IR 05000410/1988001
| ML17055D659 | |
| Person / Time | |
|---|---|
| Site: | Nine Mile Point  |
| Issue date: | 03/04/1988 |
| From: | Meyer G, Wenzinger E NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML17055D658 | List: |
| References | |
| 50-410-88-01, 50-410-88-1, NUDOCS 8803150003 | |
| Download: ML17055D659 (40) | |
Text
0 U.S.
NUCLEAR REGULATORY COMMISSION
REGION I
Report No.
Docket No.
License No.
Licensee:
50"410/88-01 50-410 NPF-69 Niagara Mohawk Power Corporation 301 Plainfield Road Syracuse, New York 13212 Faci 1 ity:
Location:
Dates:
Nine Mile Point Unit 2 Oswego, New York January
24, 1988, Team Leader:
E. Wenzinger, Chief, Projects Br. 2, RI Members:
M. Haughey, Project Manager, NRR A. Howe, Senior Operations Engineer, RI L. Lois, Nuclear Reactor Engineer, NRR H. Ornstein, Senior Reactor Systems Engineer, AEOD Reviewed by:
. Meyer, Pro ct Engineer, RI Date Approved by:
. Wenzinger, Chic
, Pr sects Br. 2, RI ate An Augmented Inspection Team (AIT) reviewed the causes, safety implications, and adequacy of operator actions for the January 20, 1988 reactor scram due to loss of feedwater and the subsequent reactor vessel overfill.
The inspection results are discussed in the Executive Summary (Section 1).
The team identified corrective actions needed prior to restar ting the reactor (Section 6 ~ 1) and corrective actions to be addressed in the written report to be submitted by Niagara Mohawk within 30 days of restarting the reactor (Section 6.2).
No violations were identified.
8803i50003 880308 PDR ADOCK 050004i0
Table of Contents 1.
EXECUTIVE SUMMARY.
2.
BACKGROUND, 3.
SEQUENCE OF EVENTS........................
............
~.....
4.
EVALUATION OF EQUIPMENT AND DESIGN.................
4.1 4.2 4.3 4.4 Overfill into Main Steam Lines...................
Feedwater Control Valves Containment Isolation Instrumentation.
Effect of Loss of Instrument Air....
8
10 5.
EVALUATION OF HUMAN FACTORS
6.
5.1 Isolation of Instrument Air System...........'....
5.2 Control of Level by Licensed Operators.....,.....
5.2. 1 Manual Control of Master Feedwater Controlle 5.2.2 Operator Cognizance of Level During Overfill 5.2.3 Lack of Confirmation of Closing of Valves...
5.2.4 Tripping of Condensate Booster Pumps,.......
5.3 Procedure Adequacy.
5.4 NRC Notification..
5.5 Feedback of Operating Experience.
CORRECTIVE ACTION SUMMARY.....
13
13
15
16
~
~
~
~
~
~
~
~
~
~
r
~
~
~
~
~
~
~
~
~
~
~
~
6. 1 Corrective Actions Prior to Restart.............
6.2 Additional Corrective Actions...
17 7.
CONCLUSIONS AND FINDINGS
Enclosures:
1.
Confirmatory Action Letter dated January 20, 1988 2.
Augmented Inspection Team (AIT) Charter dated January 21, 1988 3.
EXECUTIVE SUMMARY On January 20, 1988, the Nine Mile Point Unit 2 reactor scrammed from 42% power due to a total loss of feedwater, and subsequently, the reactor vessel was overfilled and water filled the main steam lines.
The event was initiated by a personnel error; a non-licensed operator improperly isolated an instrument air filter.
The decreasing instrument air pressure caused feedwater minimum flow valves to fail open and resulted in the tripping of the-feed pumps and the total loss of feedwater.
The loss of feedwater caused a rapidly decreasing reactor vessel water level, which scrammed the reactor and initiated the Reactor Core Isolation Cooling (RCIC) and High Pressure Core Spray (HPCS)
Systems to automatically inject water.
These systems returned water level to normal ranges within four minutes of the scram.
Later, the non-licensed operator recognized his error and reopened the filter.
This precipatated the second phase of the event, when feedwater began reinjecting.
The inadvertent return of feedwater injection went undetected by the control room operators for approximately seven minutes, during which time vessel level rose to the main steam lines and water filled the steam lines.
When the operators recognized the high level, they terminated the feedwater injection, concluding the event.
The responses of the equipment and the operators were as expected during the loss of feedwater phase.
The second phase of the event (vessel overfill) was complicated by a unique circuit characteristic in the manual control circuit of the feed control valves which combined with a change in valves'ockup setpoints and locked up the feed control valves at nearly full open.
The control room operator that had attempted to close the valves did not recognize that the valves had locked up open and that feedwater continued to flow to the vessel.
After the event Niagara Mohawk found that some containment isolation system setpoints had been misset but were within their Technical Specification allowable values.
