IR 05000454/2017002
| ML17219A597 | |
| Person / Time | |
|---|---|
| Site: | Byron  |
| Issue date: | 08/07/2017 |
| From: | Eric Duncan Region 3 Branch 3 |
| To: | Bryan Hanson Exelon Generation Co, Exelon Nuclear |
| References | |
| IR 2017002 | |
| Download: ML17219A597 (28) | |
Text
UNITED STATES ust 7, 2017
SUBJECT:
BYRON STATION, UNITS 1 AND 2NRC INTEGRATED INSPECTION REPORT 05000454/2017002 AND 05000455/2017002
Dear Mr. Hanson:
On June 30, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an integrated inspection at your Byron Station, Units 1 and 2. On July 11, 2017, the NRC inspectors discussed the results of this inspection with Mr. H. Welt and other members of your staff. The results of this inspection are documented in the enclosed report.
Based on the results of this inspection, the NRC has identified one finding that was evaluated under the risk significance determination process as having very low safety significance (Green). Issue reports were entered into the corrective action program to address this issue.
If you disagree with the cross-cutting aspect assignment or any finding not associated with a regulatory requirement in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region III; and the NRC Resident Inspector at the Byron Station. This letter, its enclosure, and your response (if any) will be made available for public inspections and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.
Sincerely,
/RA/
Eric R. Duncan, Chief Branch 3 Division of Reactor Projects Docket Nos. 50-454; 50-455 License Nos. NPF-37; NPF-66 Enclosure:
IR 05000454/2017002; 05000455/2017002 cc: Distribution via LISTSERV
SUMMARY
Inspection Report 05000454/2017002, 05000455/2017002; 04/01/2017 - 06/30/2017; Byron
Station, Units 1 and 2; Identification and Resolution of Problems.
This report covers a 3-month period of inspection by resident inspectors and announced baseline inspections by regional inspectors. One Green finding was identified by the inspectors.
The finding was not associated with U.S. Nuclear Regulatory Commission (NRC) regulations.
The significance of inspection findings is indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) and determined using Inspection Manual Chapter (IMC) 0609,
"Significance Determination Process," dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310, "Aspects Within the Cross-Cutting Areas," dated December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated November 1, 2016. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 6.
- Green.
A finding of very low safety significance was self-revealed on March 28, 2017, when operators rapidly reduced generator load in response to a loss of forced cooling for the newly installed Unit 1 East main power transformer (1E MPT) and an indicated rapid rise in transformer winding hotspot temperature caused by vendor data entry errors in the monitoring system software. The process detailed in CC-AA-256-101, Software Quality Assurance Process for Plant Digital Instrumentation and Control Systems and Components, to verify and validate the software/firmware during updates was not implemented after the vendor made changes to the digital software during the modification process. The issue was entered into the licensees corrective action program (CAP) and corrective actions included replacement of the cooling group supply breaker, correction of the software errors, and revision of the alarm response procedure and supporting documentation.
The inspectors concluded that the issue was more than minor because it adversely impacted the Design Control attribute of the Initiating Events Cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during plant operations. Specifically, rapid power changes or load reject could challenge operating safety limits. In this event, the rapid rise in the calculated winding hotspot indications and subsequent operator actions to rapidly reduce load over 300 megawatts electric (MWe) was the result of two software errors: (1) an incorrect Current-Turns (CT) Ratio and (2) the incorrect configuration of the MPT cooling groups in series within the software. The inspectors utilized Exhibit 1, Initiating Events Screening Questions of IMC 0609, Significance Determination Process, Appendix A, dated June 19, 2012, to conclude that the finding was Green, or of very low safety significance, because the event did not cause a reactor trip and the event did not affect any mitigation equipment. A cross-cutting aspect in the Challenge the Unknown element of the Human Performance Area (IMC 0310 H.11) was assigned because the engineering group based the risk evaluation on the vendor input that the scope of the change was limited. The flawed assumption that the vendor input was correct without verification resulted in a failure to manage the risk prior to implementation through the verification/validation of the software/firmware. [Section 4OA2.4]
REPORT DETAILS
Summary of Plant Status
During this inspection period, both Byron Station Units 1 and 2 were periodically scheduled to vary electrical output by the grid operator for short periods to help ease congestion on the transmission system or to support the economic dispatch agreement between Exelon and the grid operator.
Units 1 and 2 began the period at full power and operated at scheduled power levels for the entire inspection period.
REACTOR SAFETY
Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity
1R01 Adverse Weather Protection
.1 Summer Seasonal Readiness Preparations
a. Inspection Scope
The inspectors performed a review of the licensees preparations for summer weather for selected systems, including conditions that could lead to an extended drought.
