IR 05000336/2011008
| ML111470484 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 05/27/2011 |
| From: | Chris Miller Division of Reactor Safety I |
| To: | Heacock D Dominion Resources |
| miller, chris ri\\drs 610-337-5128 | |
| References | |
| EA-11-047 IR-11-008 | |
| Download: ML111470484 (37) | |
Text
SUBJECT:
MILLSTONE POWER STATION UNIT 2 - NRC SPECIAL INSPECTION REPORT 05000336/201 1 008; PRELIMINARY WHITE FINDING
Dear Mr. Heacock:
On April 14,2011, the U. S. Nuclear Regulatory Commission (NRC) completed a Special Inspection at your Millstone Power Station (Millstone) Unit 2. The inspection was conducted in response to an unanticipated reactor power transient event that occurred on February 12,2011.
The NRC's initial evaluation of this event satisfied the criteria in NRC lnspection Manual Chapter 0309, "Reactive Inspection Decision Basis for Reactors," for conducting a special inspection. The Special Inspection Team (SlT) Charter (Attachment 2 of the enclosed report)
provides the basis and additional details concerning the scope of the inspection. The enclosed inspection report documents the inspection results, which were discussed at the exit meeting on April 1 4, 2011, with Mr. A. J. Jordan, Millstone Site Vice President, and other members of your staff.
The Special lnspection Team (the team) examined activities conducted under your license as they relate to safety and compliance with Commission rules and regulations and with the conditions of your license. The team reviewed selected procedures and records, observed activities, and interviewed personnel. In particular, the team reviewed event evaluations, causal investigations, relevant performance history, and extent-of-condition to assess the significance and potential consequences of issues related to the February 12 event.
The team concluded that the plant operated within acceptable power limits and no equipment malfunctioned during the power transient. Nonetheless, the team identified several issues related to procedure discrepancies and human performance that complicated the event.
Additionally, the team noted that Dominion's initial response to the event was not appropriately thorough and timely, did not highlight the significance of the unplanned power increase and reactivity control issues, and was narrowly focused. The enclosed chronology (Attachment 3 of the enclosed report) provides additional details regarding the sequence of events and event complications.
This report documents one finding that, using the reactor safety Significance Determination Process (SDP), has preliminarily been determined to be White, or of low to moderate safety significance. The finding is associated with a performance deficiency involving the failure of Millstone personnel to carry out their assigned roles and responsibilities and inadequate a.**
ttnut t-W;
+**tt reactivity management during main turbine control valve testing, which contributed to the unanticipated reactor power increase. Specifically, the Millstone Unit 2 operations crew failed to implement written procedures that delineated appropriate authorities and responsibilities for safe operation and shutdown, and a procedure for controlling reactor reactivity. In addition, the licensee failed to establish written procedures for Reactor Protection System (RPS) Variable High-Power Trip (VHT) setpoint reset and for power operation and transients involving multiple reactivity additions.
This finding was assessed using NRC Inspection Manual Chapter (lMC) 0609, Appendix M,
"SDP Using Qualitative Criteria," because it involved human performance errors. Preliminarily, the NRC has determined this finding to be of low to moderate safety significance based on a qualitative assessment. There were no immediate safety concerns following the transient because the event itself did not result in power exceeding license limits or fuel damage.
Additionally, interim corrective actions were taken, which included removing the Millstone Unit 2 control room crew involved in the transient from operational duties pending remediation, and establishment of continuous management presence in the Millstone Unit 2 control room while long term corrective actions were developed.
The finding involved two apparent violations (AVs) of NRC requirements involving Technical Specification 6.8, "Procedures," that are being considered for escalated enforcement action in accordance with the Enforcement Policy, which can be found on NRC's Web site at http://www. nrc.oov/readinq-rom/doc-collections/enforcemenU.
In accordance with NRC Inspection Manual Chapter (lMC) 0609, we will complete our evaluation using the best available information and issue our final determination of safety significance within 90 days of the date of this letter. The significance determination process encourages an open dialogue between the NRC staff and the licensee; however, the dialogue should nbt impact the timeliness of the staff's final determination. Before we make a final decision on this matter, we are providing you with an opportunity to (1) attend a Regulatory Conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2) submit your position on the finding to the NRC in writing. lf you request a Regulatory Conference, it should be held within 30 days of your response to this letter, and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. lf a Regulatory Conference is held, it will be open for public observation. lf you decide to submit only a written response, such submittal should be sent to the NRC within 30 days of your receipt of this letter. lf you decline to request a Regulatory Conference or submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either, you failto meet the appeal requirements stated in the Prerequisite and Limitation Sections of Attachment 2 of IMC 0609.
Please contact Sam Hansell by telephone at (610) 337-5046 and in writing within 10 days from the issue date of this letter to notify the NRC of your intentions. lf we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision.