On January 21 Region I issued a Confirmatory Action Letter, which documented Niagara Mohawk's agreement to remain shutdown unti 1 Region I authorization had been received to restart and to submit a written report of the event within 30 days of restarting the reactor.
The Augmented Inspection Team (AIT) arrived at the site on January 21 and completed its inspection on January 24.
As part of the AIT's findings, Niagara Mohawk committed to complete the following prior to restart:
A.
Provide a written analysis of the stresses experienced by the vessel, steam line nozzles and steam lines as a result of the overfill transien B.
Modify the feedwater lockup circuit or recalibrate the setpoint using a revised procedure as appropriate.
C.
Correct the setpoint reference values and recalibrate the Level
and Level 2 trip functions for containment isolation on low vessel water level.
D.
Review operating procedures and EOPs for the following conditions, revise the procedures as necessary, and train the operators on the revised procedures.
a.
Low vessel level b.
Hi vessel level c.
Loss of instrument air (full or partial)
There were no radiological consequences.
No violations were identified.
On February 1,
1988, Region I authorized restarting NMP-2 based on satisfactory completion of the above items.
Additional corrective action items listed in Section 6.2 should be addressed in the licensee'
written report of this event.
2.
BACKGROUND Nine Mile Point Unit 2 (NMP-2)- is a General Electric boiling water reactor (BWR-5) with a Mark II primary containment.
The plant is licensed to the Niagara Mohawk Power Corporation and has a design electrical output of 1080 MWe.
NMP-2 received an'initial operating license on October 31, 1986 and a full power operating license on July 2,
1987.
Reactor operations subsequent to full power license issuance have been directed toward power ascension testing.
The highest power achieved up until the January 20, 1988 event had been 96% power.
On the morning of January 20, 1988, testing was in progress in Test Condition 5 involving reactor natural circulation, and the reactor recirculation pumps were not in service.
Power had been approximately 60%, but due to problems with a feedwater heater drain valve and a
condensate pump discharge check valve, power was reduced to 42% at 7 a.m..
At 9:45 a.m. the reactor scram occurred from this power.
The scram was reported to the NRC Operations Center at 10:27 a.m..
After recovering from the scram NMP-2 entered into a planned seven day outage one day early.
During NRC followup on the event it became apparent, that the event had involved overfilling of the vessel and filling of the main steam lines and that the feedwater control valves had malfunctioned.
Following discussions between the resident inspectors, Region I management, and NRR management, the NRC decided to review the event immediately with an Augmented Inspection Team (AIT).
On January 20 William Kane, Director, Di'vision of Reactor Projects, Region I initiated a telephone conversation with Thomas Lempges, Vice President, Niagara Mohawk, in
which Mr. Kane informed Mr. Lempges that an Augmented Inspection Team would arrive onsite on January 21 to evaluate the event.
During this conversation, Mr. Lempges agreed to obtain the authorization of the Regional Administrator prior to restarting the reactor and to submit a
written report on the event withing 30 days following restart.
A Confirmatory Action Letter dated January 21, 1988 (Enclosure 1) was issued to document the above.
The AIT arrived onsite on January 21 and was composed of a Region I operator license examiner, the NRR Project Manager for NMP-2, an NRR nuclear engineer, and an AEOD systems engineer with experience on instrument air systems.
The team was led by a Branch Chief from Division of Reactor Projects-,
Region I.
An inspection charter dated January 22, 1988 (Enclosure 2) was issued by the Regional Administrator to establish the inspection team's objectives.
The inspection's results were presented to Niagara Mohawk during the inspection and at an exit meeting on January 24.
On February 1,
1988 Niagara Mohawk informed Region I that the pre-restart corrective actions had been completed and that they were ready to restart the reactor.
Region I authorized restart on the same day.
~EOF Y
T The sequence of events regarding the January 20, 1988 reactor scram and subsequent overfilling of the reactor vessel (RV) are listed below.
The times are referenced to the reactor scram, which occurred at 9:45 a.m..
The correlations of vessel levels, instrument levels, and automatic actions are shown in the Technical Specification Bases Figure B3/4.3-1, Reactor Vessel Water Level, Enclosure 3.
The events are broken into two phases; Phase 1 covering the loss of feedwater initiated by the isolation of instrument air and Phase
covering the reactor vessel overfilling initiated by the reopening of instrument air system valves.
Some times and levels could not be firmly established and are annoted by npn Time
-
RV Level Inches Descri tion PHASE 1 - LOSS OF FEEDWATER:
-1 min 183 (1)
Auxiliary operator closes valves that isolate one instrument air prefi lter train.
The"isolation valves on the other train are not open, and instrument air pressure in the turbine and reactor buildings decrease sec 183-17 sec 180 Reduced instrument air pressure reaches the point at which air operated minimum flow valves for the condensate, condensate booster, and feed pumps fail open as designed.