During the inspection, the inspectors focused on plant-specific design features and the licensees procedures used to mitigate or respond to adverse weather conditions.
Additionally, the inspectors reviewed the Updated Final Safety Analysis Report (UFSAR)and performance requirements for systems selected for inspection, and verified that operator actions were appropriate as specified by plant-specific procedures. The inspectors also reviewed corrective action program (CAP) items to verify that the licensee was identifying adverse weather issues at an appropriate threshold and entering them into their CAP in accordance with station corrective action procedures.
The inspectors reviews focused specifically on the following plant systems:
- Switchyard; and
- Unit 1 and Unit 2 Main Power Transformers.
This inspection constituted one seasonal adverse weather sample as defined in Inspection Procedure (IP) 71111.01-05.
b. Findings
No findings were identified.
.2 External Flooding
a. Inspection Scope
The inspectors evaluated the design, material condition, and procedures for coping with the design basis probable maximum flood. The evaluation included a review to check for deviations from the descriptions provided in the UFSAR for features intended to mitigate the potential for flooding from external factors. Additionally, the inspectors performed a walkdown of the essential service water make up pumps to review the condition of barriers and identify any modification to the river screen house which would inhibit drainage during a flooding event or allow water ingress past a barrier.
This inspection constituted one external flooding sample as defined in IP 71111.01-05.
b. Findings
No findings were identified.
1R04 Equipment Alignment
.1 Quarterly Partial System Walkdowns
a. Inspection Scope
The inspectors performed partial system walkdowns of the following risk-significant systems:
- Unit 1 Train B (1B) essential service water (SX) while Unit 1 Train A (1A) SX was out-of-service for planned maintenance;
- Unit 2 Train A (2A) residual heat removal (RH) while Unit 2 Train B (2B) RH was out-of-service for planned maintenance;
- 2B auxiliary feedwater (AF) while 2A AF was out-of-service for planned maintenance; and
- 2A Containment Spray (CS) while 2B CS was out-of-service for planned maintenance.
The inspectors selected these systems based on their risk significance relative to the Reactor Safety Cornerstones at the time they were inspected. The inspectors attempted to identify any discrepancies that could impact the function of the system and, therefore, potentially increase risk. The inspectors reviewed applicable operating procedures, system diagrams, UFSAR sections, Technical Specification (TS) requirements, outstanding work orders (WOs), issue reports (IRs), and the impact of ongoing work activities on redundant trains of equipment in order to identify conditions that could have rendered the systems incapable of performing their intended functions. The inspectors also walked down accessible portions of the systems to verify system components and support equipment were aligned correctly and operable. The inspectors examined the material condition of the components and observed operating parameters of equipment to verify that there were no obvious deficiencies. The inspectors also verified that the licensee had properly identified and resolved equipment alignment problems that could cause initiating events or impact the capability of mitigating systems or barriers and entered them into the CAP with the appropriate significance characterization.
These activities constituted four partial system walkdown samples as defined in IP 71111.04-05.
b. Findings
No findings were identified.
1R05 Fire Protection
.1 Routine Resident Inspector Tours
a. Inspection Scope
The inspectors conducted fire protection walkdowns which were focused on the availability, accessibility, and condition of firefighting equipment in the following risk-significant plant areas:
- Unit 1 Auxiliary Bldg. 439'-0" Elev. Lower Cable Spreading Room;
- Unit 2 Auxiliary Bldg. 439'-0" Elev. Lower Cable Spreading Room; and
- Unit 2 Auxiliary Bldg. 383'-0" Elev. 2B Auxiliary Diesel Feedwater Pump and Day Tank Room.
The inspectors reviewed areas to assess if the licensee had implemented a fire protection program that adequately controlled combustibles and ignition sources within the plant, effectively maintained fire detection and suppression capability, maintained passive fire protection features in good material condition, and implemented adequate compensatory measures for out-of-service, degraded or inoperable fire protection equipment, systems, or features in accordance with the licensees fire plan. The inspectors selected fire areas based on their overall contribution to internal fire risk as documented in the plants Individual Plant Examination of External Events with later additional insights, their potential to impact equipment which could initiate or mitigate a plant transient, or their impact on the plants ability to respond to a security event. The inspectors verified that fire hoses and extinguishers were in their designated locations and available for immediate use; that fire detectors and sprinklers were unobstructed; that transient material loading was within analyzed limits; and fire doors, dampers, and penetration seals appeared to be in satisfactory condition. The inspectors also verified that minor issues identified during the inspection were entered into the licensees CAP.
