IR 05000397/1996012
| ML17292A437 | |
| Person / Time | |
|---|---|
| Site: | Columbia  |
| Issue date: | 09/03/1996 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML17292A436 | List: |
| References | |
| 50-397-96-12, NUDOCS 9609090392 | |
| Download: ML17292A437 (14) | |
Text
ENCLOSURE U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket No.:
License No.:
Report No.:
Licensee:
Facility:
Location:
Dates:
Inspectors:
Approved By:
50-397 NPF-21 50-397/96-1 2 Washington Public Power Supply System Washington Nuclear Project-2 3000 George Washington Way Richland, Washington 99352 June 23 through August 3, 1996 R. C. Barr, Senior Resident Inspector G. D. Replogle, Resident Inspector H. J. Wong, Chief, Project Branch E Division of Reactor Projects ATTACHMENT:
Attachment 1:
Partial List of Persons Contacted List of Inspection Procedures Used List of Items Opened, Closed, and Discussed List of Acronyms 9609090392 960903 PDR ADOCK 05000397
EXECUTIVE SUMMARY Washington Nuclear Project-2 NRC Inspection Report 50-397/96-12 This routine, announced inspection included aspects of licensee operations, engineering, maintenance, and plant support.
The report covers a 6-week period of resident inspection.
~Oeretinne A programming error in the digital feedwater system software, ineffective validation testing after revising the digital feedwater program, an operator knowledge weakness, and an inadequate pretest briefing contributed to conditions that resulted in a reactor scram on June 24, 1996 (Section 01.2).
Licensee assessment of the June 24, 1996, reactor scram was narrowly focused, which resulted in the failure to identify important contributors to the scram (Section 01.2).
Maintenance Maintenance performance was generally acceptable (Section M1.1).
During disassembly of Valve FDR-V-3, a craftsman demonstrated poor radiation worker practices (Section M1.4).
During disassembly of Valve FDR-V-3, workers failed to follow work instructions which required complete valve disassembly (Section M1.4).
Entnineering The digital feedwater testing program continued without rigorous review and understanding of the system responses in spite of several reactor water level transients, indicating a poor questioning attitude and safety focus (Section E1.1).
The problems experienced thus far during the digital feedwater control system testing indicate weaknesses in the preinstallation test validation program (Section E1.1).
Report Details The inspection period began on June 23, 1996, with the rea~tor at approximately 23 percent reactor power.
On June 24, operators manually scrammed the reactor due to feedwater control problems.
On June 27, the reactor was restarted and, subsequently, shut down due to an error in calculating the estimated critical rod position.
The reactor was restarted on June 29, and the licensee recommenced power ascension and testing of the digital feedwater and adjustable speed drive modifications.
On July 20, while at 68 percent power, the plant experienced a short period of 15 percent power transient due to an error associated with adjustable speed drive testing.
The inspection period concluded with the reactor at 60 percent power and postmodification testing on hold awaiting implementation of corrective actions associated with the aforementioned errors.
I. Operations
Conduct of Operations 01.1 General Comments 71707 Using Inspection Procedure 71707, the inspectors frequently reviewed ongoing plant operations.
Inspectors found that weak operator understanding of the feedwater pump controls in conjunction with a computer programming error in the digital feedwater control software contributed to a reactor scram.
Specific events and observations are detailed in the following sections.
01.2 Reactor Scram a. Ins ection Sco e 92901 93702 On June 24, 1996, during digital feedwater control system testing and in response to an unexpected reactor vessel water level decrease, operators manually scrammed the reactor from 29 percent power.
An inspector responded to the control room, observed the operators'esponse to the event, reviewed the licensee's root cause determination, and performed an independent assessment of the event.
b..Observations and Findin s At the time of the scram, operators and engineers were testing the digital feedwater control system modification, which was installed during Refueling Outage R11
~ To evaluate system response, the test program included manually-induced level changes.
The level changes were generated using the feedwater control system software.
The test intent was to insert a 6-inch step-change in reactor water level with level starting at 42 inches.
However, due to a programming error in the software, three 6-inch water level changes were initiated in quick succession.
As required by the test procedure, the reactor operator (RO), to recover reactor water level, shifted from automatic to manual control on the feedwater pump controller when reactor water level decreased to 28 inches.
However, in spite of this action,
-2-reactor water level decreased to 15 inches, a half-scram occurred on low water level, and the RO manually scrammed the reactor, as required by the test procedure.