With the minimum flow valves open, feedwater recirculates back to the condenser and feedwater pressure drops.
Both running feed pumps trip on loss of suction pressure as does one of the two running condensate booster pumps.
Feedwater pressure drops below reactor pressure and results in a total loss of feedwater.
Vessel level begins to decrease rapidly.
159
.25 min 110 3.75 min 195 4 min 202 4-5 min 202 An operator in the control room switches to manual mode on the master controller of the feedwater level control valves and tries to open the valves further.
The control valves were already fully open due to the automatic response of the feedwater control system.
Reactor scrams on low vessel level (Level 3),
High Pressure Core Spray (HPCS)
and Reactor Core Isolation Cooling (RCIC) Systems automatically inject (Level 2).
Level begins increasing.
Operator closes the HPCS injection valve, thereby terminating HPCS injections RCIC automatically isolates (Level 8).
Reactor stable with level constant at 202 inches and pressure decreasing slowly from 655 psig to 625 psig.
PHASE 2 VESSEL OVERFILL; 5 min 202 5'5 min 202 Auxiliary operator realizes his error following the reactor scram and reopens the isolated instrument air train.
Instrument air pressure begins increasing.
The increasing instrument air pressure is high enough to close the failed open feedwater minimum flow valves.
Feedwater pressure (from the condensate booster pumps)
rapidly increases to about 30 psig above reactor pressure, and due to the feed control valves being in manual mode and open, feedwater injects into the vessel.
Within 15 seconds feedwater flow increases to approximately 2,600,000 lbs/hr, about the same as the pre-scram quantity.
Level increases rapidl.4 min 235 Operator attempts to close the feedwater flow control valves.
The valves lock up at approximately 80% open due to a unique problem with the manual control circuit, although the close control signal is indicated.
7.7 min 250 Level rises to the bottom of the main steam lines and remains relatively constant as steam lines fill.
11.5 min 275 Level rises above main steam lines and resumes rapid increases.
~ 5.mi n 310 Operator stops the level increase by shutting the feedwater blocking valves.
Valves take approximately a
minute to close.
13.5 min 333 Level reaches a maximum.
Level gradually decreases as water drains out of the steam lines through the steam line drains and is removed vi.a the Reactor Water Cleanup System.
There were no radiological consequences during the event.
4.
EVALUATION OF E UIPMENT AND DESIGN 4.1 Overfsll snto Masn Steam Lsnes Equipment damage was not apparent during Niagara Mohawk walkdowns and visual examinations of the main steam lines.
Based on these general walkdowns and examination of linear plots of piping deflection instrumentation, the engineering group determined that there had been no excessive piping deflections and that the lines had filled slowly without any water hammer effect.
Therefore, Niagara Mohawk concluded that a snubber inspection was not required per Technical Specification 4.7.5.d.
Niagara Mohawk's analyses of thermal, static and dynamic stresses for the-main steam lines and main steam nozzles were still being prepared during the inspection.
Subsequent to the inspection, Niagara Mohawk completed the initial analyses of the main steam lines'iping from the reactor vessel to the jet impingement wall was analyzed using ASME Code Class 1 rules.
From the jet impingement wall to the stop valves, the piping was designed and built in accordance with ANSI B31. 1 rules and analyzed accordingly.
The analyses showed that the stresses experienced during the event were within allowable limits.
The piping from the reactor vessel to the MSIVs was designed and built in accordance with ASME Code Class 1 rules and therefore was analyzed properly.
However, the piping between the MSIVs and the jet impingement
wall was designed and built to ANSI B31.1 rules and upgraded for the break exclusion zone in accordance with NRC Branch Technical Position MEB 3-1.
Therefore, the piping between the MSIVs and the jet impingement wall should have been analyzed using ASME Code Class
rules.
Niagara Mohawk subsequently reevaluated that section of piping using Class 2 rules with the exceptions noted in MEB 3-1 and determined that the stresses were within the allowable limits for ANSI B31. 1 piping in the break exclusion zone as defined by MEB 3-1.
Accordingly, Niagara Mohawk met its commitment to complete the main steam line analyses prior to reactor restart.
This is also discussed in Inspection Report 50-410/87-45.
Niagara Mohawk has not determined the maximum allowable differential temperature between the main steam line walls and the fluid in the event of a vessel overfill.
Consequently, the operators will continue to be unaware of the design basis limit in such an event.
Niagara Mohawk should determine the limiting differential temperature in such an event and incorporate the results of the review in the next update of the FSAR.
4.2 Feedwater Control Valves During the vessel overfill phase when an operator attempted to close the nonsafety-related feedwater control valves, the valves stopped at 805 open because of a unique characteristic of the manual portion of the feedwater control valves'ontrol circuits combined with a change in the setpoint of the valve lockup circuit.
In attempting to close the feedwater control valves quickly, the operator called for the largest close signal, i.e., the minimum electrical control signal value.