These activities constituted three quarterly fire protection inspection samples as defined in IP 71111.05-05.
b. Findings
No findings were identified.
1R11 Licensed Operator Requalification Program
.1 Resident Inspector Quarterly Review of Licensed Operator Requalification
a. Inspection Scope
On May 23, 2017, the inspectors observed a crew of licensed operators in the plants simulator during licensed operator requalification training. The inspectors verified that operator performance was adequate, evaluators were identifying and documenting crew performance problems, and that training was being conducted in accordance with licensee procedures. The inspectors evaluated the following areas:
- licensed operator performance;
- crews clarity and formality of communications;
- ability to take timely actions in the conservative direction;
- prioritization, interpretation, and verification of annunciator alarms;
- correct use and implementation of abnormal and emergency procedures;
- control board manipulations;
- oversight and direction from supervisors; and
- ability to identify and implement appropriate TS actions and Emergency Plan actions and notifications.
The crews performance in these areas was compared to pre-established operator action expectations and successful critical task completion requirements.
This inspection constituted one quarterly licensed operator requalification program simulator sample as defined in IP 71111.11-05.
b. Findings
No findings were identified.
1R12 Maintenance Effectiveness
.1 Routine Quarterly Evaluations
a. Inspection Scope
The inspectors evaluated degraded performance issues involving the following risk-significant systems:
- Unit 1 RH;
- Unit 1 Condensate Booster System (CB); and
- Unit 2 Instrument Power.
The inspectors reviewed events including those where ineffective equipment maintenance had resulted in valid or invalid automatic actuations of engineered safeguards systems and independently verified the licensee's actions to address system performance or condition problems in terms of the following:
- implementing appropriate work practices;
- identifying and addressing common cause failures;
- scoping of systems in accordance with 10 CFR 50.65(b) of the maintenance rule;
- characterizing system reliability issues for performance;
- charging unavailability for performance;
- trending key parameters for condition monitoring;
- ensuring 10 CFR 50.65(a)(1) or (a)(2) classification or re-classification; and
- verifying appropriate performance criteria for structures, systems, and components (SSCs)/functions classified as (a)(2), or appropriate and adequate goals.
The inspector performed a quality review for the Unit 2 Instrument Power system, as discussed in IP 71111.12, Section 02.02.
The inspectors assessed performance issues with respect to the reliability, availability, and condition monitoring of the system. In addition, the inspectors verified maintenance effectiveness issues were entered into the CAP with the appropriate significance characterization.
This inspection constituted two quarterly maintenance effectiveness samples and one quality control maintenance effectiveness sample as defined in IP 71111.12-05.
b. Findings
No findings were identified.
1R13 Maintenance Risk Assessments and Emergent Work Control
.1 Maintenance Risk Assessments and Emergent Work Control
a. Inspection Scope
The inspectors reviewed the licensee's evaluation and management of plant risk for the maintenance and emergent work activities affecting risk-significant and safety-related equipment listed below to verify that the appropriate risk assessments were performed prior to removing equipment for work:
- Emergent yellow risk on unit 1 following failure of 1RH619 flow control valve;
- 2A AF pump K632 relay surveillance; and
- Unplanned trip and restoration of motor control center (MCC) 133Z2 feeder breaker.
These activities were selected based on their potential risk significance relative to the Reactor Safety Cornerstones. As applicable for each activity, the inspectors verified that risk assessments were performed as required by 10 CFR 50.65(a)(4) and were accurate and complete. When emergent work was performed, the inspectors verified that the plant risk was promptly reassessed and managed. The inspectors reviewed the scope of maintenance work, discussed the results of the assessment with the licensee's probabilistic risk analyst or shift technical advisor, and verified plant conditions were consistent with the risk assessment. The inspectors also reviewed TS requirements and walked down portions of redundant safety systems, when applicable, to verify risk analysis assumptions were valid and applicable requirements were met.
These maintenance risk assessments and emergent work control activities constituted four samples as defined in IP 71111.13-05.
b. Findings
No findings were identified.
1R15 Operability Determinations and Functional Assessments
.1 Operability Evaluations
a. Inspection Scope
The inspectors reviewed the following issues:
- Unexpected alarm for reactor coolant pump electrical bus undervoltage;
- Unit 1 containment emergency core cooling systems (ECCS) gas void ultrasonic testing exam results for 1SI092;
- Part 21 evaluation for AMETEK potential circuit board defect;
- Unit 1 control rod drive (RD) system pulse-to-analogue (P/A) converter & bank overlap unit not reading correctly; and
- Found two broken studs and degraded rubber on 2DSFSO03 flood seal.
