ML17292B041
| ML17292B041 | |
| Person / Time | |
|---|---|
| Site: | Columbia  |
| Issue date: | 09/02/1997 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML17292B039 | List: |
| References | |
| 50-397-97-10, NUDOCS 9709050119 | |
| Download: ML17292B041 (60) | |
See also: IR 05000397/1997010
Text
ENCLOSURE 2
U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket No.:
License No.:
Report No.:
Licensee:
Facility:
Location:
Dates:
Team Leader:
Inspectors:
Accompanying
Personnel:
Approved By:
50-397
50-397/97-1 0
Washington Public Power Supply System
Washington Nuclear Project-2
3000 George Washington Way
Richland, Washington
May 11 through July 30, 1997
W. B. Jones,
Senior Reactor Analyst
P. Gage, Maintenance
Branch
C. Paulk, Maintenance
Branch
.J
~ March-Lueba, Senior Staff Analyst, Oak Ridge National Labs
J. Stewart, Nuclear Reactor Regulation, Senior Electrical Engineer
Dale Powers, Chief Maintenance
Branch
Division Reactor Safety
ATTACHMENTS:
1.
Supplemental
Information
2.
Letter, Licensee Response
to Supplemental
Questions dated June 25, 1997
(G02-97-1 31 )
9709050ii9 970902
ADQCK 050003'P7
6
TABLE OF CONTENTS
EXECUTIVE SUMMARY
Report Details
I. Operations
.
01
Conduct of Operations ~...................
01.1
Planned Reactor Feedwater
Pump Trip Test
04
Operator Knowledge and Performance.........................
5
04.1
Operator Performance
and Procedure
Implementation .....
~ ..
~
5
III. Engineering
E1
Conduct of Engineering
E1.1
Reactor Stability Perspective:
Entry Into Region A .........
E1.2
Review of Engineering Analysis in Support of Adjustable Speed
Drive Modification
E1.3
Integrated Plant Testing of Adjustable Speed
Drive and Digital
Level Control System......................
6
6
12
E7
Quality Assurance'in
Engineering
E7.1
Licensee Root-Cause
Investigation, Followup Activities, and
Corrective Actions...
~ ~.........
~
~ ~...
15
15
E8
Miscellaneous
Engineering
Issues
E8.1
Control Rod Position Indications
20
20
IV. Management
Meetings
22
X1
Public Meeting and Exit Meeting Summary....
~
~
~
~
~
~
~
~
~
~
~
~
22
EXECUTIVE SUMMARY
Washington Nuclear Project-2
NRC Inspection Report 50-397/97-10
This special team inspection reviewed the causes,
circumstances,
and corrective actions
associated
with the March 27, 1997, reactor recirculation system runback to minimum
speed
and the subsequent
digital feedwater system response
following the manual reactor
trip.
In addition, co .trol rod position indication concerns were reviewed.
~Qerarinna
r
The team identified a strength
in the overall operator preparations for the planned
reactor feedwater pump trip test, their response
to the unexpected
reactor
recirculation system flow runback to minimum speed
and apparent entry into the
power-to-flow instability region (Region A). The pretest briefing and subsequent
follow through of identified contingency actions were well implemented.
The plant response
to the planned feedwater trip was consistent with the as-built
differential temperature
cavitation interlock design.
Plant operation near Region A
did not result in power oscillations and core stability was maintained prior to and
following the manual reactor scram.
The digital feedwater response
to the reactor scram was consistent with previous
plant performance; however, the digital feedwater level control system design
changes
were not effective in preventing
a post-scram
Level 8 (high level)
feedwater pump trip without operator intervention.
~En ineerin
Safety and nonsafety-related
modifications resulted in an unexpected
plant transient
response
and operation at or near the area of power-to-flow instability region.
The
integrated effect of the digital feedwater level control system, adjustable
speed
drive, and power-up rate modifications were not considered
as they related to the
reactor recirculation cavitation interlock protection setpoint.
The resulting
recirculation system operating characteristics
and differential temperature
cavitation
interlock logic changes effectively reduced the margin to actuate the differential
temperature. cavitation interlock.
The engineering
analysis tools (REDY and RETRAN) were adequate
to predict the
integrated plant response
to the feedwater pump trip test; however, the licensee
failed to consider the recirculation differential temperature
cavitation interlock during
their analysis.
~
Two violations were identified involving failures to appropriately incorporate
recirculation system design information.
The first violation involved the failure to
incorporate the power-up rate modification analyzed recirculation differential
temperature
cavitation interlock temperature
setpoint into the plant.
The second
violation involved two examples where the recirculation system design basis was
not adequately
established
to support 10 CFR'50.59 unreviewed safety question
determinations.
~
The post-modification and power-ascension
testing performed prior to the March 27
loss of feedwater pump trip test provided appropriate
loop verification of adjustable
speed drive and digital feedwater level control system control functions and
sufficient overlap of the control systems.
~
The licensee's
approved procedure, for safety and nonsafety-related
software control
applications did not provide, or reference software quality controls for safety-related
software development
and management.
This procedure was determined not to
have been utilized for any safety-related
applications.
The initial event evaluation team and independent
evaluation team activities did not
provide the assurance
that the event and corrective actions were well understood
or
that the bases for the recommendations
were well supported
by analyses.
However, the subsequent
event evaluation team and independent
evaluation team
activities, reviewed by the NRC team, provided
a thorough understanding
of the
event and the conditions leading to it, as well as, establishing the root cause
and
the recommended
comprehensive
corrective actions.
The event evaluation team and independent
evaluation team plant restart issues
were appropriately identified and resolved prior to reactor criticality following the
refueling outage.
The integrated adjustable
speed drive and digital feedwater level
control system testing demonstrated
the plant operating setpoints
had been properly
implemented.
The additional analyses
provided the assurance
that the integrated
power-up rate, adjustable
speed drive and digital feedwater level control system
operational characteristics
(including tiansient response)
were well understood.
~
The licensee's
review of the'digital feedwater system performance
and control rod
indication problems were appropriately focused.
Re ort Details
Summar
of Plant Status
The reactor was manually scrammed
by the operators
on March 27, 1997, as a result of
unexpected
reactor recirculation pump runbacks to minimum speed
(15 hertz).
The reactor
had been operating at approximately 96 percent thermal power at the 96 percent control
rod line. A planned reactor feedwater pump trip test was initiated which resulted in a
recirculation pump runback to 27 hertz; however,
a second runback to 15 hertz occurred
when the recirculation system differential temperature
cavitation interlock actuated
on a
low differential temperature
sensed
between the recirculation loops and the steam dome.
The operators initiated a manual reactor scram because
of the apparent plant entry into the
instability region (Region A) on the power-to-flow map.'he digital feedwater system
subsequently
failed to control reactor vessel below Level 8 and a reactor feedwater pump
turbine trip occurred.
The unit was placed in cold shutdown for a maintenance
outage and
subsequently
entered Refueling Outage
12.
On July 23, with the unit at 99 percent thermal power, the reactor feedwater pump trip
test was performed successfully.
The recirculation system runback was as expected
and
the digital feedwater level control system maintained reactor water level above the low
water level scram setpoint.
I. 0 erations
01
Conduct of Operations
01.1
Pianned Reactor Feedwater
Pum
Tri Test
On March 27, 1997, at approximately 9 a.m. PST, the plant operators initiated a
planned feedwater pump trip with the reactor at 96 percent power.
During this
power ascension
test, an unexpected
reactor recirculation pump runback to 15 hertz
occurred.
The expected plant response
was for the reactor recirculation pumps to
runback to 27 hertz on the loss of a reactor feedwater pump coincident with reactor
vessel Level 4. However, a second runback to 15 hertz occurred when the reactor
recirculation differential temperature
cavitation interlock actuated.
The adjustable
speed drive system was designed to run the recirculation pumps
back to a slower speed on selected transients
and abnormal events.
These trips
and runbacks were to be equivalent to those provided by the replaced flow control
system and would maintain the same level of protection as the flow control system
for the scenarios
identified in the adjustable
speed drive safety evaluation report
(GI2-96-137), dated June 3, 1996, Table 1. This same level of protection was
provided through the adjustable
speed drive automatic actions.
Specifically, on a
sensed
condition of one feedwater pump tripped and reactor water level less than or
equal to +31.5 inches (Level 4) the adjustable
speed drive would run the pumps
back to 45 percent (27 Hertz), which was approximately 48 percent core flow.
A manual reactor scram was initiated when the operators conservatively concluded
that the reactor was operating in the instability Region A. Subsequently,
reactor
feedwater Pump A overfed the reactor vessel resulting in a Lev'el 8 feedwater
isolation.
The event chronology
is provided below.
8:30:00
Control room supervisor provide'd pre-job brief for reactor feedwater
pump trip (TC-6) in accordance
with Procedure 8.3.339, "Test
Instructions-Reactor
Recirculation Adjustable Speed
Drive and Reactor
Digital Feedwater
Control Ascension Test Program Power Ascension
Test," Revision 3.
9:04:53
r
The operators manually tripped reactor feedwater pump Turbine B in
accordance
with power ascension
Procedure 8.8.339.
9:05:03
Runback of reactor recirculation system to 27 hertz began
(Level 4
coincident with reactor feed pump trip) ~
9:05:29
Runback to 15 hertz began on actuation of reactor recirculation
system differential temperature
cavitation interlock (9.9'F as
measured
between the recirculation suction loops and the steam
dome pressure
converted to temperature
for a period equal to or
greater than 15 seconds)
~
9:07:28
Operators evaluated
apparent entry into Region A of the power-to-
flow map using abnormal operating Procedure 4.12.4.7,
"Unintentional Entry into Region of Potential Core Power Instabilities,"
Revision 14, for both the reactor recirculation pumps having ramped
down to 15 hertz.
Immediate operator action was taken for being in
Region A and a manual scram initiated (apparent entry into Region A).
9:07:29
Reactor vessel water level was at 44 inches narrow range and
indicated level decreasing
from void collapse (actual reactor vessel
water inventory was beginning to increase with increasing feedwater
flow).
9:07:32
Reactor feedwater Pump A governor valve opened consistent with
master level controller output.
A governor valve servo surge was
experienced
as the demand on the feedwater pump turbine hydraulic
control exceeded
the response
capability.
This resulted in a step
change
(close) in governor valve position and a momentary decrease
in the feedwater flow rate before the feedwater system recovered
and
continued to increase feedwater flow.
9:07:43
Reactor feedwater Pump A experienced
a second governor valve
servo surge resulting in a momentary decrease
in the feedwater flow.
Reactor vessel water inventory and indicated level were increasing.
9:08:35
Feedwater master level controller output zero; however, feedwater
9:08:40
9:08:41
9:36:00
pump turbine governor valve remained full open.
Reactor feedwater Turbine A governor valve started to close.
Reactor feedwater Turbine A tripped on reactor high level (Level 8)
4
Operators restarted reactor feedwater Pump A for reactor 'vessel level
control.
01.1.1
Plant Performance
Associated with the Event
a.
Ins ection Sco
e 93702
The team reviewed the expected
plant response
and the observed
plant response
to
the planned loss of feedwater pump trip test.
The plant initial conditions, feedwater
system performance,
and reactor recirculation system runbacks were considered.
b.