Reactor water level decreased to -15 inches during the transient following the scram.
The licensee assembled an Incident Review Board, initiated Problem Evaluation Request (PER) 296-0516, and reported the event to the NRC per 10 CFR 50.72.
On July 24, 1996, the licensee submitted Licensee Event Report 96-004, describing the event, its causes, and corrective actions.
Licensee Conclusions:
The licensee determined that a manufacturer's programming error caused the event.
The error was introduced in the digital feedwater software when contract engineers attempted to resolve a previous, similar problem with unexpected repetitive test signals being rapidly inserted.
In modifying the software, the original problem was corrected; however, a different problem was introduced.
Vendor and licensee validation testing were insufficient to identify the problem.
The licensee considered the response of the operators to the event to be excellent and noted that the digital feedwater system responded as expected in manual control.
NRC Assessment:
The inspectors considered the licensee's evaluation was narrow in scope because it failed to identify all the causes of the event and did not implement sufficient corrective actions based on this and previously identified digital feedwater system problems.
The inspectors noted that the licensee's evaluation failed to address why the operator actions of transferring to manual control were ineffective in recovering reactor water level and avoiding the reactor scram.
The inspectors found that the RO had an inadequate understanding of the modified feedwater pump control system.
Specifically, the RO did not completely understand that the responsiveness while in the slow speed option had been reduced as a result of previous testing.
No training had been given the operators on this change.
The inspectors found that, when the malfunction occurred, the RO utilized the slow speed option to recover level until very late in the transient.
If the RO had utilized the fast speed option earlier, he likely would have succeeded in recovering reactor water level and avoided the reactor scram.
Had the pretest briefing discussed the slow and fast speed options of the feedwater control system and the change that had been made, the operator may have responded differently and a reactor scram may have been avoided.
The licensee did not recommend additional software validation as a corrective action.
The inspectors noted that there had been previous programming-related errors, discussed later in this report, which had resulted in operational anomalies.
c. Conclusions The licensee's evaluation of the reactor scram was narrow in scope.
The evaluation failed to identify all the causes of the event and to implement sufficient corrective
-3-actions based on this and previously identified digital feedwater system problems.
Insufficient operator knowledge and an inadequate pretest briefing significantly contributed to this event.
01.3 Reactor Shutdown Due to an Error in the Calculation of the Estimated Critical Position On June 27, operators restarted and, subsequently, shut down the reactor due to an error in calculating an estimated critical rod position.
The NRC is conducting a special inspection of this event.
The inspection will be documented in NRC Inspection Report 50-397/96-1 6.
01.4 Unex ected Power Transient Durin Ad ustable S eed Drive Testin On July 20, while at 68 percent power, the plant experienced an unplanned, short-duration 15 percent power transient due to an error associated with adjustable speed drive testing.
The NRC is conducting a special inspection of this event.
The inspection will be documented in NRC Inspection Report 50-397/96-16.
Operational Status of Facilities and Equipment 02.1 En ineered Safet Feature S stem Walkdowns 71707 The inspectors used Inspection Procedure 71707 to walk down accessible portions of the following ESF systems:
~
High Pressure Core Spray (HPCS)
~
Emergency Diesel Generators (EDGs)
1 and 2
~
HPCS Diesel Generator
~
HPCS Service Water System
~
Floor Drains Radioactive (FDR) System Containment Isolation Valves Equipment operability, material condition, and housekeeping were acceptable.
Several minor discrepancies were brought to the licensee's attention and were corrected.
II. Maintenance M1 Conduct of Maintenance M1.1 General Comments a. Ins ection Sco e 62703 The inspectors observed all or portions of the following work activities:
~
Plant Procedure Manual (PPM) 7.4.5.1.11:
HPCS System Operability Test
~
WOT BVD901: FDR-V-3 Valve Repair
~
PPM 7.4.0.5.6B:
FDR-V-3/4 Stroke Time Test
~
PPM 7.4.6.1.2.4:
FDR-V-3/4 Local Leak Rate Test (LLRT)
b. Observations and Findin s Generally, overall maintenance was performed acceptably.
However, the licensee and the inspectors identified a number of examples when surveillance requirements were not met and operational mode changes were made with safety equipment inoperable.
The specific issues are documented in the following sections.