This minimum signal was recognized by the valve lockup circuit as a loss of signal, because the controller signal was less than the setpoint for the lockup circuit.
The control indications showed that the valves had received close signals at the same time the valve was locked up at the 80% open position.
The human factors aspects of this are discussed in Section 5.2.3.
Test data taken on January 22, 1988 disclosed that the voltage setpoint for lockup of the feedwater control valves had increased significantly since the previous calibration, such that certain manipulations of the manual control stations for the valves were able to actuate the lockup (i.e.,
a signal less than the lockup setpoint).
Had the setpoints not changed, the valves would not have locked up.
The change in the setpoint was initially diagnosed as setpoint drift.
It was later thought to have been caused by a problem in the setpoint calibration circuit connections.
The actual cause was still being investigated by Niagara Mohawk at the conclusion of the inspection.
Niagara Mohawk agreed to correct the valve lockup problem prior to restart, either by recalibrating the setpoint or by modifications to the lockup circui During the week of January 13, 1988, the onsite General Electric (GE)
Co. Operations Superintendent and a Niagara Mohawk Assistant Operations Superintendent, a licensed Senior Reactor Operator (SRO),
had discussed a Problem Report on this unique design feature.
Interviews with the Assistant Operations Superintendent determined that he did not fully understand the significance of this control valve circuitry problem and did not pass this information to the shift operating staff.
i The team reviewed the Problem Report, which had been prepared by the GE Operations Superintendent to authorize GE engineering personnel in San Jose to review the potential lockup problem, and concluded that it was poorly worded and did not properly communicate the technical significance of the issue.
In the team's opinion, it was not reasonable to expect the operators to be informed of this unique circuit characteristic, irrespective of the fact that the setpoint change did occur.
The setpoint change was only one of several ways the circuits'nique characteristic could have precipitated valve lockup.. All involve malfunctions of active components or errors in setpoint calibration.
At. the time this hypothetical problem was postulated by GE onsite personnel, it was not reasonable to predict that such a circuit malfunction (e.g., drift)
would occur prior to its being modified to eliminate this particular unique characteristic.
The team concluded that the priority given the corrective actions appeared to have been appropriate.
Regardless of the technical merits of the above, the Niagara Mohawk Assistant Operations Superintendent should have understood the problem and then decided whether or not to inform the operators.
He did not understand the problem when he signed off on the associated Problem Report.
4.3 Containment Isolation Instrumentation During the event, the vessel level reached a minimum value of about 110 inches.
Based on the Level 2 automatic initiation of HPCS and RCIC, it appeared that the containment isolation valves should also have closed as the nominal setpoint value for this function is also Level 2.
The Technical Specifications (TS) require that Level 2 setpoints be initially set to a nominal value of 108.8 inches or greater.
The setpoints are permitted to vary from the nominal value but must not go below the minimum allowable value in the Technical Specifications of 101.8 inches.
When checked after the event, the setpoints were 103.8 inches.
Niagara Mohawk found that this setpoint had initially been misset to 104 inches due to an error in calculating the setpoint electric signal in mi lliamps.
As 103.8 inches is above the minimum allowable value, it was technically acceptable.
Subsequent Niagara Mohawk review found that the Level 1 containment isolation setpoints wer e similarly misset between the nominal and allowable valves.
Based
on further evaluation after the inspection, Niagara Mohawk concluded that the misset Level 1 and Level 2 Primary Containment Isolation System instrumentation setpoints violated the Technical Specifications in that the setpoints had been set below the nominal value; the Notice of Violation is contained in Inspection Report 50-410/87-45.
Niagara Mohawk agreed to revise the setpoints and to properly recalibrate the Level 1 and Level 2 Primary Containment Isolation System instrumentation prior to reactor restart.
Effect of Loss of Instrument Air During the event, alarms were received indicating that the reactor building air header pressure was low (below 90 psig)
and that the CRD or scram air header pressure was low (below 65 psig).
The instrument air system pressure had decreased to some pressure below 65 psig.
However, some of the equipment actions which would have been expected to occur
" upon a complete loss of instrument air did not occur.
Instrument air pressure had not decreased to 0 psig.
The inspection team reviewed some of the key components which were affected by the reduced instrument air pressure.
Plant operating procedure N2-0P-19, Instrument and Service Air System, Rev.
1, September 11, 1986 provides a partial list of valves and dampers that "could have a major effect on plant operations".
That partial list specifies 19 different components; however, it does not indicate the effect that loss of air has upon the valves in the minimum flow bypass lines for the condensate, condensate booster and feedwater pumps.
In contrast, the FSAR (Section 15.0.5)
notes that upon a loss of air the valves in those minimum flow bypass lines will open to bypass feedwater to the condenser.
Furthermore, the FSAR states that upon loss of instrument air, the reactor water level would drop to Level 3, thereby initiating a scram signal.