Observations
and Findin s
Significant modifications were made to the reactor recirculation and reactor
feedwater systems during the 1996 refueling outage.
The analog feedwater level
control system was replaced by a digital feedwater level control system and the
reactor recirculation loop flow control valves were replaced with reactor
recirculation pump motor adjustable
speed drives.
In 1994 the licensee had
implemented
a power-up rate to the plant which increased the megawatt
thermal (MWt) output of the reactor to 3486 MWt (a 163 MWt increase).
A power ascension
test program was developed to validate the adjustable speed
drive and digital feedwater level control system responses
and ensure the initial
power ascension
program acceptance
criteria would be met.
The power ascension
test report, dated December 31, 1996, concluded that the plant responses
were at
least equal to those obtained
in the original WNP-2 startup test and that the new
adjustable
speed drive and digital feedwater level control systems met all required
transient performance acceptance
criteria.
However, this did not include
performance of a reactor feedwater pump trip. The licensee had performed
a
review of adjustable
speed drive preoperational test results and ran the computer
code RETRAN to predict the plant response.
The analysis showed that the Level 3
low vessel water trip setpoint would not be reached.
On March 27, 1997, the licensee performed the reactor feedwater pump trip test to
verify the integrated effects of these modifications.
The test was intended to
demonstrate
the capability of the reactor recirculation and feedwater systems to
withstand a trip of one reactor feedwater pump from approximately 100 percent
power without a scram on a low reactor water level condition, as described
in Final
Safety Analysis Report Section H.2.3.3.2.2.
However, during the test, the
recirculation system differential temperature
cavitation interlock actuated,
resulting
in an unanticipated
runback of the adjustable
speed drive output to 15 hertz instead
of the expected
27 hertz.
The second runback of the recirculation pumps resulted
in reactor operation near Region A of the power-to-flow map.
The operators
determined that the reactor was operating
in Region A and initiated a manual reactor scram in accordance
with the Technical Specifications
and abnormal
operating Procedure 4.12.4.7.
This event was of concern because
this transient
resulted in apparent reactor operation in an area which could lead to reactor core
instability.
Subsequently,
the reactor feedwater Pump A tripped when the reactor
vessel Level 8 setpoint was reached.
The team reviewed the digital feedwater level control system response
following the
feedwater pump trip test conducted
during power ascension
testing.
The team
determined that the digital feedwater level control system response
was normal
prior to, and shortly, after ti>e manual scram was initiated by the plant operators to
prevent operation beyond the area of increased
awareness
on the power-to-flow
map.
The team noted that the reactor water level decreased
to a minimum value of
approximately 23 inches and had recovered to about 30 inches when the reactor
recirculation differential temperature
cavitation interlock initiated the second reactor
recirculation system runback.
This interlock was designed to provide jet pump
cavitation protection during transient plant conditions by ensuring
a minimum 9.9'F
differential temperature
was,maintained
between the recirculation loops and steam
dome temperature
(as measured
by steam dome pressure
and converted to
saturation temperature).
This condition had to exist for a minimum of 15 seconds
before the differential temperature
cavitation interlock would actuate.
Following the
differential temperature
cavitation interlock runback, reactor water level increased to
a maximum value of about 51 inches and was decreasing
when the manual scram
was initiated.
Immediately after the manual scram, the digital feedwater level control system
master controller output dropped sharply to zero, indicating the level controller
setpoint setdown to 18 inches narrow range had initiated.
The operating narrow
range level setpoint was 36 inches.
The team observed that the digital feedwater
level control system signals, reactor feedwater pump speed response,
and reactor
water level response
operated
as designed
until approximately
11 seconds
before a
Level 8 high reactor water level trip occurred.
The failure of the feedwater pump
turbine governor valve to begin closing when the master controller output signal
decreased
resulted in a significant amount of feedwater being supplied to the
reactor vessel following the scram.
The team determined that the reactor feedwater pump turbine governor valve
should have been closing based on the master controller output demanding
less
feedwater flow for the'corresponding
increasing reactor vessel level and associated
turbine feedwater pump speed.
The team noted that the governor valve position
started to close about 2 seconds
prior to the high level trip of the operating reactor
feedwater pump.
The licensee identified that there were no indications of any
communication interruptions between the FANUC (GE programmable
hardware
system) controller and the Lovejoy (digital feedwater level control system
manufacturer) controller during the event, and there was no time delay in the level
control system regarding governor valve response.
The licensee determined that
the probable cause for the governor valve staying open was sticking of the governor
servo pilot valve and the servo surges may have resulted in excessive travel of the
governor pilot valve.
The licensee subsequently
determined through analysis, including RETRAN
simulations, that the additional period the governor valve remained full open did not,
in itself, result in the Level 8 feedwater trip. The licensee's
analysis showed that
the digital feedwater level control system was not capable of preventing
a Level 8
high level trip following a reactor scram without operator intervention.
Based on a
review of the licensee's probabilistic risk assessment
and human recovery actions,
the team found that the operator action to recover feedwater following a scram was
risk important.
The team also reviewed the operational history for WNP-2 to determine whether any
instances
had occurred where the differential temperature
cavitation interlock had
initiated during feedwater transients.
No previous instances were identified where
the loss-of-single feedwater pump or other feedwater transient resulted in the
differential temperature
cavitation interlock being met.
c.
Conclusions
The observed plant response
to the planned feedwater pump trip was consistent
with the as-built plant.
The recirculation system differential temperature
cavitation
interlock actuated
in accordance
with the established
cavitation interlock setpoints.
The digital feedwater level control system responded
appropriately to the loss of a
single feedwater pump.
The failure of the digital feedwater level control system to
maintain reactor vessel water level below Level 8 following the reactor scram was
limited by the digital feedwater level control system response
characteristics
and
tuning and apparently not the result of the delayed governor pilot valve response.
04
Operator Knowledge and Performance
04.1
0 erator Performance
and Procedure
Im lementation
a.
Ins ection Sco
e
93701
The team reviewed:
(1) the test, operating,
and abnormal procedures
applicable to
the event; (2) operator preparations for the test, including simulator exercises
and
pretest briefings; and, (3) the operators'esponse
during the event.
b.
Observations
and Findin s
The licensee established
the planned feedwater pump trip test controls in
Procedure 8.3.339, "Test Instructions-Reactor
Recirculation Adjustable Speed Drive
and Reactor Digital Feedwater Control Power Ascension Program," Section 8.16,
"Reactor Feedwater
Pump Trip (TC-6)." The plant initial conditions were
established
consistent with the test instructions and ANNA (core monitoring) was
in accordance
with Procedure 7.4.2.7.2, "Stability Monitoring System."
h
The operating crew that performed the test had participated
in simulator exercises
prior to performing the test involving the loss of a feedwater pump.
A detailed plant
recovery action was established
to maintain the reactor away from th
t b'I'
ins a iity
g'
is included specific control rod insertions and ad'ustabl
d d
'ani
ulations
o
jus a
e spec
rive
Region A. The lice
'p
to maintain the power-to-flow relationship awa
f
th
y rom
e instability
e icensee
had identified that during the initial transient, with the
recirculation pump runbacks to 27 hertz that the
I
t
ld b
p an
wou
e operating near
adequate
mar in to r
egion A; however, the recirculation pump runbacks to 2? he
o
ertz would provide
a equate margin to recover the plant.
The observed
simulator response.
did not
model that the recirculation s ystem differential temperature cavitation interlock
would actuate
and ca
cause
an additional recirculation pump runback to 15 hertz.
Prior to conductin
the
sheet (Ol-22
Rev
g
e test the licensee performed
a pre-evolution
b
f
h
k- ff
rie
c ec -o
, Revision B) for power ascension
test Procedure 8.3.339.
The
operators
again reviewed the established
plan for control rod mani ula io
ro
manipu ations and to
a ion
ow to prevent entry into the area of increased
awareness.
his prebriefing also included the contingency actions that would be taken if th
gi n
.
t was established
that the plant would be immediatel
e aenite
scrammed
on verifying Region A had been entered.
imme )ate y
During the performance of the test, the operators observed
a second,
unexpected
runback of the recirculation pumps.
Procedure 4.12.4.7
"U
ure...,
nintentional Entry into
egion o Potential Core Power Instabilities," was entered for both
had been entered
ba
g
pe
own to 15 hertz.
The operators determined th t R
'
a
egion
and the C cle 12
based
on main control board indications
core fl
f
ow re erences,
bein
in Re io
yc e 12 power-to-flow map.
Immediate operator
a t
c ion wasta
en
or
k
f
'
egion A and the reactor was manually scrammed.
Sub
taken to restore the reactor feedw
e
.
u sequent
action was
Level 8 high level trip.
e reactor
ee water Pump A to control vessel level following the
C.
Conclusions
The o erators w
pum
tri test a
p
tors were involved in extensive preparations
for the
I
d f
or
e p anne
eedwater
and Technical S
p
ip es
and had established
contingency actions consist
t
h
d
is en wit
proce
ural
re aratio
i a
pecification requirements.
A strength was not d 'h
s no e
in t e operators
egion
o the power-to-flow
p
p
'ons and response to the apparent entry into Re
'
f
III. En ineerin
E1
Conduct of Engineering
E1.1
Reactor Stabilit
Pers
ective:
Entr
Into Re ion A
a.
Ins ection Sco
e
93703
The
stabilit
he team reviewed the reactor physics, thermal-h
d
I
d
- y rau ics, an
reactor core
sta
i ity concerns with the apparent reactor operation in the instability region.
Observations
and Findin s
Region A was defined as an area on the WNP-2 core operating'imits report power-
to-flow map where the potential for unstable power oscillations cannot be ruled out
by analysis.
A manual reactor. scram was required by the Technical Specifications
and the licensee's
abnormal procedure
when entry into Region A occurs.
The licensee's
core operating limits report for Cycle 1.2 defined Region A as the area
bounded
by tl
100 percerit control rod line at 40 percent rated flow (59.1 percent
power) and the natural circulation line at 23.8 percent flow (35.3 percent power).
The team noted that the recirculation pump runback to 15 hertz resulted
in a total
core flow reduction to 37 percent flow. Based on the licensee's power-to-flow
map, the recirculation pumps running back to 15 hertz runback would result in a
flow less than 40 percent and entry in Region A with the plant operating from a
high rod line. The licensee subsequently
determined that Region A was not entered
when the recirculation pumps ranback to 15 hertz.
A review of the plant data by
the licensee and independently
by the team showed that the actual reactor power
level was 2 percent below the Region A boundary and slowly increasing prior to the
manual scram.
The team reviewed the licensee's
implementation of the "Stability Interim Corrective
Actions." The Boiling Water Reactor Owners Group interim corrective actions
define:
(1) Region A where a manual scram is required; (2) Regions
B and C, where
intentional entry is not allowed and
a prompt exit is required by control rod insertion
or flow maneuvering;
and (3) the area of increased
awareness,
where intentional
entry is only allowed if stability monitoring is functional.
The team concluded that
the interim corrective action implementation and operator training relating interim
corrective action procedures
were appropriately implemented.
The licensee identified that it had chosen "Stability Long Term Solution," Enhanced
Option 1-A (E1A), with plans to perform the initial testing of the flow control trip
reference cards in 1998 and full implementation
in 1999.