M1.2 In-Service Testin of Valves FDR-V-'3 and FDR-V-4 a. Ins ection Sco e 37551 61726 The inspectors utilized Inspection Procedures 37551 and 61726 to evaluate compliance with the ASME Code and Technical Specifications regarding the testing of Valves FDR-V-3 and FDR-V-4, containment isolation valves in the leakage monitoring line.
On July 27, the inspector observed surveillance testing of the valves.
b. Observations and Findin s On January 19, 1996, Valve FDR-V-4 failed to close during the ASME stroke time test, as documented in PER 296-0045.
The inspector noted that the PER did not contain all of the information that was required by ASME/ANSI OM Code, OMa-1988 Addenda.
Subsequently, the licensee provided the inspectors with the failed test procedure and data that included the required information.
The licensee also provided the inspectors with the. ended data for Valves FDR-V-3 and FDR-V-4. The inspectors noted that the trend data did not include the failure of Valve FDR-V-4 to close on January 19, 1996.
The licensee indicated that the previous trending software did not allow entry of a valve's failure to stroke closed.
The program would only accept a finite value for stroke time. The licensee stated that the trending software was in the process of being replaced and the new trending software would permit trending these types of failures.
The licensee indicated the PER system provided for the documentation of the failure. The inspectors noted that this method of trending was not fully effective, since it did not integrate the stroke time data and the failures so that a determination could be made if their was a correlation between stroke time and failures.
On July 27, 1996, the inspector observed stroke time tests and LLRTs performed on Valves FDR-V-3 and FDR-V-4. The licensee performed more frequent testing due to operational problems previously observed with both valves.
The inspector observed
-5-that the sequence of testing may not be optimal for evaluating valve performance.
Specifically, the licensee performed open and closed stroke time testing prior to performing the LLRTs. This method of testing, although adequate for stroke time testing, placed into question the validity of the LLRT results, since the valves were cycled before leakage measurements were taken, potentially preconditioning the LLRTs. A more appropriate method of testing would have been to stroke the valve closed, perform the LLRT, and then perform the open stroke time testing.
c. Conclusions The inspectors identified an instance where the licensee had not been effectively trending failures of valves to stroke in the IST program.
The licensee plans to correct this problem.
Testing of Valves FDR-V-3 and FDR-V-4 for stroke time and leak rate could have been sequenced differently to provide improved assurance of operability.
M1.3 WOT BVD901 FDR-V-3 Valve Re air a. Ins ection Sco e 62703 On July 16, the inspector observed the disassembly, inspection, and repair of containment isolation Valve FDR-V-3. The work was initiated after the valve failed stroke time testing on July 6 and LLRT on July 12, 1996.
b. Observations and Findin s The inspector observed that a craftsman did not exercise good radiation work practices.
The inspector observed that the worker frequently touched scaffolding and other structures outside the contamination zone, in spite of the valve being considered contaminated.
As the job progressed, the health physics technician (HPT)
cautioned the worker, which resulted in improved performance.
After valve reassembly, the HPT surveyed the areas the worker had touched and verified contaminatiori was not spread.
The craftsman removed the valve bonnet, visually inspected the valve internals, and identified no abnormalities.
The inspector noted that the craftsman had not completely disassembled the valve, as required by the procedure and, therefore, most of the internals could not be seen.
The inspector questioned the system engineer about the change in job scope.
The engineer stated he was concerned about maintaining the integrity of the valve seating surfaces since there were no replacement parts on site.
The system engineer also explained that there was a large amount of water in the piping upstream of the valve and they had not prepared a
contamination zone or water collection device for the work. The failure to properly prepare the work site was indicative of poor coordination between the maintenance and health physics organization Prior to the inspector raising a concern about following the maintenance work instructions, maintenance management independently identified this problem in PER 296-0584.
Corrective actions included counselling the involved individuals regarding procedure compliance.
The failure to adhere to the procedure was a violation of Technical Specification 6.8.1, but this licensee-identified and corrected violation is being treated as a noncited violation, consistent with Section Vll of the NRC Enforcement Policy (NCV 50-397/9612-01).
After the valve was reassembled, it was retested and again failed the LLRT. In response to the failure, the valve was completely disassembled and a large amount of corrosion products and dirt was found on the valve seating surfaces.
The valve was cleaned and reassembled, passed subsequent testing, and was declared operable.
c.
Conclusions During disassembly of Valve FDR-V-3, a craftsman demonstrated poor radiation worker practices and workers failed to follow work instructions.