This is exactly what happened on January 20, 1988.
The main steam isolation valves (MSIYs) require air to open and use air and spring force to close.
During the loss of air event, the MSIVs did not close.
There is a large air receiver in the Reactor Building between the MSIVs and the air compressors.
The receivers are separated from the isolated prefi lters by check valves.
Although the pressure in the air receivers did drop below 65 psi, it is believed that the inventory left was sufficient to maintain the MSIVs open.
If pressure had dropped below the minimum pressure required to hold these valves open, a pilot valve would have vented the air used to hold the valve open, and the valve would have closed by a combination of spring force and air force from a separate accumulator.
The inspection team concluded that Niagara Mohawk should evaluate the instrument air pressure at which this MSIV closure would occur and should include this information in the operating procedure for'nstrument ai The FSAR (Chapter 15.0.5, Amendment 7) states that while a complete analysis of the loss of instrument air transient has not been performed, it provides an expected sequence of events and operator actions.
However, the loss of instrument air procedure did not provide an expected sequence or recommended operator actions.
The inspection team concluded that Niagara Mohawk should further evaluate a loss of instrument air transient and incorporate the results in a revised operating procedure on instrument air.
Niagara Mohawk agreed to review the operating procedures concerning loss of instrument air, to revise the procedures as needed, and to train the licensed operators on the revised procedures prior to reactor restart.
EVALUATION OF HUMAN FACTORS Isolation of Instrument Air S stem The normal process for maintenance involves administrative control of maintenance under Maintenance Requests and administrative control of equipment isolations under Mark Up Sheets.
The Mark Up Man, who is usually a Chief Shift Operator (CSO) from the spare shift, initiates Mark Ups for the approved Maintenance Requests.
The Mark Up Man is responsible to check for plant impact and the correctness of the isolation.
The CSO approves the Mark Up to control the release of the Mark Up for the beginning of work.
The Senior Shift Supervisor (SSS)
checks for plant impact, correctness of isolation, and TS requirements as part of approving the Mark Up.
In the case of the instrument air prefi lters, the Mark Up Man received Maintenance Requests to work on both air filters at the same time.
He placed one in his drawer and processed the other one.
The Mark Up Man realized the importance of the system and put a note on the Mark Up to
"ensure one filter 2A or 28 is in service prior to isolating a filter."
The Mark Up was approved and released for work by being placed in the To-Be-Worked Basket on the CSO's desk.
The operator who actually did the work had four years experience as an Auxiliary Operator.
He obtained the Mark Up from the To-Be-Worked Basket on the CSO's desk and proceeded to the Instrument Air System (IAS) in the Turbine Building.
He did not inform any of the control room operators that he was about to perform this Mark Up.
The inspection team concluded that release of Mark Ups for work via the To-Be-Worked Basket without informing the control room operators appeared to be a poor practice, which should be reviewed by Niagara Mohawk in their written report on the event.
The Auxiliary Operator stated that he glanced at the B filter lineup and saw that the valves were open and proceeded to close the valves in the A
train.
He heard the noise from the compressors increase, which he thought was strange.
Later, the inspection team was unable to positively establish whether the B train filter valves were closed or
partially open.
In either case, the instrument air pressure would have decreased but at different rates.
When the inspector asked the equipment operator to describe the normal filter lineup, the operator stated that it was one filter on line and one secured.
Asked if he thought it strange that two filters were in service, he stated he did not think about that.
He admitted that he was careless in his check for proper lineup and suggested that he should have paid more attention, i.e.,
he should have put his hands on the open valves and verified that they were open.
He did not recall any formal training or management policy which requires a hands-on check to verify valve position.
He stated that valve position verification was covered in on-the-job training but that this was limited to following and watching another operator.
An Assistant Superintendent of Operations (ASO) indicated to the inspectors that Operations Department management wants operators to check valve positions and that they want hands-on checks 100% of the time.
Concerning Auxiliary Operator training, the ASO stated that the verification methods used by Auxiliary Operators are learned during on-the-job observation but confirmed that there were no checkoffs (signatures)
to document this.
He stated that individuals are interviewed by management prior to being authorized as Auxiliary Operators to ascertain their level of competence.
The inspection team concluded that Niagara Mohawk should review the policy for hands-on verification, determine whether it should be written',
and review the existing on-the-job training program for Auxiliary Operators to determine if additional training for such items as hands-on checking of valve position should be included in the program.
The control room operators were able to recognize the initial problem with the air system because of a
"CRD Scram Valve Pilot Air Header" alarm.
The "Instrument Air System Trouble" alarm is a
common alarm for numerous trouble conditions and was already alarmed due to one of the three air compressors being out of service.
The design of the common alarm does not provide for any reflashing of the alarms.
Accordingly, this alarm was useless to the operators during the event.
When the instrument air header pressure was checked by the control room operators, its indication was within the normal range.
This instrument receives its signal from upstream of the isolated filters.