The team noted that the
E1A exclusion region would likely have resulted
in an automatic scram for.a similar
15 hertz runback at a high rod line.
The team reviewed three conditions which appeared
to have contributed to the
operators'etermination
that Region A had been entered.
These conditions were:
(1) the plant operation was near the 100 percent rod line prior to the feedwater
pump trip; (2) the core was at the end of life and the void reactivity coefficient was
estimated to be lower than average resulting in the actual flow-control rod line
having a steeper slope than the average
rod line used to define the stability regions;
and, (3) the reactor was scrammed
before full feedwater temperature
equilibrium
was reached
(i.e., the power was still increasing slowly) ~
The team reviewed the stability calculations performed using the licensed
frequency-domain
Code STAIF for the operating conditions reached just before the
These calculations indicated that the core decay ratio was 0.51, the out-of-
phase decay ratio ($ 1.038 subcritical mode) was 0.54, and the hot-channel
decay
ratio (a SVEA bundle with peaking factor of 1.558) was 0.22.
The team found the
STAIF calculations were appropriately utilized and agreed with the licensee's
determination that unstable power oscillations would not have been likely if the
manual scram had not been performed.
A review of the plant data also indicated
that unstable power oscillations did not occur prior to the scram.
Conclusions
The reactor core operating data confirmed that Region A was not entered.,
Although plant conditions were approaching
Region A, the reactor remained stable
and power oscillations were unlikely. The operator actions in this instance were
appropriate to maintain core stability and the scheduled
long-term solution
implementation date was adequate
given the operator's demonstrated
sensitivity to
core instability concerns.
Review of En ineerin
Anal sis in Su
ort of Ad'ustable
S eed Drive Modification
Ins ection Sco
e
92903
The team reviewed the engineering
analysis used, in part, to support the adjustable
speed drive modification.
Comparisons
were performed between the previous
recirculation system flow control valve design and adjustable
speed drive operating
characteristics.
This also included the licensee's activities to integrate the other
significant plant modifications, power-up rate and digital feedwater level control
system initiated during the same period, for plant performance
and transient
response.
Observations
and Findin s
Com arison of Reactor Recirculation
S stem Runback Rates
The team compared the plant test data from the 1984 initial power ascension
feedwater pump trip test to the data obtained from the March 27, 1997, feedwater
pump trip test.
The team calculated that the rates of total core-flow reduction
during a recirculation system runback were approximately 4.2 percent/sec for the
new adjustable
s'peed drive configuration and approximately 11.0 percent/sec
for
the previous recirculation system configuration with flow control valves.
The core-
flow runback rate was approximately 75 percent of the drive flow rate (i.e., a drive-
flow reduction from 100 to 0 percent results in a core-flow reduction from 100 to
24 percent, the natural circulation rate); thus, the team estimated that the
recirculation loop drive-flow runback rates were approximately 5.5 percent/sec
for
the adjustable
speed drive configuration and approximately 14.5 percent/sec
for the
flow control valve configuration.
The team found that the runback rate in the
adjustable
speed drive configuration was approximately 2.5 times slower than in the
flow control valve configuration.
The overall effect of the slower adjustable
speed
drive runback rate was reviewed with the licensee
and assessed
using the
licensee's
RETRAN licensing model code.
1
En ineerin
Anal sis to Determine Im act of Power-u
Rate and Ad'ustable
S eed
Drive Modification on Recirculation S stem Performance
The team reviewed
a number of calculations performed by General Electric with
their licensing Code REDY, and sensitivity analysis performed by the licensee's staff
with their RETRAN licensing model.
The REDY calculations were documented
in
Letter GENE-208-12-0793 ("WNP2 Power Up Rate Supplement for the WNP-2
Control System Design report, Incorporating the Adjustable Speed
Drive Reactor
Recirculation System" ), and the RETRAN calculations were summarized
in internal
licensee memorandums.
The core flow predicted by both of these simulations
compared well with the actual core flow from the March 27 recirculation flow
runback.
The primary purpose of the REDY calculations in Letter GENE-208-12-0793 was to
evaluate the impact of the new power level and control systems
on the reactor
water level following a number of transients.
The analyses
were performed to
demonstrate
analytically that a reactor scram on either low or high vessel level
would not occur, as had been demonstrated
during the initial startup testing
program.
The licensee identified, following the March 27, 1997, test, that the
analysis performed prior to the feedwater pump trip test did not address the
recirculation loop temperatures
and differential temperature
cavitation interlock
margin.
The RETRAN calculations were performed in December 1996 to evaluate the impact
of the different flow runback rates between the adjustable
speed drive and flow
control valve systems.
As with the above REDY calculations, the RETRAN results
were evaluated to determine the impact on water level transient behavior, but
margins to the pump cavitation interlock were not investigated.
Following the
March 27 event, the licensee's staff evaluated the RETRAN-calculated recirculation
loop temperature
and determined that the simulation had predicted the cavitation
interlock but was not recognized prior to the event.
J
The licensee's
event evaluation team identified that the differential temperature
cavitation interlock had been set at 9.9
F in 1984 and that the setpoint had not
been changed to 10.7
F when the power-up rate was implemented
as
recommended
by General Electric.
The team reviewed the basis for the differential
temperature
cavitation setpoint and requested
any analysis which provided for
maintaining the setpoint at 9.9
F. The team was subsequently
provided with
General Electric Letter 94-PU-0013, dated March 18, 1994, which specified, in
part, that the 10.7
F recirculation system differential temperature
cavitation
setpoint was consistent with the analysis in support of the power-up rate project.
The letter stated that, "(s)hould the Supply System request additional analysis
in
support of the 9.9'F setpoint, General Electric will do so as a change notice to the
current power-up rate contract since this constitutes
a change from the agreed upon
power-up rate recirculation system design basis."
The power-up rate modification (Technical Specification Amendment 137) became
effective on May 2, 1995, with the recirculation system cavitation interlock setpoint
established
at 9.9
F.
The team found that the power-up rate design basis was not
correctly translated for the recirculation system differential temperature
cavitation
setpoint following the power-up rate.
The licensee implemented the power-up rate
in May 1995, and operated the plant for two cycles without changing the setpoint,
without performing additional testing, and without additional analyses.
The team
identified this to be a violation of Criterion III, "Design Control," of Appendix B to
10 CFR Part 50 (50-397/9710-01).
The team also considered
the design basis for the 15-second
delay before the
differential temperature
cavitation interlock would actuate.
No specific design basis
was found; however, the licensee's staff believed the delay time was chosen to
avoid spurious pump speed reductions,
based on engineering judgement using
empirical data, and was consistent with similar delay times in other plants.
The team reviewed the written safety evaluation performed to support the
installation of the adjustable
speed drives (Safety Evaluation Control 93-200, dated
July 11, 1995).
The team found that the recirculation system design basis
information used to support development of the safety evaluation was not adequate
to provide the basis that an unreviewed safety question did not exist.
Specifically,
the licensing basis implementing determination for Plant Modification
Request 87-0244 did not provide a comprehensive
review for the design and testing
of the reactor recirculation system adjustable
speed drive.
The licensing basis
impact determination did not identify that the reactor recirculation system cavitation
interlock would actuate during a planned loss of a feedwater pump.
This resulted in
a second recirculation pump runback and reactor operation near the power-to-flow
instability Region A, an area of operation prohibited by Technical Specifications.
This plant response
was not recognized
and reviewed.
The licensee did not
establish
an adequate
design basis for the recirculation system to determine that the
adjustable
speed drive modification did not result in an unreviewed safety question.
The team identified this to be a violation of 10 CFR 50.59
(50-397/9710-02).
The licensee subsequently
performed Safety Evaluation SE 97-078, "Recirculation
Flow Control System Digital Feedwater
Level Control System Feedwater
Pump Trip
Test Followup 10 CFR 50.59 Safety Evaluation," Revision 0. This safety evaluation
provided an integrated review based
on the results observed from the feedwater
pump trip test.
The licensee's safety evaluation appropriately considered
the
differential temperature
cavitation interlock actuation and associated
reactor
recirculation pump runback, plant operation in or near Region A, and the digital
feedwater level control system response.
The licensee determined that the
integrated plant response
did not result in an unreviewed safety question.
10
Prior to the March 27 test, the licensee conducted
operator training using the plant
simulator.
The simulator modeling of the test failed to predict the differential
temperature
cavitation interlock would actuate.
The team reviewed the simulator
calculation and the licensee ran the simulation again during the inspection with the
same results.
The team reviewed the licensee's
evaluation, which attributed the
failure to predict the cavitation, interlock to a 4'F steady state mismatch between
the predicted and measured
recirculation loop temperatures.
Because of this 4'F
mismatch, the 9.9'F cavitation setpoint was not reached
in the simulation.
The
licensee was continuing to evaluate the cause of the 4'F mismatch at the end of the
inspection.
The team agreed with the licensee's
assessment
that the WNP-2
training simulator had not been modeled to validate detailed engineering
analysis.
Contributin
Factors to the Differential Tem erature Cavitation Interlock Actuation
The team found that the differential temperature
cavitation interlock actuation
during the feedwater pump trip test was attributable,
in part, to reactor recirculation
system design changes
resulting from the adjustable
speed drive modification and
power-up rate.
The team identified three factors as contributors to the reduction in
the recirculation differential temperature
cavitation interlock margin:
(1)
The drive flow runback rate was reduced from approximately
15 percent/sec
(using the recirculation flow control valves) to approximately 5 percent/sec
(with the adjustable
speed drive design).
The RETRAN simulation showed
the flow control valves resulted in a faster transient, with the differential
temperature
cavitation interlock actuating for a shorter period of time.
The
RETRAN simulations always indicated
a reduction in the cavitation interlock
margin with the adjustable
speed drive system.
The magnitude of the margin
reduction ranged from 10 percent to 30 percent depending
of the
methodology used for data interpretation.
Similar results using the NRC's
TRAC model were obtaine'd by the team.
(2)
The final drive-flow setpoint following the runback was reduced significantly.
In the flow control valve system, the runback resulted in approximately
60 percent core flow; the adjustable
speed drive system runback to 27 hertz
resulted in approximately 48 percent core flow. This significant reduction in
final core flow resulted in a lower dome pressure,
lower saturation
temperature,
and reduced margin to the differential temperature
cavitation
interlock.
In addition, the power-up rate modification implemented
in 1994
resulted in a higher operating pressure
and suction side recirculation system
operating temperatures,
which also contributed to the reduced margin to the
cavitation interlock actuation.
(3)
The cavitation interlock logic was modified for the adjustable
speed drive
system.
The new logic was more conservative
in actuating the differential
temperature
cavitation interlock because
it selected the lower of the two
measured
saturation temperatures
and the highest of the four measured
recirculation loop temperatures.
The adjustable
speed drive cavitation
interlock logic had the effect of reducing the steady state cavitation margin.
11
c.
Conclusions
The engineering
analysis tools (REDY and RETRAN) were adequate
to predict the
integrated plant response
to the feedwater pump trip test; however, the licensee
failed to consider the recirculation differential temperature
cavitation interlock during
their analysis.
Several recirculation system operating characteristics
were effected
by the design modifications, which resulted in the unexpected
recirculation system
pump runbacks
and plant operation
in or near Region A.
Two violations were identified involving failures to appropriately incorporate
recirculation system design information.