The final resolution of this matter will be conveyed in separate correspondence.
Because the NRC has not made a final determination in this matter, no Notice of Violation is being issued for this inspection finding at this time. Please be advised that the number and charicterization of the apparent violations described in the enclosed inspection report may change as a result of further NRC review. In addition, the report documents one self-revealing finding, of very low safety significance (Green). This finding did not involve a violation of NRC requirements.
ln accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any)will be available electronically for public inspection in the NRC Public Document Room and from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.qov/readinq-rm/adams.html (the Public Electronic Reading Room).
Sincerely, p2zz*
Christopher G. Miller, Director Division of Reactor Safety Docket No. 50-336 License No. DPR-65 Enclosure: lnspection Report05000336/2011008 w/Attachments: Supplemental Information (Attachment 1)
Special Inspection Team Charter (Attachment 2)
Detailed Sequence of Events (Attachment 3)
Appendix M Table 4.1 (Attachment 4)
cc w/encl: Distribution via ListServ
SUMMARY OF FINDINGS
lR 0500033 612011008; 0212212011 - 0411412011; Millstone Nuclear Power Station (Millstone)
Unit 2; Special lnspection for the February 12,2011, Unanticipated Reactor Power Transient Event; lnspection Procedure 93812, Special Inspection.
A three-person NRC team, comprised of two regional inspectors and one resident inspector, conducted this Special Inspection. One representative from the State of Connecticut,
Department of Environmental Protection accompanied the team. One finding with potentialfor greater than Green safety significance and one Green finding were identified. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using lnspection Manual Chapter (lMC) 0609, "Significance Determination Process" (SDP); the crosscutting aspect was determined using IMC 0310, "Components Within the Cross Cutting Areas;" and findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 4, dated December 2006.
NRC ldentified and Self Revealing Findings
Cornerstone: Initiating Events
.LrgI@:Aself-revealingfindingWaSidentifiedinvolvingthefailureof lrltittstone personnel to carry out their assigned roles and responsibilities and inadequate reactivity management during main turbine control valve testing on February 12,2011, which contributed to the unanticipated reactor power increase. Specifically, the Millstone Unit 2 operations crew failed to implement written procedures that delineated appropriate authorities and responsibilities for safe operation and shutdown and a procedure for controlling reactor reactivity. ln addition, the licensee failed to establish written procedures for the Reactor Protection System (RPS) Variable High-Power Trip (VHT), and for power operation and transients involving multiple reactivity additions.
The finding has preliminarily been determined to be White, or of low to moderate safety significance. The finding is also associated with two apparent violations of NRC requirements specified by Technical Specifications. There were no immediate safety concerns following the transient because the event itself did not result in power exceeding license limits or fuel damage. Additionally, interim corrective actions were taken, which included removing the Millstone Unit 2 control room crew involved in the transient from operational duties pending remediation, and establishment of continuous management presence in the Millstone Unit 2 control room while long term corrective actions were developed. Dominion entered this issue, including the evaluation of extent-of-condition, into the corrective action program (CR413602) and performed a root cause evaluation (RCE).
The finding is more than minor because the performance deficiency (PD) was associated with the human performance attribute of the Initiating Events cornerstone and affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during power operations. Additionally, the PD could be viewed as a precursor to a significant event. Because the finding primarily involved human performance errors, probabilistic risk assessment tools were not well suited for evaluating its significance. The team determined that the criteria for using IMC 0609, Appendix M, "significance Determination Process Using Qualitative Criteria," were met, and the finding was evaluated using this guidance, as described in Attachment 4 to this report. Based on the qualitative review of this finding, regional management concluded the finding was preliminary of low to moderate safety significance (preliminary White).
The team determined that the PD resulted from several causes; however, the team concluded that the primary cause was ineffective reinforcement of Dominion standards and expectations. The team also concluded that this finding had a cross-cutting aspect in the Human Performance area, Decision Making component, because Dominion licensed personnel did not make the appropriate safety-significant decisions, especially when faced with uncertain or unexpected plant conditions to ensure safety was maintained. This includes formally defining the authority and roles for decisions affecting nuclear safety, communicating these roles to applicable personnel, and implementing these roles and authorities as designed H.1(a). (Section 2'1)
Green: The team identified a self-revealing finding of very low safety significance tCreenl for improper operation of the turbine controls during turbine control valve testing.
Specifically, the inspectors identified that control room operators failed to correctly implement surveillance procedure SP-2651N, "Main Control Valve Testing." Incorrect operation of the turbine controls caused an unplanned power increase from 88 percent to 96 percent. Dominion entered this issue into the corrective action program (cR4150e4).