The inspection team concluded that the location of the instrument air pressure tap should be evaluated.
Despite the confusing information, the operators later claimed to have eventually diagnosed a loss of instrument air, but their concern was directed to the loss of feedwater transien.2 Control of Level b
Licensed 0 erators The inspection team found the following areas regarding the control of vessel level by the licensed operators needed further evaluation:
Shifting of feedwater master control to manual mode prior to reactor scram.
Cognizance of level by licensed operators during the event's second phase (vessel overfill).
Lack of confirmation of the closing of the feed control valves.
Closing the feedwater blocking valves instead of tripping the condensate booster pumps.
These concerns are discussed separately below.
5.2.1 Manual Control of Feedwater Mastei Controller Prior to the reactor scram an operator responded to the decreasing vessel level and took manual control of the feedwater master controller and attempted to open the feedwater control valves; they were already fully open due to th'e automatic response of the control system.
The controller was left in manual with the valves open.
Later, during the second phase of the event, this condition permitted the feedwater system to inject water and overfill the vessel.
Had the system remained in automatic, the feedwater control valves would have controlled feedwater flow based on level, and presumably, the vessel overfill would not have occurred.
The operator switched to manual control because he was trained to do so.
Further, because of recent feedwater control problems during feedwater adjustments and power ascension testing, the operator felt that the system was somewhat unstable.
The inspection team concluded that the operator'
action was acceptable, based on his trai ning, the feedwater system's recent history, and the conservative direction in which he went.
5.2.2 0 erator Co nizance of Level Durin Overfill Licensed operator actions during the loss of feedwater (i.e., prior to the scram and for five minutes following the scram)
were appropriate and acceptable.
After the initial loss of feedwater, the subsequent scram, and HPCS and RCIC initiations, the operators were concerned with level recovery and post-scram actions.
An initial distraction was
verification that all control rods were fully inserted because some did not have "full in" indications.
The operator s proceeded to perform scram recovery actions including securing of auxiliary steam system loads, electrical lineup adjustments, balance of plant alignment, turbine generator securing, and other actions per OP-101C, Plant Shutdown.
However, operator cognizance of the rising vessel level appeared to be poor following its initial stabilization after HPCS and RCIC stopped injecting.
When the operators noted that level was increasing at a rate greater than normal expansion, they began checking for sources and eventually found that the feedwater system was injecting.
This confused them, because the controller demand signal for the feedwater control valve was calling for the valve to be closed.
As discussed below, neither the actual valve position nor the feedwater flow were checked.
One operator later claimed that he suspected valve leakage and thought about securing the booster pumps.
When level reached the steam lines, the rate of increase stopped since the steam lines were being filled, and the operators thought level stopped increasing.
Later, an Assistant Operations Superintendent and an operator diagnosed that the feedwater control valves were open and would not shut.
At this time the decision was made to stop flow by closing the feedwater blocking valves.
The Senior Shift Supervisor (SSS)
and the Chief Shift Operator (CSO)
failed to ensure that an operator was assigned the responsibility to monitor and control the vessel level.
Later, the CSO informed the inspector that he was not involved in level control actions after the initial recovery from low level.
This failure to assign level control responsibility resulted in allowing level to increase due to feedwater injection.
The inspection team concluded that the responsibility to control level should be addressed by Niagara Mohawk in their review of EOPs and operating procedures.
Niagara Mohawk agreed to do this prior to reactor restart.
5.2.3 Lack of Confirmation of Closin of Valves The operators later claimed that they recognized that reactor pressure was decreasing to the point that the condensate booster pumps would start injecting water into the vessel.
Approximately six and a half minutes following the scram (feedwater had already been injecting for a minute),
an operator attempted to stop this flow path by closing the
,feedwater control valves in the individual manual control mode.
The valves closed only to 80% and locked up due to a circuit design problem and a variation in the lockup setpoint (discussed in Section 4.2).
However, the operator apparently only checked the indication of the control signal on the controllers (which showed the close signal)
and did not check the actual valve position indication, which was directly above the controllers, or the feed flow indications on the vertical section of the control panel above the controllers.
These indications showed that the control. valves had not closed and that feedwater continued to inject into the vessel.
The valves'ockup and the error
in not recognizing it went uncorrected for another six minutes.
Had the lockup been recognized initially, the level could potentially have been corrected prior to reaching the steam lines.'he operator's error in not confirming the results of his actions (i.e.,
closing of the valves)
by enough of the available means (actual valve position indication and feedwater flow indication) represented a crucial error during the overfill and has application to both routine operations and transient response actions.
The inspection team concluded that Niagara Mohawk should address in their written report the practice of operators properly confirming the results of their intended actions and the possible corrective actions for this error.