The first violation involved the failure
to incorporate the power-up rate modification analyzed recirculation differential
temperature
cavitation interlock setpoint into the plant.
The second violation
involved the failure to adequately
establish the recirculation system design basis, for
the adjustable
speed drive modification, to determine that an unreviewed safety
question did not exist.
E1.3
Inte rated Plant Testin
of Ad'ustable
S eed Drive and Di ital Feedwater
Level
Control S stem
Ins ection Sco
e 92903
The team reviewed:
the 1996 post-adjustable
speed drive and digital feedwater
level control system modification testing, the power ascension test results and the
1984 power ascension test results; problem evaluation requests
associated
with the
adjustable
speed drive and digital feedwater level control system since their
implementation;
and, internal licensee correspondence.
This included the software
testing associated
with the adjustable
speed drive and digital feedwater level control
system related to reactor recirculation pump differential temperature cavitation
interlock and the reactor feedwater Turbine A governor valve controls.
b.
Observations
and Findin
s
Inte rated ad'ustable
s eed drive and Di ital Feedwater
Level Control S stem
~Testin
The team found the post-modification and power-ascension
testing, performed prior
to the March 27 loss-of-feedwater
pump trip test, provided appropriate
loop
verification of adjustable
speed drive and digital feedwater level control system
control functions and sufficient overlap of the control systems.
The power
ascension test Procedure 8.3.339 encompassed
the Final Safety Analysis Report
requirements
and was consistent with verifying the adjustable
speed drive system
as described
in the safety evaluation by the Office of Nuclear Reactor Regulation
(Amendment 145 for the replacement
of the reactor recirculation flow control
system with an adjustable
speed drive system).
12
A licensee report on the power-ascension
program was developed
in December
1996.
The report found the testing criteria had been met for the adjustable
speed
drive and digital feedwater level control system.
In addition, the report provided
a
basis for delaying the performance
of the feedwater pump trip test.
The team
identified that the written safety evaluation performed to support the deferral of
power ascension
testing (Safety Evaluation Control 96-106, dated December
12,
1996) was not adequate
to provide the basis that an unreviewed safety question
did not exist.
The team found that the recirculation system design basis information
used to support development
of the safety evaluation was not adequate.
As
previously discussed,
the plant response
was not recognized
and reviewed.
The
failure to establish the recirculation system design basis for evaluating the deferral
of the power ascension
test, to provide the 10 CFR 50.59 evaluation basis that an
unreviewed safety question did not exist, was identified by the team as a second
example of Violation 50-397/9710-02.
Inte rated Plant Di ital Feedwater
and Ad'ustable
S eed Drive Software Review
The software associated
with the instrumentation
and controls for the digital
feedwater level control system and the reactor recirculation system performed
as
designed
during the feedwater pump trip test.
The unanticipated
second runback of
the reactor recirculation pump was found to be a design deficiency (unanticipated
differential temperature
interlock actuation) rather than a software implementation
error.
The feedwater pump governor valve software operated correctly during the
test prior to the failure to close upon demand
and no software errors were found
which would have caused the digital feedwater level control system failure.
NRC Inspection Report 50-397/96-07 documented
concerns associated
with the
design and installation of the digital feedwater level control system.
This inspection
found that some of these concerns
had manifested
as problems.
Problem Event
Report 296-0624, pertaining to which processor was to control and which was to
be the backup, and Work Order CXH6, pertaining to cable replacement,
were
generated
to correct problems, which had been previously identified by the vendor
(GE-FANUC). The team identified that no surveys or audits were performed by the
licensee on the GENE design prior to the factory acceptance
test to identify these
types of problems.
The team also determined that the GE-FANUC programmable
controllers were not
registered with GE-FANUC and as such the licensee would not receive any
notifications of errors or design changes.
The team found that the prime contractor
(GENE) had not registered the product and the licensee did not register the product
until operation such that there were several years where error reports or design
changes
were not reported to GENE or the licensee.
The licensee was not aware of
the number or significance of any notifications that may have been issued by
GE-FANUC while they were not registered.
The team reviewed Procedure
1.4.14, "WNP-2 Software Control," Revision 0, used
to maintain software configuration control for the feedwater and recirculation
systems.
Changes
made by the vendors were controlled by the vendor procedures.
13
The team noted that this procedure defined the methods used for the development,
maintenance,
production, use, and retirement of software.
The procedure
was
applicable to both safety- and selected nonsafety-related
systems.
The feedwater
and recirculation systems
(nonsafety-related)
were not specifically identified in the
procedure;
however, the licensee stated that the procedure
was applicable to these
systems.
As a software configuration control document for nonsafety systems,
the
team found that the procedure
had several deficiencies.
The procedure
did not
identify interface controls with vendors and subcontractors
and did not address
security, inspections
and audits, tools, techniques
and methodologies,
o training
documents.
As a safety-related software development
plan, the team found the
proc'edure to be inadequate.
The procedure
did not specify or reference
a software
management
plan, a software development
plan, a software quality assurance
plan,
a software safety plan, verification and validation methodology, training,
programming standards,
hardware/software
integration, installation procedures
or
maintenance.
The team verified that this procedure
had not been used for the
development
or modification of any safety-related
software.
The licensee
representative
stated that they had no plans for doing so.
The team'reviewed
Problem Event Report 296-0625, which included
a "Design
review of adjustable
speed drive and DFW systems" performed in August 1996 and
the event evaluation report, which evaluated the March 27 runback test event.
These reports included many software-related
conclusions
and recommendations.
A
summary table of the actions planned,
as a result of the event evaluation report,
was provided to the team during this evaluation; however, the team noted that
there were many specific recommendations
from the August 1996 report that were
not included in the action plan.
The team found the adjustable
speed drive and digital feedwater level control
system engineers
knowledgeable
about systems software and were proactive about
reviewing changes to the software.
This included detailed interactions with the
equipment suppliers.
Conclusions
The post-modification and power-ascension
testing performed prior to the March 27
loss of feedwater pump trip test provided appropriate
loop verification of adjustable
speed drive and digital feedwater level control system control functions and
sufficient overlap of the control systems.
A second example of a 10 CFR 50.59 violation was identified for the failure to
establish the design basis for the recirculation system in evaluating the deferral of
the power ascension
test and ensure that an unreviewed safety question did not
exist.
14
The licensee had limited involvement in the original design of both the feedwater
and recirculation digital retrofit. Several equipment failures occurred, which may
have been preventable with more active involvement by the licensee during the
original design.
The team concluded that the licensee staff had subsequently
become knowledgeable
about these systems.
I
The deficiencies noted in the software control procedure indicated that software
procedure controls were weak.
The procedure was determined to be inadequate
for
the developmer..
or management
of software for safety-related
applications.
The
licensee had not utilized the software configuration control procedure
on any safety-
related applications.
The design review and the event evaluation reports contain many specific and
programmatic recommendations
that should further enhance
the feedwater and
recirculation systems performance.
E7
Quality Assurance
in Engineering
E7.1
Licensee Root-Cause
Investi ation
Followu
Activities and Corrective Actions
a
~
Ins ection Sco
e
92703
The team reviewed the licensee's
event investigations'performed
by the event
evaluation team and the independent
evaluation team.
This review included
evaluating the depth of the event evaluation team's review, technical basis for the
event evaluation team's recommendations
and findings, and their resolution.
The
independent
evaluation team was reviewed for its independence
and overall scope
of review of the event evaluation team findings and conclusions.
The initial and
supplemental
reports issued by the event evaluation team and independent
evaluation team were reviewed.
The team also followed up on the licensee's
responses
to the additional questions identified during the May 30, 1997, public
meeting regarding the reactor feedwater pump trip test.
b.
Observations
and Findin s
The licensee's April 9, 1997, letter to Mr. E. W. Merschoff defined the scope of the
event evaluation team and independent
evaluation team activities regarding the
March 27, 1997, reactor scram.
On April 3, the licensee committed to provide the
results of the evaluations prior to the plant startup from the spring 1997
maintenance
and refueling outage.
The event evaluation team, composed
principally of licensee personnel were tasked with: evaluating the analytical results
of the testing performed on March 27, 1997; the performance of the onshift
personnel
leading up to, during, and immediately following the manual reactor scram
on March 27; the performance of the adjustable
speed drive and digital feedwater
level control system; the adequacy
of the design integration for installation of the
reactor power-up rate, adjustable
speed drive, and digital feedwater level control
system modifications; and, the adequacy
of the power ascension
test procedure.
The primary assurance
was to be that the licensee had a thorough understanding
of
15
the events surrounding the March 27 test, reactor scram and any needed corrective
actions.
The independent
evaluation team, which was composed
principally of non-
licensee personnel,
was also tasked with providing a critical re'view of the event and
the investigation performed by the event evaluation team.
The team noted that Licensee Event Report 97-004-00, "Technical Specification
Required Manual Scram Due to Entry Into Region A of the Power-to-Flow Map,"
dated April 28, 1997, did not provide a comprehensive
review of the March event.
The licensee event report was issued prior to completion of the event evaluation
team and independent
evaluation team activities.
The license representative
stated
that they intend to provide a revised licensee event report to include the findings
~
from the event evaluation team and independent
evaluation team.
Licensee Event Evaluation Team Activities
The initial event evaluation team report was issued on May 9, 1997, and addressed
each of the items identified in the charter.
Each of the event evaluation team
recommendations
was specifically identified in Problem Evaluation Report 97-0244.
The team found the event evaluation team's findings and recommendations
to be
good.
However, the team was concerned that the event evaluation team had not
evaluated
each of the operating parameters
effected by the power-up rate,
adjustable
speed drive, and digital feedwater modifications.
For example, the team
identified differences in the adjustable
speed drive, and flow control valve runback
rates, which the event evaluation team did not appear to have considered.
In
addition, the design integration of the adjustable
speed drive, power-up rate, and
digital feedwater systems were not comprehensively
addressed.
These issues were
subsequently
reviewed following the licensee's
response
to questions identified
during a May 30, 1997, public meeting with the licensee.
The event evaluation team subsequently
issued an addended
report (Event
Evaluation Team Addendum
1), which provided additional information regarding
additional analyses that were performed during and following the event evaiuation
team activities.
The event evaluation team was able to demonstrate,
qualitatively
and quantitatively, based
on these additional analyses,
the overall cumulative
impact of the adjustable
speed drive, power-up rate, and digital feedwater
modifications on the differential temperature
cavitation interlock margin.
Sensitivity
studies performed on six case descriptions provided
a quantitative assessment
of
the different changes
resulting from the power-up rate, adjustable
speed drive and
digital feedwater modifications.
These cases involved:
final power-to-flow
conditions; flow control valve and adjustable
speed drive runback rates; combined
power-up rate and digital feedwater; and, the effect of the conservative
FANUC trip
logic. The event evaluation team. concluded that, of the case sensitivity reviews
performed, the addition to the conservative
logic and the final condition (power-to-
flow) of the runback provided the largest contributors to reducing the differential
temperature
cavitation interlock margin.
Each of the sensitivity studies showed the
effect of each modification was to decrease
the margin to a differential temperature
cavitation interlock trip. The event evaluation team did not identify any further
recommendations
based
on the additional analyses that were performed.