The inspectors selected these potential operability issues based on the risk significance of the associated components and systems. The inspectors evaluated the technical adequacy of the evaluations to ensure that TS operability was properly justified and the subject component or system remained available such that no unrecognized increase in risk occurred. The inspectors compared the operability and design criteria in the appropriate sections of the TS and UFSAR to the licensees evaluations to determine whether the components or systems were operable. Where compensatory measures were required to maintain operability, the inspectors determined whether the measures in place would function as intended and were properly controlled. The inspectors determined, where appropriate, compliance with bounding limitations associated with the evaluations. Additionally, the inspectors reviewed a sampling of corrective action documents to verify that the licensee was identifying and correcting any deficiencies associated with operability evaluations.
This operability inspection constituted five samples as defined in IP 71111.15-05.
b. Findings
No findings were identified.
1R19 Post-Maintenance Testing
.1 Post-Maintenance Testing
a. Inspection Scope
The inspectors reviewed the following post-maintenance (PM) activities to verify that procedures and test (PMT) activities were adequate to ensure system operability and functional capability:
- 1B emergency diesel generator (EDG) overspeed trip surveillance following overhaul work window;
- Repair of 125 VDC battery charger 112 after circuit card failure; and
- 2A AF pump after maintenance window.
These activities were selected based upon the structure, system, or component's ability to impact risk. The inspectors evaluated these activities for the following (as applicable):
the effect of testing on the plant had been adequately addressed; testing was adequate for the maintenance performed; acceptance criteria were clear and demonstrated operational readiness; test instrumentation was appropriate; tests were performed as written in accordance with properly reviewed and approved procedures; equipment was returned to its operational status following testing (temporary modifications or jumpers required for test performance were properly removed after test completion); and test documentation was properly evaluated. The inspectors evaluated the activities against TSs, the UFSAR, 10 CFR Part 50 requirements, licensee procedures, and various NRC generic communications to ensure that the test results adequately ensured that the equipment met the licensing basis and design requirements. In addition, the inspectors reviewed corrective action documents associated with post-maintenance tests to determine whether the licensee was identifying problems and entering them in the CAP and that the problems were being corrected commensurate with their importance to safety.
This inspection constituted four post-maintenance testing samples as defined in IP 71111.19-05.
b. Findings
No findings were identified.
1R22 Surveillance Testing
.1 Surveillance Testing
a. Inspection Scope
The inspectors reviewed the test results for the following activities to determine whether risk-significant systems and equipment were capable of performing their intended safety function and to verify testing was conducted in accordance with applicable procedural and TS requirements:
- 2BOSR 8.1.14-2 Revision 23; 2B Diesel Generator 24-Hour Endurance Run and Hot Restart (routine);
- 0BOSR 5.5.8.SX.5-1c, Revision 12; Unit Zero Comprehensive Inservice Testing (IST) Requirements For Essential Service Water Makeup Pump 0A;
- 2BOSR 7.5.4-2; 2B Diesel Driven Auxiliary Feed Pump Monthly Surveillance (routine); and
- 2BOSR 5.5.8.CS 5-1c Revision 4; Unit Two Comprehensive Inservice Testing (IST) Requirements for Containment Spray Pump 2CS01PA.
The inspectors observed in-plant activities and reviewed procedures and associated records to determine the following:
- did preconditioning occur;
- were the effects of the testing adequately addressed by control room personnel or engineers prior to the commencement of the testing;
- were acceptance criteria clearly stated, sufficient to demonstrate operational readiness, and consistent with the system design basis;
- was plant equipment calibration correct, accurate, and properly documented;
- were as-left setpoints within required ranges; and was the calibration frequency in accordance with TS, the UFSAR, plant procedures, and applicable commitments;
- was measuring and test equipment calibration current;
- was the test equipment used within the required range and accuracy, and were applicable prerequisites described in the test procedures satisfied;
- did test frequencies meet TS requirements to demonstrate operability and reliability;
- were tests performed in accordance with the test procedures and other applicable procedures;
- were jumpers and lifted leads controlled and restored where used;
- were test data and results accurate, complete, within limits, and valid;
- was test equipment removed following testing;
- where applicable for IST activities, was testing performed in accordance with the applicable version of Section XI of the ASME Code and were reference values consistent with the system design basis;
- was the unavailability of the tested equipment appropriately considered in the performance indicator (PI) data;
- were test results not meeting acceptance criteria addressed with an adequate operability evaluation or was the system or component declared inoperable;
- was the reference setting data accurately incorporated into the test procedure;
- was equipment returned to a position or status required to support the performance of its safety functions following testing;
- were problems identified during the testing appropriately documented and dispositioned in the licensees CAP;
- were annunciators and other alarms demonstrated to be functional and were setpoints consistent with design requirements; and
- were alarm response procedure entry points and actions consistent with the plant design and licensing documents.