M1.4 Surveillance Testin and Mode Chan es During the last two inspection periods, the licensee and the inspectors identified a number of examples when surveillance requirements were not met and operational mode changes were made with safety equipment inoperable.
The NRC is conducting a special inspection associated with these events.
The inspection will be documented in NRC Inspection Report 50-397/96-19.
III. En ineerin E1 Conduct of Engineering E1.1 Feedwater Transients a. Ins ection Sco e 37551 71711 92903 Several abnormal feedwater system transients occurred during testing and adjustment of the digital feedwater control system.
The inspectors investigated the transients and discussed the issues with engineering staff.
b. Observations and Findin s On July 2, the plant was at 63 percent power.
Operators were changing reactor feedwater Pump A control from automatic to manual when feedpump speed unexpectedly decreased by 100 rpm, as documented in PER 296-0541.
Operators then returned the pump to automatic control and a 1300 rpm speed drop occurred.
Reactor water level decreased from 36 to 25 inches before recovering to the normal
-7-level.
The licensee stopped testing of the digital feedwater control system until the problem could be resolved.
Subsequently, the vendor isolated the problem in the feedwater logic control system and made repairs.
On July 17, the plant was at approximately 65 percent power and operators were reducing speed on feedwater Pump B in preparation for removing the pump from service.
At a flow rate of approximately 1500 gallons per minute, the discharge check valve shut as documented in PER 296-0569.
The feedwater control system increased flow with feedwater Pump A to compensate for the decreased flow due to the check valve shutting; however, the digital feedwater control system responded sluggishly, resulting in a reactor level decrease of 8 inches (to 28 inches) before returning to the normal level ~
Engineering determined that operators had properly attempted to remove the pump from service and further stated that the system responded as expected.
Engineering recommended that the test program continue.
Operations and plant management expressed a concern regarding the responsiveness of the system.
On July 18, another unexpected transient occured, which is documented in PER 296-0572. At 65 percent power, feedwater Pump B was on the minimum flow line when operators tripped the pump.
Subsequently, level increased by 5 inches and then returned to normal.
Although the system response again appeared sluggish, engineers concluded that the system had responded as expected and that there were no problems.
NRC Investigation:
Following the July 17 and 18 transients, the inspector met with the engineering staff and expressed concern regarding the occurrences.
Specifically, the inspectors were concerned that, based on recent testing, the feedwater control system may not meet the original design basis.
Specifically, the system was designed to maintain reactor water level above 13 inches to preclude a reactor scram on low reactor water level upon the loss of one reactor feedwater pump.
The observed system responses cast doubt on the ability of the system to meet this design requirement.
In the discussion, the inspector learned that the engineering staff had not reviewed past instances where feedwater pumps were removed from service 'to determine if similar transients had previously occurred.
In response to the inspector's questions, the licensee reviewed the most recent instance where a feedwater pump was removed from service and noted that a transient did not occur.
Based on this information, the inspector questioned the licensee's conclusion that the system response was as expected.
As part of the continuing evaluations of system response, engineers identified an abnormal system response around 60 percent power.
When just below 60 percent power, the system responded as it had in the past with level oscillations of less than 1 inch.
However, slightly above 60 percent power, the period and magnitude of the oscillations were significantly greater.
The engineers consulted with the vendor of the digital feedwater control system regarding this observation.
The vendor determined that the wrong gain configuration may have been selected for the
-8-governor valve control logic. When on a single feedwater pump, at greater than 60 percent power, the system would respond more slowly than expected and this caused the increased oscillations that the engineers observed.
This problem likely caused the two level transients that were observed on July 17 and 18. At the end of the inspection period, the licensee had not determined whether the problem needed to be corrected.
The licensee expressed concern that much of the feedwater control system testing would have to be repeated if the gain was changed.
The licensee was evaluating the impact of the previously selected gain.
This is an inspection followup item pending further NRC review of the licensee's decision (IFI 50-397/9612-02).
After this inspection concluded, additional problems occurred during digital feedwater testing and the licensee began a complete review of the digital feedwater system design.
C.
Conclusions Personnel involved with the testing and assessment of the digital feedwater system lacked a questioning attitude and had a poor safety focus.
The digital feedwater testing program continued without rigorous review and understanding of the system responses in spite of several abnormal reactor water level transients.
The problems experienced thus far during the digital feedwater control system indicate weaknesses in the preinstallation test validation program.