16
The team noted that the event evaluation team addended
report provided
a
comprehensive
review of the event, which was well supported
by analyses.
The
event evaluation team and the team found that the overall effect of the power-up
rate, adjustable
speed drive, and digital feedwater modifications resulted in a
reduced margin to the differential temperature
cavitation interlock trip.
Inde endent
Evaluation Team Activities
The team was concerned that the independent
evaluation team, as documented
in
the initial report dated
May 9, 1997, concluded,
in part that, "although there was
considerable
agreement
between the independent
evaluation team and event
evaluation team, the independent
evaluation team concluded that the event
evaluation team preliminary report was not acceptable
in its entirety.
The
independent
evaluation team review found the event evaluation team developed
plausible causes
for the event but had not fully validated these causes
by analysis."
Specifically, the independent
evaluation team (based on review of the preliminary
event evaluation team report) found that the event evaluation team report provided
an unconvincing evaluation of the adequacy of the design integration for the
installation of the power-up rate, adjustable
speed drive, and digital feedwater
modifications.
These independent
evaluation team findings did not provide
assurance
that the licensee had
a thorough understanding
of the events surrounding
the March 27, 1997, reactor scram, and developed
the appropriate corrective
actions.
The NRC addressed
the concern that the independent
evaluation team's findings
resulted in not accepting the event evaluation team report in its entirety during the
May 30 public meeting.
The licensee identified that the independent
evaluation
team would perform an additional review of the event evaluation team final report
and provide the results of that review to the team.
On June 20, the independent
evaluation team issued
a report addressing
the independent
evaluation team review
of the event evaluation team report and Addendum
1.
In addition, the independent
evaluation team reviewed the licensee's
response
to the NRC's June 4, 1997, letter
regarding additional questions for the reactor feedwater pump trip test event.
The
independent
evaluation team concluded that final event evaluation team report and
the associated
addendum
adequately
addressed
the independent
evaluation team's
concerns.
The addended
event evaluation team report provided the necessary
analysis to validate the. causes for the event.
The licensee's
planned actions, with
respect to the independent
evaluation team identified startup issues, were found to
adequately
resolve the remaining issues that would prevent plant'startup.
The
independent
evaluation team noted that the original safety evaluations for the
modifications should be reviewed to ensure their continued applicability and ensure
that an unreviewed safety question did not exist.
These actions were completed by
the licensee and reviewed by the team.
No unreviewed safety questions
were
identified.
17
Licensee
Res
onse to Additional Questions
Re ardin
Reactor Feedwater
Pum
Tri
Test and Corrective Actions
The licensee's
response
to the NRC letter dated June 4, 1997, T. P. Gwynn to
J. V. Parrish, "Summary of Meeting with Washington
Public Power Supply System
(WNP-2) on May 30, 1997," appropriately addressed
each of the six items and/or
concerns pertaining to the reactor feedwater pump test.
The specific items
involved:
followup actions planned by the event evaluation team and independent
evaluation team to address
apparent divergent findings or recommendations;
the
licensee's
plans for a thorough review of the integrated engineering
and/or
operational design feature review of the modifications; actions to be taken to
integrate the independent
evaluation team and event evaluation team findings and
recommendations;
an accounting of each independent
evaluation team and event
evaluation team recommendation;
whether an unreviewed safety question existed
because
of the adjustable
speed drive modification; and the licensee's
plans for
performing the reactor feedwater pump trip test.
The NRC raised the above described six items because
of concerns with the event
evaluation team's basis for its conclusions
and recommendations
and the
independent
evaluation team's overall conclusion that the event evaluation team
report could not be accepted
in its entirety.
Prior to the May 30 public meeting, the
team had not been provided with the licensee's
actions to resolve the differences
between the event evaluation team and independent
evaluation team
recommendations
and what additional reviews the independent
evaluation team
would perform to provide assurance
of the completeness
of the event evaluation
team's activities.
The team found that the licensee performed extensive additional efforts to resolve
the independent
evaluation team's concerns.
These efforts were documented
in the
event evaluation team addended
report as discussed
previously.
These additional
efforts were reflected in the licensee's
response
to the six items. The team
reviewed both the event evaluation team addended
report and the independent
evaluation team supplemental
report and found the event evaluation team
appropriately addressed
the independent
evaluation team report concerns
and
validated the causes for the event.
The licensee's
and GENE's engineering
operational design feature reviews did not identify any additional adverse effects on
the operating parameters
with the exception of the differential temperature
cavitation interlock. The licensee's
background information provided to the team
supported this finding.
Integration of the event evaluation team and independent
evaluation team findings
with regard to the adjustable
speed drive and digital feedwater level control system
was accomplished
through the problem evaluation report process.
Additional
RETRAN simulations identified that the digital feedwater level control system had
operated
properly and that the system performance would not prevent a Level 8
high reactor vessel water trip after a scram.
The concerns with the sluggish
feedwater pump turbine governor relay valve operation were addressed
through the
problem evaluation report process.
Corrective maintenance
was performed to clean
18
and polish the relay valves.
Additional tuning of the hydraulic control system was
performed; however, the licensee determined that additional modifications were are
needed to the system to improve the responsiveness
of the governor controller
following a reactor scram.
The team reviewed the licensee's
actions and'proposed
actions for each of the
event evaluation team and independent
evaluation team recommendations.
Each
recommendation
was being addressed
by the licensee through the problem
evaluation report process.
The licensee's safety evaluation to determine whether an
unreviewed safety question existed because
of the adjustable
speed drive
modification was well supported
and the team agreed with the licensee's
determination that an unreviewed safety question did not exist.
However, the team
was concerned
with the incomplete basis provided for Safety Evaluation 97-075
performed to modify the differential temperature
cavitation setpoints.
The licensee
identified changes to the differential temperature
setpoints, differential time delay to
runback, and alarm features.
The team found that the safety evaluation provided to
the plant operating committee was not well supported with regard to the
justification for the setpoint changes.
The increase
in the setpoint to 10.7
F was
based
on a previous General Electric analysis; however, the basis for increasing the
differential time delay to 10 minutes from 15 seconds
was based
on the justification
in a draft General Electric memorandum to the licensee.
The team reviewed the
plant operating committee meeting minutes, dated June 25, 1997, where Safety
Evaluation 97-075 was reviewed.
The team found the plant operating committee
had identified similar concerns with the basis supporting the differential time delay
increase to 10 minutes.
The plant operating committee conducted
extensive
discussions
with the engineering staff and GENE.
The team also discussed
the
basis for the time increase with the engineering staff and GENE.
The team found
-that the jet pump usage factors, fatigue factors and jet pump set screw gap
concerns
had been considered
in the establishing the increased time differential
limit. The safety evaluation was accepted
based
on the supplemental
information
obtained during the plant operating committee meeting to support the. safety
evaluation.
The team found the licensee had appropriately identified the event evaluation team
and independent
evaluation team recommendations,
which were required to be
completed prior to plant restart.
The team verified that each of the restart
recommendations
had been completed.
The feedwater pump trip retest was
successfully. completed on July 23. The adjustable
speed drive system ran the
recirculation pumps back to 30 hertz (revised based
on WNP-2 Cycle 13 power-to-
flow map) and the digital feedwater level control system maintained level between
the low and high reactor vessel level trip setpoints.
Conclusions
The initial event evaluation team and independent
evaluation team activities did not
provide the assurance
that the event and corrective actions were well understood
or
that the bases for the recommendations
were well supported
by analyses.
The
additional event evaluation team and independent
evaluation team activities to
19
provide this assurance
were not undertaken
until after the public meeting on
May 30, 1997, with the NRC. However, the final event evaluation team and
independent
evaluation team activities provided
a thorough understanding
of the
event and the conditions leading to it, as well as, establishing the root cause and
recommending
comprehensive
corrective actions.
The event evaluation team and independent
evaluation team plant restart issues
were appropriately identified and resolved prior to criticality following the refueling
outage.
The integrated adjustable
speed drive and digital feedwater level control
system testing demonstrated
the plant operating setpoints
had been properly
implemented.
The additional analyses
provided the assurance
that the integrated
power-up rate, adjustable
speed drive and digital feedwater level control system
operational characteristics
(in'eluding transient response)
were well understood.
E8
Miscellaneous Engineering Issues
E8.1
Control Rod Position Indications
a.
Ins ection Sco
e 92903
The team reviewed control rod position indication concerns
and apparent position
discrepancies.
The review included:
(1) frequency of control rod indication
problems;
(2) cause of the observed
"bounce" phenomenon
and resolution; and
(3) licensee actions based
on industry experience.
b.
Observations
and Findin s
The licensee had identified and tracked various rod position indication problems, at
an average of approximately one per month, during plant operations for fuel
Cycle 12.
During the plant response
to the manual reactor scram following the
performance of a reactor feedwater pump trip test, three control rods were not
verified by the plant computer to be at their full-in position.
This concern was
documented
in Problem Evaluation Request 297-0244.
Plant operators verified that
all rods were inserted by full core display and auto scram timer data.
The licensee
included the rod position indication concern in with other related issues documented
in Problem Evaluation Requests
297-0153 and 297-0187.
The team noted
a combination of three reed switches provided rods-in position
indication; two switches were located at the normal latched position and a third
switch corresponding
to just beyond full-in position.
The licensee was unable to
determine the specific control rods from the operator logs or interviews conducted
with control room personnel.
The team found that a new data system, currently in
a test mode, indicated that all control rods were full-in immediately following the
scram, but several control rods sporadically lost indication at various times.
20
Problem Evaluation Request 297-0187 documented
that during the performance of
scram time testing of Control Rod 1415, the respective
blue scram light and green
full-in light failed to illuminate.
The licensee identified that after the scram test
switches were reset, an unusually long period of time elapsed
before flow
movement noises
in the hydraulic control unit ceased;
at which time rod position
indications had returned to normal.
The tearri noted that the blue scram light
provided indication that both scram valves were in the fully open position, providing
full accumulator flow to the hydraulic control unit to rapidly insert the control rod
into the core.
The team observed that the green light provided indication that the
control rod was at the fully inserted position of the core.
Troubleshooting
efforts by plant personnel
identified the cause of the blue scram
light indication problem to be a limit switch failure.
The team found that the limit
switches for the scram valves of Hydraulic Control Unit 1415 had been
, subsequently
replaced.
Post-maintenance
testing resulted in all normal indications,
including the blue scram light response
regarding scram test switch operation.
No
additional problems regarding the blue scram light indications have occurred since
the replacement
of the limit switches for the effected scram valves.
The license
determined that the scram valves for the effected control rod should be refurbished
at the next available opportunity to ensure normal response
characteristics
while
closing.
The team determined that no safety function was provided while resetting
or closing the scram valves.
General Electric provided Service Information Letter 532, dated March 27, 1991,
regarding full-in control rod position indication.
This service information letter
stated that several boiling water reactors have temporarily lost "full-in"control rod
indication during reactor scrams.
Although not verified, General Electric postulated
that following a reactor scram, the position sensing magnet was subjected to
temperature
excursions,
which reduced its magnetic strength until cooling water
had been restored.
The letter recommended
modifying the rod position information
system logic to indicate full-in if any one of the three reed switches monitoring the
corresponding
position was closed.
Plant personnel
had implemented
a similar
modification 2 years prior to the service information letter submitted by General
Electric to.minimize spurious data fault indications.