This inspection constituted two routine surveillance testing samples and two in-service test samples as defined in IP 71111.22, Sections-02 and-05.
b. Findings
No findings were identified.
1EP6 Drill Evaluation
.1 Emergency Preparedness Drill Observation
a. Inspection Scope
The inspectors evaluated the conduct of a routine licensee emergency drill on June 21, 2017, to identify any weaknesses and deficiencies in classification, notification, and protective action recommendation development activities. As part of the inspection, the inspectors reviewed the drill package and expected scenario timeline. The inspectors observed emergency response operations in the Main Control Room (MCR)and the Technical Support Center (TSC) to determine whether the event classification, notifications, and protective action recommendations were performed in accordance with procedures. The inspectors also attended the licensee drill critique to compare any inspector-observed weakness with those identified by the licensee staff in order to evaluate the critique and to verify whether the licensee staff was properly identifying weaknesses and entering them into the CAP. The inspector also verified that identified performance deficiencies were entered into the CAP.
This emergency preparedness drill inspection constituted one sample as defined in IP 71114.06-05.
b. Findings
No findings were identified.
OTHER ACTIVITIES
Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Security
4OA1 Performance Indicator Verification
.1 Safety System Functional Failures
a. Inspection Scope
The inspectors sampled licensee submittals for the Safety System Functional Failures PI for Byron Station Units 1 and 2 for the period from the second quarter 2016 through the first quarter 2017. To determine the accuracy of the PI data reported during those periods, guidance contained in the Nuclear Energy Institute (NEI) Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, dated August 31, 2013, and NUREG-1022, Event Reporting Guidelines 10 CFR 50.72 and 50.73 definitions and guidance, were used. The inspectors reviewed the licensees operator narrative logs, operability assessments, maintenance rule records, maintenance work orders, inspection reports, event reports and NRC Integrated Inspection Reports for the period April 1, 2016 through March 31, 2017 to validate the accuracy of the submittals. The inspectors also reviewed the licensees issue report database to determine if any problems had been identified with the PI data collected or transmitted for this indicator.
This inspection constituted two safety system functional failures samples as defined in IP 71151-05.
b. Findings
No findings were identified.
.2 Reactor Coolant System Leakage
a. Inspection Scope
The inspectors sampled licensee submittals for the reactor coolant system (RCS)leakage PI for Byron Station Units 1 and 2 for the period from the second quarter 2016 through the first quarter 2017. To determine the accuracy of the PI data reported during those periods, guidance contained in the NEI Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, dated August 31, 2013, was used. The inspectors reviewed the licensees operator logs, RCS leakage tracking data, inspection reports, event reports and NRC Integrated Inspection Reports for the period of April 1, 2016 through March 31, 2017 to validate the accuracy of the submittals. The inspectors also reviewed the licensees IR database to determine if any problems had been identified with the PI data collected or transmitted for this indicator.
This inspection constituted two reactor coolant system leakage samples as defined in IP 71151-05.
b. Findings
No findings were identified.
4OA2 Identification and Resolution of Problems
.1 Routine Review of Items Entered into the Corrective Action Program
a. Inspection Scope
As discussed in previous sections of this report, the inspectors routinely reviewed issues during baseline inspection activities and plant status reviews to verify they were being entered into the licensees CAP at an appropriate threshold, adequate attention was being given to timely corrective actions, and adverse trends were identified and addressed. Some minor issues were entered into the licensees CAP as a result of the inspectors observations; however, they are not discussed in this report.
These routine reviews for the identification and resolution of problems did not constitute any additional inspection samples. Instead, by procedure they were considered an integral part of the inspections performed during the quarter.
b. Findings
No findings were identified.
.2 Semi-Annual Trend Review
a. Inspection Scope
The inspectors performed a review of the licensees CAP and associated documents to identify trends that could indicate the existence of a more significant safety issue. The inspectors review was focused on repetitive equipment issues, but also considered the results of daily inspector CAP item screening discussed in Section 4OA2.1 above, licensee trending efforts, and licensee human performance results. The inspectors review nominally considered the 6-month period of December 2016 through May 2017, although some examples expanded beyond those dates where the scope of the potential trend warranted.