5.2.4 Tri in of Condensate Booster Pum s
Niagara Mohawk personnel told the inspectors that when the operators determined that feedwater was still injecting and was overfilling the vessel (approximately 12 minutes following the scram),
they made a
conscious decision to allow the condensate booster pumps to continue operating and to terminate the transient by closing the feedwater flow control valves (LV-10s) and the feedwater blocking valves (MOVs 21-A and-B).
This method was chosen by the SSS because he felt it was better to keep the condensate booster pumps running since he felt that the pumps might not restart.
The condensate booster pumps are rated for about 11,000 gpm each and have 3000 hp motors.
As a result, there is a concern for the amount of electrical current they draw on starting and the resultant heatup of the motor windings.
Operating Procedure OP-3, Condensate and Feedwater System limits the number of starts permitted for the condensate booster pumps, reflecting this concern.
Closing the feedwater blocking valves was initiated by an operator and took about a minute.
At nearly the same time the GE Operations Superintendent recognized the problem with the feedwater valves and directed the operators how to take the valves out of lockup.
That action was successful.
The feedwater control valves were then closed.
Apparently, the blocking valves and control valves came closed simultaneously.
The inspection team concluded that while tripping the pumps might have been a faster way to stop the feedwater injection, closing the blocking valves was an acceptable method and was consistent with the operating procedures and operator training.
5.3 Procedure Ade uac Operating procedures and Emergency Operating Procedures (EOPs)
which address a loss of feedwater event were evaluated by the inspection team, who concluded that the procedures needed improvement.
The EOPs addressed maintaining reactor vessel level between Level 3 and Level 8 during a
vessel refill, but did not address vessel overfill.
Operating Procedure (OP)
101C, Plant Shutdown did not address vessel overfill.
The operating procedure for instrument air did not contain sufficient information on the effects of a loss of instrument air, as discussed in Section 4.4.
The inspection team concluded that the the operating procedures and EOPs which address low vessel level and high vessel level should be evaluated in light of the overfill event.
Niagara Mohawk agreed to review these procedures, to revise the procedures as necessary, and train the operators on the revised procedures prior to reactor restart.
5.4 NRC Notification On January 20, 1988, at 10:27 a.m.,
Niagara Mohawk notified the NRC Operations Center of the event and provided the following information:
The plant scrammed on Level 3 reactor water level.
An Unusual Event had been declared and terminated.
The report further stated that "all systems functioned as required".
The report did not include the information that there was a problem with the feed control valves nor that the steam lines had been filled with water.
Approximately 15 minutes after the scram, the Shift Supervisor determined that emergency procedures specify that an Unusual Event be declared if an Emergency Core Cooling System (ECCS) actuates based on an actual condition, i.e. valid signal.
Accordingly, he declared an Unusual Event, effective from the initiation of HPCS.
The Unusual Event was terminated shortly
~
afterwards (It could have been terminated four minutes after the scram when level had been restored and HPCS secured).
The subsequent notifi-cations to the NRC and the state and local authorities included the Unusual Event's declaration and termination.
Niagara Mohawk did not consider the problem with the feedwater control valve nor the filling of the steam lines with water as significant and therefore did not report them.
The overfill event on January 20, 1988 was the second overfill event at NMP-2; the first occurred on October 1,
1987.
The LER concerning the October 1,
1987 event did not report the water in the main steam lines.
However, there are no Technical Specifications or other reporting requirements to require that a vessel overfill event be reported unless it is determined that the event was beyond the design basis or outside the operating or emergency procedures.
The determination as to whether or not the event was beyond the design basis was not immediately available to the operators.
This apparent deficiency in the reporting requirements may have contributed to Niagara Mohawk's lack of sensitivity and awareness of the potential safety aspects of the January 20, 1988 even At the conclusion of the inspection the event was still under evaluation to determine if it was enveloped by existing analysis.
Therefore, whether or not this event should have been reported as beyond the design basis (or significantly compromising plant safety) could not be determined during the inspection.
Niagara Mohawk should address this evaluation as part of the written report to be submitted.
5.5 Feedback of 0 eratin Ex erience The operators were unaware of similar overfill events which occurred at Washington Nuclear Power Unit 2 (WNP-2) (LERs 86-25-01 and 87-02).
Also, the October 1,
1987 vessel overfill at NMP-2 apparently did not result in corrective actions which could have prevented the January 20, 1988 overfill.
Niagara Mohawk should review these events and their procedures for feedback of operating events to the operators.
6.
CORRECTIVE ACTION SUMMARY 6.1 Corrective Actions Prior to Restart Niagara Mohawk committed to complete the following prior to restart:
A.
Provide a written analysis of the stresses experienced by the vessel, steam line nozzles and steam lines as a result of the overfill transient.
(Section 4. 1)
B.
Modify the feedwater lockup circuit or recalibrate the setpoint using a revised procedure as appropriate.
(Section 4.2)
C.
Correct the setpoint reference values and recalibrate the Level
and Level 2 trip functions for containment isolation on low vessel water level. (Section 4.3)
D.