The licensee had performed the
modification in accordance
with Maintenance Work Request AT5718 by changing
the programmable
read only memory locations corresponding
to the full-in logic
portion of the position indication probe data processing
cards.
With this change,
either of the two normal latch position switches combined with the full-in position
switch would provide the green full-in and data fault indication.
The team noted
that this modification did not prevent the momentary loss of full-in position
indication during the manual scram during the reactor feedwater pump trip test.
The team observed that scram valves for Control Rod 1415 were scheduled
for
refurbishment during Refueling Outage 12, in addition to replacement of position
indicator probes with identified problems during the last operating cycle.
The team
observed that, as a part of the corrective action plan, during control rod testing all
21
control rod position indications were verified to operate properly, including each of
the full-in and full-out position reed switches.
The team found that the licensee
staff had not implemented
a replacement
plan for scram valves, scram limit
switches, or position indicator probes, prior to failure.
c.
Conclusions
The licensee's
corrective actions following the position reed switch failures were
conservative
and demonstrated
an aggressive
approach
in tracking and r.solving
past rod position indication problems.
IV. Mana ement Meetin s
X1
Public Meeting and Exit Meeting Summary
A public meeting was held in the Region IV office on May 30, 1997, to review the
events leading to the March 27, 1997, reactor feedwater pump test, the safety
implications of resulting events, the post-event reviews performed by the event
evaluation team and independent
evaluation team, and the corrective actions being
implemented or proposed.
The team presented
the inspection results to members of licensee management
after the conclusion of the inspection on July 30, 1997.
The licensee
acknowledged
the findings presented.
During the inspection the licensee identified
that certain material details examined should be considered
proprietary.
None of
these details are contained
in the report.
22
ATTACHMENT 1
Supplemental
Information
PARTIAL LIST OF PERSONS CONTACTED
Licensee
J. Arbuckle, Licensing Engineer
R. Barbee, Assistant Manager System Engineering
P. Bemis, Vice President for Nuclear Operations
R. Burk, System Engineer
A. J. Fonstock, Training Supervisor
P. Inserra, Licensing Engineer
R. Libra, Systems
Engineering Supervisor
D. Mand, Manager, Design and Projects
D. Mano, Design Engineer Manager
M. Monopoly, Operations Manager
B. Pesek, Supervisor Major Projects
G. Shindehite, Technical Specifications
G. Smith, Plant General Manager
J. Swailes, Engineering Director
D. Swank, Regulatory Affairs Manager
R. Webring, Vice President Operations Support
D. Whitcomb, Principal Engineer
INSPECTION PROCEDURES USED
IP 52001:
IP 52002:
IP 92901:
IP 92903:
Digital Retrofits Receiving Prior Approval
Digital Retrofits without Prior Approval
Followup - Operations
Followup - Engineering
50-397/9710-01
VI0
50-397/9710-02 VIO
ITEMS OPENED
Design Criterion III (Section E1.2)
Two examples of inadequate
10 CFR 50.59 reviews
(Sections E1.2 and E1.3)
LIST OF DOCUMENTS REVIEWED
Letter from Mr. P. R. Bemis, Vice President
Nuclear Operations,
dated June 25, 1997,
Nuclear Plant WNP-2, "Operating License NPF-21-Reactor
Pump Trip Test
Response
To Questions"
Plant Operating Committee Meeting 97-24.02, dated June 28, 1997, background
material
Plant Operating Committee Meeting 97-24 Meeting Minutes, dated June 25, 1997
Procedure 4.602.A6, "602.A6 Panel Alarms," Revision 8, and procedure revision form,
dated June 24, 1997
Safety Evaluation 97-078, "Recirculation Flow Control System Digital Feedwater
Level
Control System Feedwater
Pump Trip Test Followup 10 CFR 50.59 Safety Evaluation,"
Revision 0
Y
PMR 87-0244-6, "RRC-ASD-Interconnection 5 Control Room Mods, dated January 31,
1996
ASD-DFWLC Testing Overview
Procedure 4.12.4.7, "Unintentional Entry Into Region of Potential Core Power Instabilities,"
Revision 14
Problem Event Report 297-0244," Following RFW Pump B and Expected
RRC Runback to
27 Hz, a Second Unexpected DiffTemp Cavi Runback Occurred" dated March 27, 1997,
and associated
corrective action plans
Problem Event Report 297-0246, "Following Manual Reactor Scram Reactor Feedwater
Control System Did Not Reactor Level Below Level 8," dated March 27, 1997, and
associated
corrective action plans
PMR 91-0438-0, Field Change Request 91-0438-0-08, "The Power Ascension Test portion
of the Test Requirement Summary needs to be revised to include additional testing required
by POC," dated November 17, 1995
GE SIL 380, "Control of Neutron Flux Noise in Low Damped Operating Conditions"
Licensee Letter, "WNP-2 Operating License NPF-2, Evaluation of March 27, 1997 Reactor
Scram," dated April 9, 1997
Work Task Order BST8, RRCTT01 Suet Temp LOOP Cals, dated December 23, 1996
Procedure 8.3.339, "Test Instructions-Reactor
Recirculation Adjustable Speed
Drive and
Reactor Digital Feedwater
Control Power Ascension Test Program," Revision 3 and
Temporary Change Notice 97-108
Procedure 8.3.375, "Reactor Feedwater Turbine Digital Retrofit Preoperational
Test,"
Revision 0
1996 Power Ascension Test Report, Dated December 31, 1996
Procedure 8.3.386, "Test Instructions-RFW Governor'ost Maintenance
Retest and
Tuning," Revision
1
Procedure 8.3.376, "Test Instructions-Reactor
Recirculation Adjustable Speed
Drive
Preoperational
Test," Revision 0
Problem Event Report 296-0624, "DFWLC," dated August 11, 1996
Procedure 8.2.23.c, "Feedwater System-Feedwater
Pump Trip Test," dated January
16,
1984
Independent
Evaluation Team Report dated May 9, 1997
Independent
Evaluation team Review of Final EET Report and Addendum
1, dated June 20,
1997
Event Evaluation Team Report issued May 9, 1997, and Addended Report 1, issued June
1997
Safety Evaluation Report, Amendment dated June 3, 1996 (GI2-96-137)
Licensed Operators/STA Requalification Training for ASD and DFWLC
General Electric Letter 94-PU-0013, dated March 18, 1994
Safety Evaluation Control 93-200, dated July 11, 1995
Safety Evaluation Control 96-106, dated December
12, 1996
Procedure
1.4.14, "WNP-2 Software Control," Revision 0
WNP-2 Reactor Trip Report 97-1
Prebrief Check-off Sheet for March 27, 1997, planned reactor feedwater pump trip test
(OI-22, Revision B)
Procedure 4.12.4.7, "Unintentional Entry into Region of Potential Core Power Instabilities,"
Revision 14
BWROG Stability interim Corrective Actions and licensee's
response
GENE-208-12-0793,
"WNP-2 Power Up Rate Supplement for the WNP-2 Control System
Design Report, Incorporating the Adjustable Speed rive Reactor Recirculation System"
Plant Modification Request 87-0244
NRC letter dated June 4, 1997, T. P. Gwynn to J. V. Parrish, "Summa'ry of Meeting with
Washington Public Power Supply System (WNP-2) on May 30, 1997
Plant Operating Committee Meeting Minutes, dated June 25, 1997,
.Cycle 012 Core Operating Limits Report
Problem Evaluation Request 297-0187
General Electric provided Service Information Letter 532, dated March 27, 1991
ATTACHMENT2
Letter G02-97-131
Licensee Response
to Supplemental
Ouestions
dated June 25, 1997
WASHINGTON PUBLIC POWER SUPPLY SYSTE!vI
PO. Box 968
~ Richlnuit, iYashingtou 99352-0968
Docket No. 50-397
U. S. Nuclear Regulatory Commission
Attn: Document Control Desk
Washington, D. C.
20555
Gentlemen.'ubject:
NUCLEAR PLANT WNP-2, OPERATING LICENSE NPF-21
REACTOR Fl<3<3)WATER PUMP TRIP TEST
RESPONSE TO QUESTIONS
Reference:
Letter, dated June 4, 1997, TP Gwynn (NRC) to JV Parrish (SS), "Summary of
Meeting with Washington Public Power Supply System (WNP-2) on May 30,
1997"
This letter provides our response to the requested information in the referenced letter pert'uning
to the reactor feedwater pump trip test and reactor scram which occurred on March 27, 1997.
The Supply System was requested
to address certain items prior to WNP-2 leaving Operational
Mode 4 and entering Operational Mode 2 for startup.
Our response
consists of this letter and Attachments A and B. In Attachment A, responses
to
each of the six items pertaining to the reactor feedwater pump test are provided.
Attachment
B consists of a listing of recommendations
from the Event Evaluation Team (EET) and the
Independent Evaluation Team (IET) and the planned response
to these recommendations.
As a result of divergent findings or recommendations
resulting from the IET review of
preliminary results from the EET, an additiona1 evaluation of plant response to the event was
performed.
The results of this evaluation were incorporated as an addendum to the final ~MT
report.
Additional insight into the factors that contributed to the differential temperature
cavitation
interlock trip which preceded
the manual scram is provided in the addendum.
The major
contributors were the effect of the conservatism
in the trip logic implemented
during the
Adjustable Speed Drive (ASD) modification and the final power and flow conditions of the
Reactor Recirculation
(RRC) System pump runback.
These
were estimated
to reduce
the
~
~
differential temperature
margin by 1.5 to 2.0 degrees Fahrenheit and 1.5 degrees Fahrenheit,
respectively.
REACTOR FEI<3)WATER PUMP TRIP TEST
RESPONSE TO QUESTIONS
Page 2 of 2
Also evaluated was the effect of power uprate and digital feedwater on differential temperature
reduction.
These
were shown to be less
significant', at 0.5 and 0.3 degrees
Fahrenheit
respectively.
Finally, the impact of the difference in runback rates between flowcontrol valve
and ASD runback rates were confirmed to be a smaller contributor to loss of differential
temperature margin. Details of the various parameters
that potentially could have impacted the
differential temperature
cavitation interlock are contained in the addendum
to the final EET
report.
Should you have any questions or desire additional information pertairung to this letter, please
call me or P.J. Inserra at (S09) 377-4147.
Respectfully
P..
s
Vi
President, Nuclear Operations
Mail Drop PE23
Attachment
CC:
EW Merschoff - NRC RIV
KE Perkins, Jr. - NRC RIV, Walnut Creek Field Office
TG Colburn - NRC NRR
NRC Senior Resident Inspector - 927N
DI. Williams - BPA/399
PD Robinson - Winston & Strawn
IL
I
( ~
REACTOR FEEDWATER PUMP TRIP TEST
RESPONSE TO QUESTIONS
Attachment A
Page 1 of 13
The Supply System
was requested
to address
the following items prior to WNP-2 leaving
Operational Mode 4 and entering Operational Mode 2 for startup.
For ease of reference,
a
restatement of each item is provided.
Item 1
"When willthe IET review of the final EKT report be completed?"
On June 20, 1997 the IET completed its review of the final EET report along
with the report addendum and the proposed responses
to items one through four
of this attachment.