The review also included issues documented outside the CAP in major equipment problem lists, repetitive and/or rework maintenance lists, departmental problem/challenges lists, system health reports, quality assurance audit/surveillance reports, self-assessment reports, and Maintenance Rule assessments. The inspectors compared and contrasted their results with the results contained in the licensees CAP trending reports. Corrective actions associated with a sample of the issues identified in the licensees trending reports were reviewed for adequacy.
This review constituted one semi-annual trend review inspection sample as defined in IP 71152.
b. Findings
No findings were identified.
.3 Annual Follow-up of Selected Issues: Site Evaluation of Vulnerability for Emergency
Diesel Generator Fuel Injector Pump Delivery Valve Holder Cracking Reported to the NRC under Part 21
a. Inspection Scope
The inspectors selected the following IRs for in-depth review:
- IR 03955974; D.C. Cook Cracks in EDG Fuel Injector Pump delivery valve holder (DVH).
As appropriate, the inspectors verified the following attributes during their review of the licensee's corrective actions for the above IRs and other related IRs:
- complete and accurate identification of the problem in a timely manner commensurate with its safety significance and ease of discovery;
- evaluation and disposition of operability/functionality/reportability issues;
- evaluation of identified root and contributing causes of the problem; and
- completion of assigned actions in a timely manner commensurate with the safety significance of the issue.
The station engineer communicated with the Part 21 originator to ascertain the specific details of the failure. Although Byron station EDGs used the same model DVH as the D.C. Cook machines, the operating pressure of the injector was significantly lower at Byron station. In addition, the Byron application of the DVH did not have the machined modification reported to contribute to the fatigue cracking at D.C. Cook. The engineer conducted field inspections of each diesel during machine operation as part of his evaluation. As a result, the final evaluation concluded that the Byron DVHs were not susceptible to the same failure. The NRC inspectors performed independent walk downs on all EDGs while the machines were operating to verify the condition described in the Part 21 were not present at the station.
This review constituted one in-depth problem identification and resolution inspection sample as defined in IP 71152.
b. Findings
No findings were identified.
.4 Annual Follow-up of Selected Issues: Unit 1 East (1E) Main Power Transformer Group 1
Cooling Fans Supply Breaker Trip
a. Inspection Scope
The inspectors selected the following IRs for in-depth review:
- IR 03990691; 1E main power transformer (MPT) Group 1 Cooling Fans Supply Breaker Trip; and
- IR 03991415; 1E MPT Cooling Group 1 Troubleshooting Results.
The operator response to this event and the plant response to the event and subsequent transient were previously discussed in NRC Inspection Report 05000454(455)/2017001.
The inspectors verified the following attributes during their review of the licensee's corrective actions for the above IRs and other related IRs:
- complete and accurate identification of the problem in a timely manner commensurate with its safety significance and ease of discovery;
- consideration of the extent of condition, generic implications, common cause, and previous occurrences;
- evaluation and disposition of operability/functionality/reportability issues;
- classification and prioritization of the resolution of the problem commensurate with safety significance;
- identification of the root and contributing causes of the problem;
- identification of corrective actions, which were appropriately focused to correct the problem;
- completion of corrective actions in a timely manner commensurate with the safety significance of the issue; and
- applicability for operating experience and communicate applicable lessons learned to appropriate organizations.
This review constituted one in-depth problem identification and resolution inspection sample as defined in IP 71152.
b. Findings
Introduction:
A self-revealed Green finding was identified on March 28, 2017, when operators rapidly reduced generator load in response to a loss of forced cooling to the newly installed 1E MPT and indicated rapid rise in transformer winding hotspot temperature caused by vendor data entry errors in the monitoring system software. The process detailed in CC-AA-256-101, Software Quality Assurance Process for Plant Digital Instrumentation and Control Systems and Components, to verify and validate the software was not performed after the vendor made changes to the digital software during the modification process.
Description:
During the Unit 1 refueling outage in the spring of 2017, Byron Station installed two new main power transformers as a plant modification. The transformers were energized on March 26, 2017, with Cooling Group 1 selected as the lead cooling bank and Group 2 as the backup bank. Power ascension was in progress with the unit at 1162 MWe when the initial transformer trouble alarm was received at 1744 on March 28, 2017.