The team determined that this finding was more than minor because it was similar to NRC Inspection Manual Chapter 0612, Appendix E, "Examples of Minor lssues," Example 4b, in that the incorrect operation of the turbine load selector pushbutton caused a plant transient. The finding was associated with the human performance attribute of the Initiating Events cornerstone and affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during power operations. The team concluded that the finding was of very [ow safety significance (Green) because it did not contribute to both the likelihood of a reactor trip and the likelihood that mitigation equipment or functions would not be available. Enforcement action does not apply because the performance deficiency did not involve a violation of a regulatory requirement. The team also determined that the finding had a cross-cutting aspect in the Human Performance area, Resources component, because Dominion did not provide adequate training of personnel and sufficient qualified personnel H.2(b). (Section 2.2)
1.
REPORT DETAILS
Backqround and Description of Event In accordance with the Special Inspection Team (SlT) Charter (Attachment 2), team members (the team) conducted a detailed review of the February 12,2011, unanticipated reactor power transient event at Millstone Nuclear Power Station (Millstone) Unit 2, including a review of Millstone Unit 2 operators' response to the event. The team gathered information from the plant process computer (PPC) alarm printouts and parameter trends, interviewed station personnel, observed an event reconstruction on the simulator, observed on-going control room activities, and reviewed procedures, logs, and various technical documents to develop a detailed timeline of the event (Attachment 3).
On Saturday February 12,2011, Millstone Unit 2 experienced an unintended 8 percent reactor power transient (88 percent to 96 percent) during the performance of quarterly main turbine control valve testing. As more fully described below, the transient was caused by multiple human performance errors committed independently by the operators involved with the testing, and was compounded by problems in communications and command and control.
Two days prior to the event, the control room operating crew that was involved with the event attended a four hour just-in-time simulator training session for the planned reactor power decrease to 88 percent and the Millstone Unit 2 main turbine control valve testing evolution. The crew also received a briefing on the planned evolution from Millstone Operations Department management on February 12, just prior to beginning the main turbine control valve test.
On the day of the Millstone Unit 2 main turbine control valve test, the Millstone Unit 2 control room was staffed with the following normalfive-person crew complement:
.
Shift Manager (SM);
.
Unit Supervisor (US);
'
Operator At The Controls Reactor Operator (OATC RO);
.
Balance of Plant Reactor Operator (BOP RO); and
.
Shift TechnicalAdvisor (STA), a non-licensed position.
Additionally, 3 other individuals were in the control room specifically to support performance of the test:
.
an SRO-licensed and SM-qualified individualto provide operations management oversight;
.
an SRO-licensed individual designated as the "Reactivity SRO" to directly supervise all reactivity changes; and
.
a Reactor Engineer to assist with development and implementation of the reactivity plan.
lnitial conditions for the control valve testing were established as follows:
1. Unit 2 reactor power was reduced to 88 percent.
2. The main turbine valve control was transferred from Load Limit to Load Set,
applying a control signal to position the turbine control valves to maintain the existing main generator load.
3. The crew adjusted turbine load and the turbine bypass valve controller automatic
setpoint to open one of the turbine bypass valves approximately 10 percent.
Turbine bypass flow is established by the test procedure to allow the turbine bypass controller to automatically compensate for any small steam flow perturbations, thereby maintaining constant reactor power during testing.
A 600 gallon reactor coolant system (RCS) dilution was initiated to compensate for the effects of core fission product poison (Xenon) concentration changes initiated by the reactor power reduction.
The test procedure provided direction to the operators to maintain constant turbine first stage pressure (t 10 psig) using the Load Set INCREASE and DECREASE pushbuttons while slowly rotating the turbine first stage pressure feedback potentiometer from the OUT to the lN position over a one minute period. lnsertion of first stage pressure feedback into the control loop ensures the control valves change position in response to changes in first stage pressure, which varies linearly with turbine load. When a control valve is stroked closed for testing, load set control with first stage pressure feedback attempts to automatically maintain turbine load constant by opening the other three control valves in response to decreasing first stage pressure.
At approximately 11:30 am, the BOP RO correctly began rotating the turbine first stage pressure potentiometer toward the lN position. However, in response to increasing turbine first stage pressure, the BOP RO incorrectly depressed the INCREASE load selector button (rather than the DECREASE load selector button), thereby increasing steam supplied to the turbine and further increasing first stage pressure. When the operator did not get the desired response (a reduction in first stage pressure), the BOP RO pressed the INCREASE pushbutton 3 more times, followed by two depressions of the DECREASE pushbutton. The increased steam demand by the turbine resulted in lower RCS cold leg temperature, the automatic closure of the one partially open turbine bypass valve, and a reactor power transient over a three minute period which peaked at 96 percent power.
Neither the STA (who was performing the peer-check) nor the US (who was observing the test) initially corrected the BOP RO, because both also incorrectly believed pressing the INCREASE button was the correct action. Additionally, none of these three individuals informed the rest of the crew that they had an unexpected response and that a transient was in progress.
2. 2.1
a.