Review operating procedures and EOPs for the following conditions, revise the procedures as necessary, and train the operators on the revised procedures.
(Sections 4.4, 5.2.2, and 5.3)
a.
Low vessel level b.
Hi vessel level c.
Loss of instrument air (full or partial)
6.2 Additional Corrective Actions Niagara Mohawk agreed to submit a written report on the event.
This report should address the following concerns raised in this report.
A.
Determine the limiting differential temperature in such an event and incorporate the results of the review in the next update of the FSAR.,(Section 4. 1)
B.
Evaluate the reduced instrument air pressure at which the MSIVs would automatically close and document this in the instrument air operating procedure.
(Section 4.4)
C.
Review the use of To-Be-Worked Basket for release of Mark Ups to be worked. (Section 5.1)
D.
Review policy on hands-on verification of equipment positions, decide whether such a policy should be written, and review nonlicensed operator training in this area.
(Section 5. 1)
E.
F.
Review design of instrument air pressure indication. (Section 5. 1)
Review licensed operator training regarding practice of confirming that equipment responses are consistent with control actions.
(Section 5.2.3)
G.
H.
Review NRC notification regarding whether event was within the bounds of existing analyses.
(Section 5.4)
Review the feedback of operating experience to licensed operators regarding the apparent failure to apply the lessons learned from the October 1,
1987 NMP-2 vessel overfill and the two WNP-2 vessel overfills. (Section 5.5)
CONCLUSIONS AND FINDINGS The inspection did not directly result in any violations.
However, based on Niagara Mohawk reviews and NRC resident inspectot evaluations following the inspection, a violation was issued in Inspection Report 50-410/87-45 for the misset sepoints for Level 1 and Level 2 Primary Conainment Isolation System trip functions, discussed in Section 4.3.
The inspection team concluded that the reactor scram and subsequent vessel overfill resulted from a personnel error, the incorrect'isolation of an instrument air filter train by an Auxiliary Operator.
This operator was judged to have had sufficient experience and qualification to do the isolation properly.
However, there was no established, written policy on hands-on verification of valve position, and on-the-job training coverage of verification appeared to need improvement.
(Corrective action item 6.2.D addresses this concern.)
The control room operators were unaware that the Auxiliary Operator was isolating the filter train, and this lack of awareness hindered their response to the event.
(Corrective action item 6.2.C addresses this concern).
r
The inspection team concluded that the equipment and operator responses to the initial phase of the event the loss of feedwater were acceptable and appropriate.
The reactor scrammed based on the low reactor water vessel, and the RCIC and HPCS Systems injected water until the vessel level was restored above the normal range.
Within four minutes of the reactor scram, the vessel level had stabilized and the reactor parameters were in the expected ranges for the loss of feedwater transient.
There had been no significant equipment or operator problems in the response to the loss of feedwater.
One calibration error was later detected in that the same level setpoints that initiated RCIC and HPCS injections could have actuated the Primary Containment Isolation System.
Later evaluations found that the setpoints had been misset due to computational errors, but setpoints were technically acceptable.
(Corrective action 6. 1.C addresses this errors
)
The inspection team found that the equipment and operator responses to the second phase of the event - the overfilling of the vessel-demonstrated the following problems:
No control room operator maintained continued cognizance of the vessel water level following the initial level stabilization.
Due to the infrequent observations of level, the operators misinterpreted the vessel level changes.
(Corrective action item 6.1.0 addresses this error.)
When an operator attempted to close the feed control valves, the control circuit locked up the valve operators at 80% open.
(Corrective action item 6.1.B addresses this failure.)
The operator attempting to close the feed control valves did not confirm their closing by checking either the valve position indications or the feedwater flow indications.
The locked up, open feed control valves went undetected until six minutes later.
(Corrective action item 6.2.F addresses this error.)
Vessel level continued to rise and the main steam lines were filled with water.
The maximum vessel level reached was approximately
inches above the steam lines.
(Corrective action item 6. 1.A addresses this problem.)
The control room indication of instrument air pressure showed the pressure to be within the normal range because it was measured upstream of the isolated filters.
(Corrective action item 6.2.E addresses this concern.)
Further, EOPs and operating procedures concerning low and high vessel level and loss of instrument air were judged to need additional information in the procedures to aid the operators.
Niagara Nohawk agreed to review these procedures and upgrade them based on the review of the event.
(Corrective action item 6. 1.0 addresses this concern.)
Exit Meetin The inspection team periodically discussed the inspection results with Niagara Mohawk management during the inspection and held an exit meeting with Mr. T. Perkins, General Superintendent, Mr.
R. Abbott, Unit 2 Superintendent, and the Niagara Mohawk staff on January 24, 1988, in which the team's major findings were presented.
Based on the NRC Region I review of this report and discussions held with licensee representatives, it was determined that this report does not contain Safeguards or 10 CFR 2.790 Information.