The breaker supplying Cooling Group 1 (6 fans and 3 oil pumps) tripped open. When the backup cooling group did not immediately start as the operators expected, the control room operators dispatched an equipment operator to investigate locally at the transformer and followed the actions listed in the alarm response procedure, BAR 1-19-B10, Main Transformer 1E Trouble. The BAR (alarm response procedure)indicated that the standby cooling fans and oil pumps should have started when the top oil temperature exceeded 65 degrees centigrade (°C) or winding temperature exceeded 75°C. The procedure also directed the operators to refer to 1BGP 100-3A12, Hyundai Transformer Operation Tables, for monitoring requirements and limits if transformer cooling was lost or damaged. The BAR subsequently directed operators to monitor oil and winding temperatures. Indication for key parameters (load, winding temperature, oil temperature and operating status) was available to the control room operators from the plant process computer.
1BGP 100-3A12 stated that the maximum temperature allowed by the vendor was 110°C and directed load reduction or removal of the transformer from service to prevent exceeding a MPT winding temperature of 130°C. The procedure also stated, A complete loss of cooling may result in temperature limits being reached in approximately 3 minutes. The BGP 100-3A12 Table listed six temperature points required to be maintained below 130°C; three HV (high voltage) winding data points and three LV (low voltage) winding data points. When the control room operators referred to the computer display for the transformer they saw two data points labeled Hotspot Temperature HV (high voltage) Winding and Hotspot Temperature LV (low voltage) Winding. Both of the data points were rising rapidly. On a separate screen, the operators located the six winding temperature points identified in the BGP and noted that they were apparently not changing. The operators concluded that although the rising hotspot temperature indications were not one of the procedurally identified points on the Temperature Monitoring Table of 1BGP 100-3A12, the computer points indicated temperature at some locations in the transformer were rising rapidly. Due to the high rate of temperature increase of the two indications, the operating crew took action based on the indication to rapidly reduce transformer loading to prevent potential damage to the transformer. At the calculated temperature reaching 75°C, the backup cooling group started, but the monitoring software did not recognize that cooling had been restored.
Shortly thereafter, the tripped supply breaker was reset. Group 1 transformer cooling restarted and the temperature then started to rapidly lower. The runback was terminated at 730 MWe.
Subsequent troubleshooting of the cooling group supply breaker identified that the compression fittings connecting the load side wiring to the breaker had loosened creating a high resistance connection and some arcing was evident on the B phase when the breaker was disassembled. The breaker was replaced and thermography used to evaluate potential extent of condition did not identify any similar vulnerabilities on other connection sites on either of the two new transformers.
Further analysis determined that the two hotspot indications were indicating falsely high temperatures. The licensee discovered that these two parameters were predicted winding temperatures calculated by the transformer monitoring computer based on load, top oil temperature and cooling capability. The transformer monitoring system perceived the breaker trip to be a complete loss of cooling capability because the two cooling supplies were modeled in the software so that if either cooling bank supply breaker was open, a complete loss of cooling was indicated. In addition, the parameters were reading falsely high because the vendor had changed the Current-Turns (CT) Ratio in the calculation, did not inform the licensees design team of the change and the error was not identified by the licensees modification review team. The result of these two errors was that the monitoring software/firmware calculated value rose rapidly indicating a severe overheating condition while actual temperature changed only about 2°C.
Analysis:
The inspectors determined that the failure to verify software changes during the modification and testing process was a performance deficiency that warranted review in the SDP. Specifically, the responsible engineer determined no additional testing or review was required due to the limited scope of the changes and did not implement the process outlined in CC-AA-256-101, Software Quality Assurance Process for Plant Digital Instrumentation and Control Systems and Components, to verify and validate the vendor software changes.
The inspectors concluded that the issue was more than minor because it was associated with the Design Control attribute of the Initiating Events Cornerstone and adversely impacted the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during plant operations. Specifically, rapid power changes or load reject could challenge operating safety limits. In this event, the rapid rise in the calculated winding hotspot indications and subsequent operator actions to rapidly reduce load over 300 MWe was primarily the result of the wrong CT Ratio included in the software for the transformer monitoring system implemented with the modification and the incorrect configuration of the MPT cooling system within the software.
The inspectors utilized Exhibit 1, Initiating Events Screening Questions of IMC 0609, Significance Determination Process, Appendix A, dated June 19, 2012, to evaluate the significance of the issue. The inspectors answered the Section B question as No because the event did not cause a reactor trip. The inspectors also answered the Section C question as No because the event did not affect any mitigation equipment.
As a result, the finding screened as Green, or of very low safety significance.
A cross-cutting aspect in the Challenge the Unknown element of the Human Performance Area (IMC 0310 H.11) was assigned because the engineering group based the risk evaluation on the vendor input that the scope of the change was limited. The flawed assumption that the vendor information was correct without verification resulted in a failure to manage the risk prior to implementation through the verification/validation of the software/firmware and was a direct contributor to the power reduction.