The IET concluded that the subsequent followup effort resulting in the finalEET
report and associated
addendum adequately
addresses
the concerns identified in
the IET report.
Specifically, the EET has provided information to v'alidate the
causes fox the event.
With respect to the IET recommendations,
the Supply System has accepted
the
recommendations
and has provided a schedule forresolving them. The two issues
which could potentially impact reactor startup (i.e., rerun ofthe reactor feedwater
pump test and analyze plausible causes for the event) are considered closed as a
result of actions taken and planned by the Supply System.
The planned actions
for the remaining recommendations will be adequately
resolved
as part of the
ongoing activities related to the event.
A separate
assigned
team,
including a supervisor,
has
been
established
to
implement and close all open issues related to the ASD and DFWLC systems.
Xtem 2
S
"Based on questions raised by the IET regarding the thoroughness
of the
a<gustable speed drive transient analysis with respect to the modifications,
please
provide your actions or plans for a thorough engineering and/or
operational design feature review of the digital feedwater and acgustable
speed drives and the power uprate modification.
This integrated review
should
ensure
that other operating
parameters,
simjtlar to the reactor
recirculation
system
delta
temperature
cavitation interlock,
were
not
impacted by these changes."
The original design and analysis for the Adjustable Speed Drive (ASD) and
reactor power uprate (RPU) modifications were performed
as
an integrated
product.
Letter
"Preliminary
Design
of WNP-2
Recirculation Adjustable Speed Drive," dated March 1992,
states in the first
paragraph of the Introduction Section,
"The preliminary design of the ASD
implementation for the WNP-2 Reactor, Recirculation System is developed to be
consistent with the ASD &Power Uprate projects."
As such, the integration of
REACTOR FEEDWATER PUMP TRIP TEST
RESPONSE TO QUESTIONS
Attachment A
Page 2 of 13
these two projects started during the preliminary design phase.
In fact, separation
ofthe two projects had to be made to allow RPU to be implemented in 1995 with
the ASD modification implemented in 1996.
This split was performed due to a
lack of sufficient resources
to complete both projects within the same year and
during the same refueling outage.
During the design phase of the Digital
Feedwater Level Control System (DFWLC), design inputs considered that both
the ASD and RPU modifications were in place.
The Supply System's Event Evaluation Team~ performed a review of the
design
requirements
for the DFWLC and ASD systems.
The Independent
Evaluation Team (IET) reviewed the EET preliminary results and questioned the
thoroughness of the work completed at that time, particularly with respect to the
evaluation of the integration of the DFWLC, ASD and RPU changes
made at
WNP-2. A description of the additional integrated review performed is provided
below.
The Supply System's
EET reviewed
the impact of the DFWLC and ASD
modifications, verses
the analog
feedwater level control system
and
analog
recirculation flow control system,
on plant design.
In particular,
the EET
evaluated the followingtransients, anticipated operational occurrences,
and events
and the potential impact of the ASD and DFWLC systems on these events:
ao
b.
C.
d.
e.
f.
g.
h.
Transient MCPR Control - FCV Failure
MCPR Control - Idle Recirculation
Pump
Start-
up/Recirculation Speed Changes
Recirculation Pump Trip System
SCRAM Avoidance - Core Flow Increases
SCRAM Avoidance - Loss Of Reactor Feedwater Pump
Equipment Protection - Cavitation Interlocks
Equipment Protection - Valve Interlocks
Loop Mismatch
Maintain Core Circulation - Reactor Recirculation System (RRC)
60 Hz Trip
Anticipated Transient Without SCRAM (ATWS)
In response
to an IET concern
regarding
the completeness
of the review
performed by the Supply System's EET, the Supply System, in conjunction with
senior members of the General Electric Nuclear Engineering
(GENE) staff,
performed a review of other operating parameters
to ensure that they were not
REACTOR FEEDWATER PUMP TRIP TEST
RESPONSE TO QUESTIONS
Attachment A
Page 3 of 13
negatively impacted by the ASD/DFWLC/RPU modifications in a manner not
evaluated as part of the modifications.
Specifically, based on direction provided
by the Supply System's Engineering organization, GENE engineers performed a
review and submitted their preliminary results to the Supply System for review
and comment.
Following Supply System comments,
additional evaluation was performed by
GENE and the final results and concerns were provided to the Supply System.
For each of the operating parameters
reviewed, consideration was given to the
integrated impact of the three modifications. The results ofthe GENE review are
consistent with those obtained during Supply System reviews.
For the RPU modification, the review group looked at the following operating
parameters.
Each of these parameters were included in the RPU analyses
as part
of the RPU modification.
APRM flow biased simulated thermal power-high scram setpoint
Reactor vessel steam dome pressure-high
setpoint
APRMflowbias simulated thermal power-upscale scram setpoint equation
Neutron flux-upscale control rod block trip setpoint equation
Main steam line high pressure setpoint
Rod Block Monitor instrument flow biased setpoint
Revised Group l SRV setpoints and the setpoint maximum tolerances to
reflect the RPU and SRV setpoint analyses
. Revised reactor pressure vessel pressure-temperature
curves for RPU
Required number of ADS valves required reduced by one for RPU
Turbine first stage pressure
scram bypass remains at 30% reactor power
Main steam line flow differential pressure setpoint revised
Reactor pressure vessel operating steam dome pressure raised
Reactor power raised to 3486 MWt
REACTOR F<E%2)WATER %AMP TRIP TEST
RESPONSE TO QUESTIONS
Attachment A
Page 4 of 13
Credited operating pressure for High Pressure
Core Spray (HPCS) was
raised
Rated feedwater flow was evaluated
Rated steam flow was evaluated
The runback rate for the Extended Load Line Limitwas analyzed as part
of the RPU and again as part of the ASD modification
For each of the RPU impacted operating parameters
listed above,
the review
group evaluated the parameters relative to changes caused by DFWLC and ASD.
No additional impacts were identified.
For the DFWLC and ASD modifications,
the review group looked at the
following:
ao
The recirculation fiow runback characteristics
were changed
since they
were previously based on flow control valve position and closure speed
With the ASD modification, these
characteristics
are based
on pump
speed.
This change was previously analyzed and determined to have no
appreciable effect.
b.
An ASD overfrequency trip was added to terminate the flowrunout event.
There is a separate overfrequency trip circuit for each of the RRC pumps.
This should have no effect on the other parameters or events since it stops
a transient from progressing.
C.
Cavitation Interlock changes
Setpoints - no changes
2.
Logic - designed
to be more conservative
since the worst case
differential temperature
is selected,
this is conservative from a
cavitation prevention point of view, but it also results in a slight
increase in the probability of a recirculation pump runback to 15
Hz and entry into Region A of the Power-to-Flow Map.
The
cavitation runback is a non-safety-related
equipment protection
feature.
3.
Removed the feedwater flow cavitation runback logic
REACTOR FEEDWATER PUMP TRIP TEST
RESPONSE TO QUESTIONS
Attachment A
Page 5 of 13
4.
Changed from an analog design to a more accurate digital design
as part of the ASD modification
d.
The single feedwater pump trip recirculation pump runback endpoint and
rate of runback were changed from flow control valve position and rate
of change to a recirculation, pump speed
end point and rate of change.
The setpoints were developed through a series of parametric studies
as
part of the ASD design effort.
e.
Added ASD equipment protection trips.
These should have no effect on
other parameters
since they are bounded by the recirculation pump trip
analysis.
The recirculation pump trip is an anticipated
operational
occurrence
that does not result in a plant scram or have other adverse
operational impacts.
One channel runback capability for loss of a single channel in one ASD.
This does not effect any other parameters in an unanalyzed way since it
is bounded by the recirculation pump trip analysis.
The recirculation
pump trip is an anticipated operational occurrence that does not result in
a plant scram or have other adverse operational impacts.
g.
Jet pump sensing line clamps were added for the variable pump speeds
(and thus pump vane passing
frequencies)
that would be encountered.
This does not effect the other parameters.
h.
The recirculation flow control valves were locked open.
The ASD
analysis was performed with the ASDs instead of the fiow control valves
providing flow control.
Electrical bus harmonics were evaluated to determine the effects of the
ASDs.
Acceptable conditions were verified for the electrical distribution
system and connected equipment.
J ~
The recirculation system runback lower limitfor a single feedwater pump
trip was lowered.
This impacted the cavitation interlock.
None of the
other operating parameters
were impacted.
An evaluation of the effect of fault logic or signal noise (transition to
single element flow control) was not specificaQy analyzed.
However,.
these changes were implemented to reduce the impact ofequipment failure
or degradation,
and
thus provide for improved system
performance.
Operation in single element control is a condition that was previously
analyzed.
REACTOR HU~MWATERPUMP TRIP TEST
RESPONSE TO QUESTIONS
Attachment A
Page 6 of 13
1
The DFWLC system
was designed
to fully open the feedwater pump
minimum flow bypass
valves back to the condenser
for 30 seconds
followinga scram and then to ramp these valves closed.
This change was
implemented to reduce the potential for a high reactor water level gevel
8) due to swell following a scram.
This change was evaluated as part of
the 10CFR50.59 Safety Evaluation for the DFWLC system.
Additional
analysis has recently been performed and it was deterinined that this valve
action has littleeffect in avoiding the Level-8 trip, and does not adversely
impact plant performance following a scram.
m.
The quasi-steady
state behavior of the differential temperature cavitation
interlock was previously analyzed.
However, the dynamic evaluation of
the instrument system was not previously analyzed for impact from ASD,
DFWLC, and RPU. Significant analysis has now been performed and an
interim modification to the differential temperature
cavitation interlock
will be implemented prior to plant restart from the current maintenance
and refueling outage.
This includes a change to the current time delay
from 15 seconds to 10 minutes. Plant procedures willbe revised to reflect
this change and to provide plant personnel with the information necessary
to ensure that the fatigue usage of 15 minutes for the remaining lifeof the
plant for the jet pumps
is not exceeded
due
to cavitation.
This
modification may become permanent
pending
the results of followup
cavitation logic change review efforts.
The differential temperature
setpoint willbe increised from 9.9 degrees
Fahrenheit to 10.7 degrees
Fahrenheit.
Although original evaluations
resulted in a setpoint of 10.7 degrees Fahrenheit, it was determined based
on initialpower ascension
testing results that 9.9 degrees Fahrenheit was
acceptable.
Subsequent
increased
core flow and power uprate analyses
concluded
that the original evaluations
remain valid and no setpoint
changes
were required.
Based on followup assessments,
the setpoint is
. being changed to 10.7 degrees Fahrenheit.
As discussed above, the evaluations of the operating parameters
and the potential
impact of the ASD, DFWLC and RPU modifications did not identify adverse
effects to these parameters
not previously evaluated,
except for the delta T
cavitation interlock.
Apreliminary review has been completed and did not identify any additional tests
that need to be re-run to validate the initial startup test program results.
In
addition, after startup an evaluation willbe completed of the FSAR Chapter 14
initialpower accession
startup test program acceptance criteria to ensure that the
changes
implemented by ASD, DFWLC and RPU did not impact the initial
REACTOR FEEDWATER PUMP TRIP TEST
RESPONSE TO QUESTIONS
Attachment A
Page 7 of 13
startup test program results and conclusions.