At the onset of the event, the RPS VHT setpoints were below 96 percent (Ch A at 95,7 percent, Ch B at 95.4 percent, Ch C at 94.9 percent, and Ch D at94.4 percent). During the turbine transient, reactor power increased toward the VHT setpoints. The Reactivity SRO observed the illumination of the VHT setpoint reset permissive lights (one light per RPS channel), and incorrectly assumed they were illuminating due to minor power fluctuations associated with the fission product poison build-in and on-going RCS dilution. Consequently, he increased the margin to the trip setpoint by resetting the VHT setpoints upward four times during the power rise. lf the SRO had not reset the VHT, the RPS would have automatically initiated a high power reactor trip due to the magnitude of the reactor power increase from 88 to 96 percent. In addition to preventing the automatic trip, the Reactivity SRO did not understand or question why reactor power was increasing, and did not inform anyone on the crew of his actions to reset the VHT setpoints.
The SM observed the closure of the partially open turbine bypass valve and directed the OATC RO to lower the turbine bypass valve controller setpoint to re-open the valve and directed the Reactivity SRO to withdraw one bank of control rods four steps to raise reactor temperature. Each of these actions added further positive reactivity and contributed to the reactor power increase. He also directed the US to return to a position of oversight and he directed the BOP RO to stop manipulating turbine controls.
After the plant stabilized, the SM incorrectly determined that the power transient had been limited to a maximum of four percent power, based on using the excore nuclear instruments instead of the more accurate Q-power indication, and decided to complete the turbine control valve testing before the end of the shift. Excore nuclear instruments did not accurately indicate the amount of the power increase due to normal instrument behavior in a significantly reduced primary coolant temperature environment. The full extent of the power transient was not identified until the next day when Millstone reactor engineers completed a formal assessment of the transient.
Human Performance Overall Crew Performance Inspection Scope The team interviewed the Millstone Unit 2 control room personnelthat responded to the February 12,2011, event, including four SROs (SM, US, reactivity SRO, operations manager assigned to oversee evolution), two ROs (OATC RO, BOP RO), the STA and the Reactor Engineer to determine whether these personnel performed their duties in accordance with plant procedures and training. The team also reviewed narrative logs, sequence of events and alarm printouts, condition reports, PPC trend data, procedures implemented by the crew, and procedures regarding roles and responsibilities of operations personnel.
b. Findinqs/Observations Multiple Examples of Procedural Violations and Inadequate Procedures Relatinq to Control Room Crew Performance Durinq a Plant Transient lntroduction: A self-revealing finding was identified involving the failure of Millstone personnel to carry out their assigned roles and responsibilities and poor reactivity management during main turbine control valve testing on February 12,2011, which contributed to the unanticipated reactor power increase. Specifically, the Millstone Unit 2 operations crew failed to implement written procedures that delineated appropriate authorities and responsibilities for safe operation and shutdown and a procedure for controlling reactor reactivity. In addition, the licensee failed to establish written procedures for the RPS VHT setpoint reset and for power operation and transients involving multiple reactivity additions.
The finding has preliminarily been determined to be White, or of low to moderate safety significance. The finding is also associated with two apparent violations of NRC requirements specified by Technical Specifications. There were no immediate safety concerns following the transient because the event itself did not result in power exceeding license limits or fuel damage. Additionally, interim corrective actions were taken, which included removing the Millstone Unit 2 control room crew involved in the transient from operational duties pending remediation, and establishment of continuous management presence in the Millstone Unit 2 control room while long term corrective actions were developed.
Description:
On February 12,2011, the Millstone Unit 2 control room crew was preparing to perform quarterly main turbine control valve testing. The unit was at 88 percent reactor power with one turbine bypass valve 10 percent open in automatic and the main turbine on Load Set control. Operators were in the process of placing turbine first stage pressure feedback in service.
During the conduct of the main turbine control valve testing, multiple operators failed to correctly implement written procedures as described below:
a. Dominion Procedure OP-AP-300, "Reactivity Management," states the Reactor Operator will stop and question unexpected situations involving reactivity, criticality, power level, or core anomalies and will meet the anomalous indication with conservative action. Dominion Procedure OP-AA-106, "lnfrequently Conducted or Complex Evolutions," establishes expectations for the need to stop the test or evolution when unexpected conditions arise or unexpected behavior is experienced.
However, as the BOP RO placed turbine first stage pressure feedback in service, he noted an increase in first stage pressure and incorrectly pressed the turbine load set INCREASE pushbutton instead of the DECREASE pushbutton. When the BOP RO did not get the desired response, he depressed the INCREASE pushbutton three more times, followed by two depressions of the DECREASE pushbutton, rather than stopping in the face of uncertainty as expected. The actions by the BOP RO resulted in a rapid, unintended reactor power rise.
b.