(IMC 0310 H.11)
Enforcement:
The inspectors did not identify a violation of regulatory requirements associated with this finding. The licensee initiated Inspection Reports 03990691 and 03991415 to document the event, troubleshooting, and corrective actions. (FIN 05000454/2017002-01; Failure to Verify Computer Software during a Transformer Replacement Modification). Corrective actions included replacement of the cooling group supply breaker, verification that no other electrical connections had degraded on either of the two transformers, correction of the software errors, and revision of the alarm response procedure and supporting documentation including the operator interface.
4OA3 Follow-Up of Events and Notices of Enforcement Discretion
.1 (Closed) Licensee Event Report 05000454/2017-001-00: Byron Station Unit 1
Volumetric and Surface Examinations of Reactor Pressure Vessel Head Penetration Nozzles Identify Indications Attributed to Primary Water Stress Corrosion Cracking and Minor Subsurface Void Enlargement from Operating Stresses.
During the spring 2017 refueling outage, volumetric and surface examinations of the Reactor Pressure Vessel (RPV) head penetration nozzles identified recordable indications on nozzles 31, 74, 76, and 77 that did not meet acceptance criteria.
Penetration 31 had been previously repaired and discovery of the indication was reported to the NRC in Event Report 52591 on March 3, 2017. On March 5, the station reported additional indications in Event Report 52592 and updated that report on March 6, 2017, to include the additional indications.
The inspectors reviewed the repair of these indications and associated documentation during the refueling outage and the results of that inspection were documented in Section 1R08 of NRC Inspection Report 05000454(455)/2017001. The inspectors subsequently reviewed the causal evaluations performed by the licensee. The issues were initially documented in the licensees CAP in IRs 03981261, 03981686, and 03982084. The causal evaluation for all three IRs is documented in IR 03981686.
The cause of the penetration 31 indications was determined to be existing welding discontinuities/minor subsurface voids opening to the surface or enlarging due to thermal and/or pressure stresses during operation. The other indications were determined to be caused by Primary Water Stress Corrosion Cracking (PWSCC). In all cases, the indications were removed by buffing or grinding. Byron Station implemented the Ultra High Pressure Cavitation Peening Process as a mitigating strategy to prevent further PWSCC degradation. This licensee event report (LER) is closed.
This event follow-up review constituted one sample as defined in IP 71153-05.
4OA6 Management Meetings
.1 Exit Meeting Summary
On July 11, 2017, the inspectors presented the inspection results to Mr. H. Welt, and other members of the licensee staff. The licensee acknowledged the issues presented.
The inspectors confirmed that none of the potential report input discussed was considered proprietary.
ATTACHMENT:
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee
- M. Kanavos, Site Vice President
- T. Chalmers, Plant Manager
- H. Welt, Operation Director
- D. Spitzer, Regulatory Assurance Manger
- S. Kerr, Manager - Projects
- G. Contrady, NRC Coordinator
- J. Armstrong, Organizational Effectiveness Manager
- T. Faley, Maintenance Director
- C. Cote, Shift Operations Superintendent
- Z. Cox, Regulatory Assurance
- S. Harvey, Chemistry Manager
- P. Boyle, Work Management Director
- C. Keller, Engineering Director
- K. McGuire, Senior Manager, Plant Engineering
- B. Barton, Radiation Protection Manager
U.S. Nuclear Regulatory Commission
- E. Duncan, Branch 3 Chief, Division of Reactor Projects
- J. McGhee, Byron Senior Resident Inspector
- C. Hunt, Byron Resident Inspector
Illinois Emergency Management Agency
- C. Thompson, Resident Inspector, IEMA
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
- 05000454/2017-001-00 LER Byron Station Unit 1 Volumetric and Surface Examinations of Reactor Pressure Vessel Head Penetration Nozzles Identify Indications Attributed to Primary Water Stress Corrosion Cracking and Minor Subsurface Void Enlargement from Operating Stresses
- 05000454/2017002-01 FIN Failure to Verify Computer Software during a Transformer Replacement Modification
Closed
- 05000454/2017-001-00 LER Byron Station Unit 1 Volumetric and Surface Examinations of Reactor Pressure Vessel Head Penetration Nozzles Identify Indications Attributed to Primary Water Stress Corrosion Cracking and Minor Subsurface Void Enlargement from Operating Stresses
- 05000454/2017002-01 FIN Failure to Verify Computer Software during a Transformer Replacement Modification