The licensee is performing a reverification of the digital feedwater design as a result of the problems encountered thus far during testing.
E8 Miscellaneous Engineering Issues (92903)
E8.1 0 en Unresolved Item 50-397 9608-02: prewetting main steam isolation valves (MSIVs) before testing.
This item was opened after the inspectors identified that IVISIVinternals were being wetted when the valves were stroked prior to LLRT.
During this inspection period, the licensee provided technical justification to support this practice.
The justification included a written recommendation from the valve manufacturer and a page from a General Electric (GE) operating procedure.
Both documents indicated that the valves should be wetted before stroking.
The inspectors contacted the valve vendor and a representative from GE to discuss the recommendations.
The valve vendor stated that the recommendation was made to minimize the potential for valve damage.
However, the vendor acknowledged that they had not considered the potential effects on LLRT (inappropriate lubrication of valve parts or wetting of seating surfaces).
The GE representative also acknowledged that their operational procedure required wetting the valves prior to stroking, but GE had not performed a study on the potential impact on LLRT either.
He went on to state, however, that GE would probably recommend taking additional precautions to minimize the effects of wetting, such as blowing the lines down with high pressure air or allowing the valves time to dry out.
The GE representative commented that he had discussed this issue previously with the licensee and had offered to prepare a recommendation for them, which the licensee decline The inspectors will review the licensee's justification with personnel in NRR to determine the acceptability of the licensee's practice.
This item will remain open pending completion of the NRC evaluation.
E8.2 Closed Unresolved Item 50-397/95201-01:
EDG start failures.
This item was opened to review the licensee's rationale for concluding that some EDG failures to start and connect to its electrical bus were not characterized as valid failures as described in Regulatory Guide (RG) 1.108.
The inspectors reviewed the licensee's analysis of the last 2 years of EDG start failures.
Of specific concern was the ability of the EDG breaker to close following a loss of offsite power upon the failure of the Woodward govenor or failure of the reverse power relay.
The inspectors reviewed each of these scenarios with the licensee and found that, if these failures had occurred, the EDG breaker would have closed onto a deenergized safety bus.
Based on this inspection, the inspectors co'ncluded that the licensee properly characterized each failure with respect to RG 1.108.
While assessing this issue, the inspectors identified that the licensee had incorrectly determined the root cause for two failures when an EDG did not automatically synchronize to the electrical distribution system.
Initially the licensee determined the root cause to be incomplete engagement of contacts; however, due to the inspectors'uestioning, the licensee determined the breaker tripped on reverse power.
The licensee plans to review the setpoint for actuation of the reverse power relay.
The actuation setpoint of the reverse power relay is not a safety function since the relay is bypassed during a loss-of-coolant accident.
V. IVlana ement IVleetin s X1 Exit Meeting Summary The inspectors presented the inspection results to members of licensee management at the conclusion of the inspection on August 20, 1996.
The licensee acknowledged the findings presented.
The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary.
No proprietary information was identifie Licensee PARTIAL LIST OF PERSONS CONTACTED P. Bemis, Vice President for Nuclear Operations L. Fernandez, Licensing Manager G. Smith, Plant General Manager A. Langdon, Acting Operations Manager J. Swailes, Engineering Director D. Swank, Regulatory and Industrial Affairs Manager R. Webring, Vice President Operations Support NRC T. Colburn, Senior Project Manager, NRR INSPECTION PROCEDURES USED IP 37551: Onsite Engineering IP 61726: Surveillance Observations IP 62703: Maintenance Observations IP 71707: Plant Operations IP 71711: Plant Startup from Refueling IP 92901: Followup - Operations IP 92902: Followup - Engineering IP 92903: Followup - Maintenance ITEMS OPENED, CLOSED, AND DISCUSSED
~Oened 50-397/961 2-01 50-397/961 2-02 NCV failure to adhere to maintenance work instructions IFI feedwater control system's ability to meet design requirements Closed 50-397/95201-01 URI emergency diesel generator start failures Discussed 50-397/9608-02 URI prewetting MSIVs before testing
-2-LIST OF ACRONYMS USED FDR GE HPCS IFI LLRT MSIV NCV NRC PER PPM RO floor drains radioactive General Electric high pressure core spray inspection followup item local leak rate test (testing)
main steam isolation valve noncited violation U.S. Nuclear Regulatory Commission problem evaluation request plant procedure manual reactor operator