I Dominion Procedure OP-AP-300, "Reactivity Management," states the Shift Technical Advisor will provide engineering expertise to shift operators, as required, during periods of significant reactivity changes. However, the STA was peer-checking the turbine manipulations and did not identify that the BOP RO actions were incorrect. Because the STA was dedicated to supporting the turbine evolution as the peer checker, he was unable to remain within his assigned role and did not provide his engineering expertise to the crew regarding the multiple inappropriate reactivity additions by other members of the crew.
Dominion Procedure OP-AA-100, "Conduct of Operations," states the Unit Supervisor will provide oversight of plant operations and ensure the plant is operated safely in accordance with procedures. Dominion Procedure OP-AP-300, "Reactivity Management," states the Unit Supervisor will direct reactivity changes and ensure reactivity manipulations are made in a deliberate, carefully controlled manner.
However, the US was focused on the turbine evolution during the event and did not provide effective oversight to the crew in responding to the power rise. The US also did not initially identify that the BOP RO should have been depressing the DECREASE rather than the INCREASE pushbutton. After the SM directed the US to resume his oversight role, the US did not clearly report to the rest of the crew that a power increase was in progress.
Dominion Procedure OP-AA-100, "Conduct of Operations," states the Shift Manager will maintain a broad perspective of plant operations as the senior management representative on shift. However, the SM did not recognize that turbine operations were causing changes in plant parameters. He observed the closure of the partially open turbine bypass valve and, believing this to be the result of the effects of fission product poison build-in, directed the OATC RO to lower the turbine bypass valve controller setpoint to re-open the valve.
Dominion Procedure OP-AP-300, "Reactivity Management," States the Reactor Operator will stop and question unexpected situations involving reactivity, criticality, power level, or core anomalies and will meet the anomalous indication with conservative action. However, the OATC RO, who was adding positive reactivity by diluting the RCS at the time, followed the SM's direction without question and adjusted the turbine bypass valve setpoint to reopen the valve, thereby adding additional positive reactivity to the core. The Millstone Unit 2 control room crew had practiced the control valve testing evolution on the simulator two days prior to the event with the OATC RO monitoring the turbine bypass valve position. This training apparently led the OATC RO to think his primary responsibility during the event was turbine bypass valve monitoring and control rather than his other reactivity control responsibilities as the Operator at the Controls.
Dominion Procedure OP-AP-300, "Reactivity Management," States that adding positive reactivity is never an appropriate way to address unstable plant conditions, and also that it is non-conservative to withdraw control rods in an attempt to restore primary coolant temperature during a transient. However, after directing reopening of the turbine bypass valve, the SM directed the Reactivity SRO to withdraw one bank d.
e.
f.
of control rods four steps to raise reactor temperature. This action added positive reactivity, thereby further exacerbating the power increase.
g. Dominion Procedure OP-AP-300, "Reactivity Management," states the Reactivity SRO reports to the Unit Supervisor, has no concurrent duties, directly monitors the reactivity change, and will provide peer checks for the reactor operator for all reactivity manipulations. The Reactivity SRO had been monitoring the rod repositioning and RCS dilutions that were performed by the OATC RO as expected.
When the OATC RO began monitoring turbine bypass valve position, the Reactivity SRO continued to monitor the ongoing RCS dilution. The Reactivity SRO believed that if he needed to personally manipulate any controls, he would no longer be acting as the Reactivity SRO. When the SM directed rod withdrawal, the Reactivity SRO glanced at a digital readout of RCS temperature, and, not noticing any change in the parameter, incorrectly concluded the plant was not in a transient and withdrew control rods.
h. Dominion Procedure OP-AA-106, "lnfrequently Conducted or Complex Evolutions,"
states the Senior Operations Manager assigned to oversight of the test will ensure tests are conducted in a manner that maximizes the margin of safety of the Unit. An SRO-licensed and SM-qualified individualwas assigned to the control room to provide operations management oversight of the power reduction and testing for this infrequently performed evolution. His responsibilities included ensuring that the test was conducted in a manner that maximizes the margin of safety of the unit.
However, this individual did not identify that the multiple reactivity additions, which were made during the transient, were inappropriate, either during or following the transient. He also did not identify that any members of the crew deviated from expected roles and responsibilities during the transient.
ln addition to the failures by the Millstone Unit 2 control room crew to implement written procedures, the unplanned reactor power transient event was further exacerbated by the lack of written procedures for operation of the reactor protection system and for specific actions for power operation and transients involving multiple reactivity additions.
