public were a very small fraction (approximately 1E-4) of annual regulatory limits.
b. Findings
No findings of significance were identified.
The team observed that the licensees calculated dose result was in good agreement with the teams independent evaluation. Projected doses to the public were a small fraction of regulatory limits as outlined in the ODCM. The licensees projected gamma air dose was 8.6E-4 mrad as compared to an annual limit of 20 mrads/site, beta air dose was 1.2E-3 mrad as compared to a limit of 40 mrads/site, and the maximum organ dose was 6.3E-3 mrem as compared to an annual limit of 30 mrem/site.
.8 Risk Significance of the Event
The team conducted an initiating event assessment and concluded that the risk of this event was very low. This risk assessment was based upon the following assumptions.
C The NRCs standardized plant analysis risk (SPAR) model for Millstone Unit 2 was used for this analysis. The model was updated to reflect the licensees operating experience and procedures.
C The SPAR model was also revised to account for the maintenance configuration of plant equipment. At the time of the event, all of the mitigating equipment that is credited in the SPAR model was available.
C The charging system was not capable of supporting once through core cooling.
Recovery of the charging system was not credited in this analysis.
The dominant accident sequences for this event were as follows:
CCDP Core Damage Sequence Description 1.4E-7 C IE - Transient C Reactor protection system fails to shutdown the reactor C Failure to prevent over pressure of the reactor coolant system 7.5E-8 C IE - Transient C Failure of the main feedwater system C Failure of the auxiliary feedwater system C Operator failure to depressurize and initiate condensate injection C Failure of once through core cooling 5.3E-8 C IE - Transient C Reactor protection system fails to shutdown the reactor C Failure of emergency boration The team concluded that the conditional core damage probability (CCDP) for this event was approximately 2.8E-7. This indicates that the risk associated with this event was very low.
.9 Technical Specification 3.0.3 Cooldown Delayed Due to Charging System Problems
Following the loss of the charging system, the licensee entered TS 3.0.3 based on inability to meet several charging system LCO requirements with the plant in Hot Standby (TS 3.1.2.2; TS 3.1.2.4; TS 3.5.2.d). Because TS 3.0.3 was entered with the unit in Hot Standby, the licensee was required to place the plant in Hot Shutdown within the following six hours. However, due to the charging system complications, operators were not able to place Unit 2 in Hot Shutdown until approximately nine hours later. As a result, a second Notification of Unusual Event was made on March 7 based on exceeding a shutdown LCO time limit. This violation of TS 3.0.3 did not, by itself, increase the risk associated with the March 7 event. Dominion is required by 10CFR50.73 to formally report this occurrence in a Licensee Event Report (LER). The TS 3.0.3 violation will be dispositioned by the NRC in conjunction with the routine review of the LER.
4OA4 Cross-Cutting Observations and Findings
Two findings identified in this inspection report involve the cross-cutting issue of Human Performance.
- A finding discussed in Section 4OA3.4 involves operators in the field changing the charging system design by installing gagging devices on relief valves, without required design controls or procedural guidance.
- A finding discussed in Section 4OA3.5 involves the failure of operators to implement the actions of AOP 2568, "Reactor Coolant System Leakage" when plant conditions met the procedure entry conditions.
4OA6 Meetings
On March 28, 2003, the NRC Special Inspection Team met with Mr. Alan Price and other members of licensee management to debrief them on the preliminary results of the Special Inspection to date.
On May 16, 2003, the NRC team presented the inspection results to Mr. Alan Price and other members of licensee management. The inspectors asked the licensee whether any material examined during the inspection should be considered proprietary. No proprietary information was identified.
IR 50-336/03-
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee Personnel
A. Price Site Vice President
W. Bellows IST Program Engineer
J. Bergin Unit 2 Training Supervisor
A. Briggs System Engineer
- D. Dodson Acting Manager, Licensing
D. Fredricks Licensing Engineer
- W. Gorman Supervisor, Nuclear Maintenance
- R. Griffin Manager, Radiological Protection and Chemistry
- W. Hoffner Manager, Nuclear Operations
R. Hoffman Nuclear Maintenance
- C. Janus Maintenance Rule Coordinator, Site Engineering
- A. Jordan Director, Nuclear Engineering
- M. Kai Supervisor, Nuclear Engineering
- J. Kunze Supervisor, Nuclear Shifts Ops/Unit 2
- P. LHeureux Supervisor, Nuclear Engineering
- M. Marino Supervisor, Nuclear Engineering
- C. Maxson Manager, Nuclear Engineering
- S. Sarver Director, Nuclear Station Operations and Maintenance
- S. Scace Director, Nuclear Station Safety and Licensing
R. Schaufler Mechanical Systems Engineer
- V. Wessling Supervisor, Nuclear Corrective Actions
NRC personnel
- S. M. Schneider Senior Resident Inspector, Team Leader
- A. J. Blamey Senior Operations Engineer, Division of Reactor Safety (DRS)
- E. W. Cobey Senior Reactor Analyst, DRS [in-office]
- D. A. Galloway Supervising Radiation Control Physicist, State of Connecticut, Department
of Environmental Protection, Division of Radiation
IR 50-336/03-06 Attachment 1
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened During this Inspection 50-336/03-06-01 URI Failure to Perform Adequate Post-modification Tests of Design Changes to the Charging System (4OA3.1)
Opened and Closed During this Inspection 50-336/03-06-02 NCV Charging Pump Relief Valves Gagged Without Procedures or Authorization (4OA3.4)
50-336/03-06-03 NCV Failure to Diagnose and Enter the AOP For RCS Leakage (4OA3.5)
50-336/03-06-04 FIN Inadequate Corrective Actions for Long-Standing Problems with Condenser Steam Dump Control System (4OA3.6)