Specific examples of these failures are provided below:
a. At the onset of the event, the RPS VHT setpoints were below 96 percent. During the turbine transient, reactor power increased toward the VHT setpoints. The Reactivity SRO observed the illumination of the VHT setpoint reset permissive lights (one light per RPS channel), and incorrectly assumed they were illuminating due to minor power fluctuations associated with the fission product poison increase and on-going dilution. Consequently, he increased the margin to the trip setpoint by resetting the VHT setpoints upward four times during the power rise. lf the SRO had not reset the VHT, the RPS would have automatically initiated a high power reactor trip due to the magnitude of the power increase from 88 percent to 96 percent. In addition to preventing the automatic trip, the Reactivity SRO did not understand or question why reactor power was increasing, and did not inform anyone on the crew of his actions to reset the VHT setpoints. The inspection team reviewed existing station procedures, and determined that there was no procedural prohibition for resetting the VHT setpoint under any conditions.
b. During the turbine steam flow increase power transient event (which introduced positive reactivity to the reactor), the crew also added positive reactivity by 1) an on-going RCS dilution, 2) opening a turbine bypass valve, and 3) withdrawing control rods. The inspection team identified that station reactivity management procedures did not provide adequate guidance regarding multiple, concurrent, positive reactivity additions during power operations.
Analvsis: The performance deficiency was the failure of Millstone personnel to carry out their assigned roles and responsibilities and poor reactivity management during main turbine control valve testing, which contributed to the unanticipated reactor power increase. Specifically, the Millstone Unit 2 operations crew failed to implement written procedures that delineated appropriate authorities and responsibilities for safe operation and shutdown and a procedure for controlling reactor reactivity. In addition, the licensee failed to establish written procedures for the RPS VHT setpoint reset and for power operation and transients involving multiple reactivity additions. Multiple factors contributed to this deficiency; however, the primary cause was ineffective reinforcement of Dominion standards and expectations. Traditional enforcement does not apply since there were no actual safety consequences, impacts on the NRC's ability to perform its regulatory function, or willful aspects to the finding.
The finding is more than minor because the finding was associated with the Human Performance attribute of the Initiating Events cornerstone and affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during power operations. Additionally, the PD could be viewed as a precursor to a significant event. Because the finding primarily involved human performance errors, probabilistic risk assessment tools were not well suited for evaluating its significance. The team determined that the criteria for using IMC 0609, Appendix M, "significance Determination Process Using Qualitative Criteria," were met, and the finding was evaluated using this guidance as described in Attachment 4 to this report. Based on the qualitative review of this finding, regional management concluded the finding was preliminarily of low to moderate safety significance (preliminary White).
The completed Appendix M table is attached (Attachment 4). There were no immediate safety concerns following the transient because the event itself did not result in power exceeding license limits or fuel damage. Additionally, interim corrective actions were taken, which included removing the Millstone Unit 2 control room crew involved in the transient from operational duties pending remediation, and establishment of continuous management presence in the Millstone Unit 2 control room while long term corrective actions were developed.
This finding had a cross-cutting aspect in the Human Performance cross-cutting area, Decision Making component, because Dominion licensed personneldid not demonstrate adequate operational decision-making, especially when faced with uncertain or unexpected plant conditions. This includes formally defining the authority and roles for decisions affecting nuclear safety, communicating these roles to applicable personnel, and implementing these roles and authorities as designed H.1(a).
Enforcement:
The team identified two apparent violations of Technical Specification 6.8, "Procedures," which states, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Appendix "A" of Regulatory Guide (RG) 1.33, February, 1978. Regulatory Guide 1.33, Appendix "A," Paragraph 1, "Administrative Procedures," requires written procedures for authorities and responsibilities for safe operation and shutdown as well as general plant operating procedures appropriate for power operation and transients. Regulatory Guide 1.33, Appendix A, Paragraph 3, "Procedures for Startup, Operation, and Shutdown of Safety-Related PWR Systems," requires, in part, written procedures for changing modes of operation, as appropriate, for the reactor control and protection system. Regulatory Guide 1.33, Appendix A, Paragraph 5, "Procedures Abnormal, Off-normal, or Alarm Conditions," requires, in part, written procedures for other expected transients that may be applicable.
The first apparent violation involved the failure of the Millstone Unit 2 control room crew to implement written procedures that delineated appropriate authorities and responsibilities for safe operation and shutdown and a procedure for controlling reactor reactivity. As noted in the Description section above, on February 12,2011, the seven operators in the control room (4 SROs, 2 ROs and 1 non-licensed operator)inadequately implemented Dominion procedures for authorities and responsibilities for safe operation and shutdown during the performance of main turbine controlvalve testing. The inappropriate actions of the operators directly contributed to an unanticipated 8 percent increase in Millstone Unit 2 reactor power' The second apparent violation involved the licensee's failure to establish written procedures for the RPS VHT setpoint reset and for power operation and transients involving multiple reactivity additions. As noted in the Description section above, on February 12,2011, Dominion did not have written procedures regarding operation of the Millstone Unit 2 VHT setpoint reset pushbuttons (a part of the reactor protection system)during steady-state or plant transient conditions. As a result, during the unanticipated plant transient on February 12,2011, a Millstone Unit 2 SRO reset the VHT setpoint a total of four times without adequate guidance from a plant procedure, thereby prohibiting the automatic trip that would have occurred, had the VHT setpoint not been reset.
Additionally, Dominion did not have an adequate written procedure related to reactivity control regarding multiple concurrent positive reactivity additions during at-power operations. Specifically, during the unanticipated reactor transient event, three separate positive reactivity additions occurred (RCS dilution, manual opening of a turbine bypass valve, and manual withdrawal of control rods), and the existing procedures did not provide guidance to address this situation.
Following review of the event, the licensee documented the condition in the corrective action process (CR 413602). lmmediate corrective actions included removal of the Millstone Unit 2 control room crew involved in the transient from operational duties pending remediation, issuance of a Standing Order regarding VHT setpoint reset, and establishment of continuous management presence in the Millstone Unit 2 control room while long term corrective actions were developed.
2.2 Pending determination of final safety significance, this finding with the associated apparent violations will be tracked as AV 05000336/2011008-01, Multiple Examples of ProceduralViolations and Inadequate Procedures Relating to Control Room Crew Performance During a Plant Transient.
Turbine Operation Inspection Scope The team interviewed the control room personnel that were directly involved with the turbine load increase during the Febr:uary 12,2011, unanticipated reactor transient event. The team also reviewed narrative logs, sequence of events and alarm printouts, condition reports, PPC trend data, procedures implemented by the crew, and procedures regarding roles and responsibilities of operations personnel.
Find inos/Observations lmproper Operation of Turbine Control Valves During Testinq lntroduction: The inspectors identified a self-revealing finding of very low safety significance (Green) for improper operation of the Millstone Unit 2 turbine controls during turbine control valve testing. Specifically, the inspectors identified that Millstone Unit 2 control room operators failed to correctly implement surveillance procedure SP-2651N, "Main Control Valve Testing." Incorrect operation of the turbine controls contributed to an unplanned reactor power increase from 88 percent to 96 percent'
Description:
On February 12,2011, the Millstone Unit 2 control room operators incorrectly performed step 4.1
.1 3.c of SP-2651 N while conducting main turbine control
valve testing. This step required the operator to use the turbine load selector pushbutton to maintain turbine first stage pressure within t10 psig of the initial pressure for the current power level, 88 percent. However, in response to an increasing trend in first stage pressure, the control operators improperly selected "INCREASE" on the turbine load set selector pushbutton instead of "DECREASE". This action caused the turbine control valve to further open and compounded the increasing trend in turbine first stage pressure. The control operators pushed the "INCREASE" pushbutton a total of four times before the operators recognized that they should have, instead, pressed the "DECREASE" pushbutton. The operators subsequently took action to stop the power increase and stabilize the plant by depressing the "DECREASE" push button twice. The unexpected turbine load increase resulted in a plant transient, raising reactor power from 88 percent to 96 percent before power was stabilized.
The STA conducted peer checking for the control operator during the control valve testing evolution and the US closely supervised the operation of the turbine controls.
Both individuals failed to identify or correct the mis-operation of the turbine load selector.
All three operators then failed to communicate the extent of the plant transient to the SM which contributed to additional human performance errors, thereby exacerbating the plant transient.
a.
b.
Analysis:
The team determined that the control room operator's failure to correctly implement step 4.1
.13. c of SP-2651 N was a performance deficiency. The cause of this
performance deficiency was reasonably within Dominion's ability to foresee and correct to ensure proper operator response during turbine control valve testing. Traditional enforcement does not apply since there were no actual safety consequences, impacts on the NRC's ability to perform its regulatory function, or willful aspects to the finding.
The finding is more than minor because it was similar to NRC Inspection Manual Chapter 0612, Appendix E, "Examples of Minor lssues," Example 4b, in that the incorrect operation of the turbine load selector pushbutton caused a plant transient.
The finding was associated with the Human Performance attribute of the Initiating Events cornerstone and affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during power operations. Specifically, the mis-operation of the turbine load selector upset plant stability by causing a plant transient that raised reactor power from 88 percent to 96 percent. The inspectors conducted a Phase 1 screening in accordance with NRC IMC 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," and determined that the finding was of very low safety significance (Green) because it did not contribute to both the likelihood of a reactor trip and the likelihood that mitigation equipment or functions would not be available.
The inspectors determined that this finding had a cross-cutting aspect in the Human Performance cross-cutting area, Resources component, because Dominion did not provide adequate training of personnel and sufficient qualified personnel H.2(b). The just-in-time training (JITT) for turbine control valve testing had not adequately prepared the control room operators to respond to a change in turbine first stage pressure. ln addition, the use of the STA for peer checking, although not prohibited by plant administrative procedures, had been previously identified during recent (May 2010)licensed operator requalification training in plant-specific operating experience as being a contributing cause for a plant transient during control valve testing on Unit 3 in 20Q7.
Nevertheless, the shift allowed the STA, who was not licensed, to be the peer checker for this evolution in place of a qualified licensed reactor operator.
Enforcement:
This finding does not involve enforcement action because no regulatory requirement violation was identified. Dominion entered this issue into their corrective action program (CR415094) and conducted an RCE to determine corrective actions to prevent recurrence. Because this finding does not involve a violation of regulatory requirements and has very low safety significance, it is identified as FIN 05000336/2011008-02, lmproper Operation of Turbine Gontrol Valves During Testing.
3. 3.1
Orqanizational Response lmmediate Response Inspection Scope The team interviewed personnel, reviewed various procedures and records, and observed control room operations to assess immediate response of station personnel to the unanticipated reactor power transient event.
Findinqs No findings of significance were identified.
The team noted that Dominion's initial response to the event was not appropriately thorough and timely, did not highlight the significance of the unplanned power increase and reactivity control issues, and was narrowly focused. Following postevent plant stabilization, a crew brief was conducted to assure good common understanding of transient and to determine whether testing should proceed. However, the crew did not identify the many human performance issues during the event, including control rod withdrawal, VHT reset, steam dump operation, multiple communication errors, and incorrect transient diagnoses.
lnitially, Dominion personnel incorrectly concluded that Unit 2 reactor power increased by four percent (rather than the actual eight percent) during the transient. This extent of power increase was challenged during immediate post-event discussions between bominion managers, but the Dominion management team did not correctly identify the extent of the power rise until the following day. Based on an incomplete and inaccurate initial assessment of the event, Crew D was allowed to complete the test, return power to 100% and stand an additional shift in the control room the following day before Dominion management removed them from operating duties. Although all of Crew D was off-shift the following week (per normal shift rotation), two of the individuals involved in the human performance errors were not formally disqualified from watchstanding until several days after the event, after NRC questioned Dominion's basis for not disqualifying those individuals. As of two weeks after the event, Dominion had only generated two condition reports related to the event and these two condition reports did not address all identified deficiencies related to the event. See the detailed sequence of events (Attachment 3).
Millstone Operations department management issued a new standing order related to VHT setpoint reset. However, a number of weeks elapsed before operating procedures were revised to provide updated approved plant procedures for the VHT setpoint operation.
a.
b.
3.2 b.
Post-Event Root Cause Evaluation and Actions lnspection Scope The team reviewed Millstone's RCE Report for the unanticipated reactor power transient event to determine whether the causes of the event and associated human performance issues were properly identified. Additionally, the team assessed whether interim and planned long term corrective actions were appropriate to address the cause(s).
Findinqs No findings of significance were identified.
The RCE was thorough and appeared to identify all underlying causal factors. The associated proposed corrective actions appeared to adequately address the underlying causalfactors. Dominion identified the root cause as an ineffective crew performance management program. The identified contributing causes and issues included:
.
lmproper implementation of standards and fundamental work practices by the crew;
.
Operator knowledge weakness related to understanding main turbine operation;
.
Inadequate guidance for VHT setpoint reset;
.
Inadequate pre-job briefs;
.
Inadequate just-in{ime training;
.
Weaknesses in test procedure guidance for controlling first stage pressure; and o
Lack of guidance on control of multiple concurrent reactivity additions.
Meetinos. lncludinq Exit Exit Meetinq Summarv On April 14,2011, the team discussed the inspection results with Mr. A. J. Jordan, Site Vice President, and members of his staff. The team confirmed that proprietary information reviewed during the inspection period was returned to Dominion.
40A6 Dominion Personnel L. Armstrong D. Bajumpaa B. Bartron C. Chapin W. Chesnut S. Claffey T. Cleary G. Closius K. Grover J. Hampton A. Jordan R. MacManus G. Marshall H. McKenney J. Riley R. Riley J. Semancik C. Tan C. Zorn Others D. Galloway 1-1
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Manager, Training
Nuclear Safety Analyst
Supervisor, Licensing
Assistant Operations Manager
Supervisor Nuclear Shift Operations Unit 2
Reactor Engineer
Licensing Engineer
Licensing Engineer
Manager, Operations
Simulator Tester
Site Vice President
Director, Nuclear Station Safety & Licensing
Manager, Outage and Planning
Supervisor Shift Operations Support
Lead Instructor - Unit 2 Operator Requalification Training
Supervisor of Nuclear Shift Operations Unit 3
Plant Manager
Simulation Engineer
Turbine System Engineer
Program Supervisor, Connecticut Department of Environmental
Protection, Bureau of Air Management, Radiation Division
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
AV Multiple Examples of Procedural Violations and Inadequate Procedures Relating to Control Room Crew Performance During a Plant Transient (Section 2.1)
lmproper Operation of Turbine Control Valves During Testing (Section 2.2)