Item 3
"VVhat evaluations willbe performed to integrate the IET and EET findings
regarding the adjustable speed drive modification and the digital feedwater
problems identified in Problem Evaluation Report (PER) 297-0246?"
The concern regarding occurrence of the post-scram high water Level-8 trip was
specifically not part of the EET charter and has not been addressed
by the EET
or IET. Resolution of this problem is being tracked by the Problem Evaluation
Request (PER) process.
i
Since initialstartup ofWNP-2, several design changes have been implemented to
improve the chances ofavoiding a Level-8 trip following a scram.
These include
setdown'of the vessel level setpoint followinga scram, reduction ofthe muiiinum
steady-state
pump governor
speeds
and,
most recently, with the
addition of the DFWLC system,
momentary opening of the feedwater pump
minimum Qow bypass to condenser valves upon a scram to reduce the vessel refill
rate.
Preliminary evaluations
determined
that each of the design
change
features
operated correctly and sluggish governor valve actuation had caused the Level-8
trip.
General Electric and Lovejoy Controls, Inc., assisted
Supply System
Engineering in reviewing the feedwater turbine response.
Based on available
data, it was concluded
that the Digital Feedwater
Level Control (DFWLC)
System appeared
to function correctly. Initial analyses indicated that a sluggish
relay valve was the most likely cause ofvessel level reaching Level-8.
Based on
the recommendations,
testing and intrusive investigations were completed
and
found the relay valves in both Reactor Feedwater Pump Turbines A and B to be
sluggish and scored.
The relay valves were removed, polished and cleaned and
confirmed to be working properly. Arepresentative from Lovejoy Controls, Inc.,
was on site during the relay valve work effort. The cause ofthe problem appears
to be less than adequate filtration in the feedwater pump turbine oil system.
To further determine
the most likely cause of the Level-8 trip, computer
(RETRAN) simulations,
specific to WNP-2, were recently completed by the
Supply System to evaluate the effectiveness of these enhancements
as well as to
quantify the effect of the sticking relay valve.
Results determined that each had
minimal effect in either causing, or avoiding, the Level-8 trip point. In fact, the
only
effective
means
of avoiding
vessel
overfill was
determined
to
be
improvement in the responsiveness
of the governor controller following a scram.
The required changes are complex.
These changes willcontinue to be evaluated
after reactor startup and a remedy implemented at the first future window of
REACTOR FEEDWATER PUMP TRIP TEST
RESPONSE TO QUESTIONS
Attachment A
Page 8 of 13
appropriate plant conditions.
ln order to assess
the impact of continued
operation of the plant without
resolution of this problem,
an
assessment
of the
safety
significance
was
performed.
Results determined that a post-scram Level-8 trip of this type does
not represent
a safety concern.
Additional actions may be required to preclude
or recover from a Level-8 trip.
However, plant operators
are trained that a
Level-8 trip followinga scram may occur. This training includes actions that can
be taken to either avoid the trip or respond accordingly should a trip occur.
Item 4
"Provide an accounting for each ofthe EET and IET recommendations.
This
accounting should provide a direct correlation between the recommendation,
its acceptance
or denial, whether the action is complete or its status, and
whether the recommendation
actions will be implemented prior to plant
restart."
The Supply System response
to this question is provided as Attachment B and
contains the EET and IET recommendations.
In each case, the recommendations
have been accepted and entered into the Plant Tracking Log. Completed actions
have been identified as well as those which willbe completed prior to reactor
startup.
The criteria for completion before startup include items that would adversely
affect plant safety or clearly decrease plant reliability or capability.
Corrective
actions that met this criteria are identified as items that require completion before
the end of the R-12 Maintenance and Refueling Outage.
Item 5
"Determine whether the instaHed a@ustable speed drive modification resulted
in an unreviewed safety question and whether an additional submittal will
need to be reviewed by the NRC modifying the previous safety evaluation.
Your response
should also include whether the planned delta T cavitation
interlock setpoint resolution willrequire NRC review and approval."
1. Plant Response to the Event
For the purposes of an unreviewed safety question determination, the activity is
defined as the plant response to the reactor feedwater pump trip test event.
This
includes
the differential temperature
cavitation interlock trip and
associated
reactor recirculation pump runback, indicated entry into Region A of the Power-
to-Flow Map, and water level response.
REACTOR H~MDWATERPVMP TRIP TEST
RESPONSE TO QVESTIONS
Attachment A
Page 9 of 13
The cavitation interlock protects
the recirculation pumps and jet pumps from
cavitation damage.
The interlock signal is the differential temperature between
the steam dome temperature
(derived from steam dome pressure
measurement)
and the recirculation pump suction temperature.
Increasing the pump speed above
the minimum value is prevented ifthe temperature
difference is less than the
setpoint.
Similarly, the pumps are automatically run back to the minimum speed
ifthe setpoint is reached.
Minimum speed is below the cavitation threshold.
Followup sensitivity evaluations were performed that considered
the effect of
changes
in various
parameters
and
plant
characteristics
as
a
result
of
implementation ofpower uprate and the ASD and DFWLC modifications. These
analyses
further defined. the extent to which final test conditions,
a more
conservative trip logic, and other variables, combined to reduce overall operating
margin during the trip test.
However, initiation of the interlock and subsequent
runback of the RRC pumps
to
15 Hz is bounded by the more severe
and
previously-analyzed trip of two recirculation pumps transient.
Reactor recirculation system flow run-back and recirculation pump trip events
leading to entry into stability Region A of the WNP-2 Power-to-Flow Map were
considered in establishing the stability region boundaries.
Response to entry into
Region A of the Power-to-Flow Map is controlled by Technical Specification 3.4.1, "Recirculation Loops Operating.
Compliance with the limitingcondition
for operation action statements in this specification, in the event of entry into
Region A, assures
that a USQ does not exist.
It was
recognized
during development of the stability region that there is
reasonable
probability that unplanned
operational
occurrences,
most notably
recirculation pump trips and run-backs,
could lead to entry into the stability
region.
The region definitions account for entry into the region as a result of a
core flow reduction,
independent of the probability of occurrence of such a
reduction in core flow.
As an aside, the Supply System has committed to implement Stability Solution
Enhanced Option I-A. General Electric Licensing Topical Report NEDO-32339-
A, "Reactor Stability Long-Term Solution: Enhanced Option I-A,"Revision 0,
was developed to provide a methodology for prevention of reactor instabilities.
The NRC determined that Enhanced Option I-A was acceptable for referencing
in license applications to the extent specified, and under the limitations delineated
in NEDO-32339 and the associated NRC technical
evaluation.'etter
and Safety Evaluation, RC Jonea (NRC-NRR) to RAFinelli (BWROG), Acceptance forRcferencing ofTopical Repott NEDO- 32339, Reactor StabiTity Long tcrtn Solution: Enhanced Option I-Ag'AC M89222),
dated April24, 199$
REACTOR mt~WATER PUMP TRIP TEST
RESPONSE TO QUESTIONS
Attachment A
Page 10 of 13
In the Topical Report, it was recognized that the establishment of the Exclusion
and Restricted
Regions
assures
stability at anticipated
terminal reactor
state
conditions following plant transients.
It was stated in the report that transients
that result in limiting reactor stability conditions are loss of feedwater and core
flow reduction events.
'vents
whose
reactor
state
trajectories
would enter
the Exclusion Region
terminate with automatic reactor scram at the region boundary.
The treatment of
events that teaninate within the Restricted Region depends upon whether they
initiate inside or outside of the Restricted Region.
In a followup to the Topical Report, it was also recognized that flow reduction
events
may
have
a
significant effect
on reactor
stability
performance.'xamples
of flow reduction events are one or two reactor recirculation pump
trips, reactor recirculation pump runbacks, and reactor recirculation flowcontrol
valve runbacks.
However, the specific mechanism causing these events is irrelevant.
Reasonably
limiting flow reduction events considering the combination of all parameters
affecting stability performance
are defined for the stability region boundary
validation analyses.
The ASD and DFWLC system response pre-scram to the feedwater pump trip and
subsequent recirculation fiowrunback was as expected with regards to the reactor
vessel water level and did not result in a Level-3 scram.
As the feedwater flow
stabilized out, the reactor vessel level swelled and peaked
at slightly over 51
inches, avoiding a Level-8.
Initiation of a feedwater pump trip not initiating a
reactor trip indicates
that the control system
response
does not increase
the
probability ofa more severe transient resulting &om an operational event.
Other,
less limiting, operational events are analyzed in the General Electric ASD control
system report and are shown not to degrade due to ASD and DFWLC system
response.
Therefore, less limiting transients do not become additional transients
for FSAR analysis.
The post-scram response is not dissimilar to what would have been seen with the
previous analog system.
Since the Level-8 trip was reached post-scram,
there
was no adverse impact on the fuel thermal limits. For long term cooling and
inventory make-up,
the High Pressure
Core Spray (HPCS) System would be
available once the water level lowered to the initiation setpoints.
Therefore, the
NEDO-32339, ReviYion i,
Licensing Topical Report - Rcactoe
StabiTity Long-Tcrtn Solution: Enhanced
Option I-h,
dated
December 1996
REACTOR H~3H)WATER PUMP TRIP TEST
RESPONSE TO QUESTIONS
Attachment A
Page 11 of 13
transients in the FSAR are stillbounding and, as a result, the consequences of an
accident as analyzed in the FSAR were not increased.
The Reactor Core Isolation
Cooling (RCIC) System would also be available once the water level lowered.
In conclusion, this situation does not result in a condition where 1) the probability
of occurrence or the consequences
of an accident or malfunction of equipment
important to safety previously evaluated in the safety analysis report may be
increased, or 2) a possibility for an accident or malfunction of a different type
than any evaluated previously in the safety analysis report may be created, or 3)
the margin of safety as defined in the basis for any technical specification is
reduced.
2. Differential Temperature Cavitation Interlock
With regard to the cavitation interlock, the following changes to the differential
temperature
logic for reactor
recirculation flow control
system
cavitation
protection are planned:
Differential Temperature Setpoint
The differential temperature setpoint willbe increased from 9.9 degrees
Fahrenheit to 10.7 degrees Fahrenheit.
Differential Temperature Setpoint Reset
'he
differential temperature
setpoint reset will be increased
from 10.9
degrees Fahrenheit to 11.2 degrees Fahrenheit.
Differential Time Delay to Runback
The differential time delay to runback willbe increased from 15 seconds
to ten minutes.
~
Alarm Features
Alarm annunciation willbe changed from actual runback initiation to the
start of the timing period.
The cavitation interlock protects
the recirculation pumps and jet pumps from
cavitation damage.
The interlock signal is the differential temperature
between
the steam dome temperature
(derived from steam dome pressure
measurement)
and the recirculation pump suction temperature.
Increasing the pump speed above
the minimum value is prevented if the temperature
difference is less than the
REACTOR FEEDWATER PUMP TRIP TEST
RESPONSE TO QUESTIONS
Attachment A
Page 12 of 13
setpoint. Similarly, the'pumps are automatically run back to the minimum speed
ifthe setpoint is reached.
The cavitation interlock setpoint is being changed to reflect calculated values,
includes margin, and accounts for the high cavitation conditions which would be
experienced
under increased core flow. Increasing the existing time delay will
result in the avoidance of unnecessary
reactor recirculation system pump speed
runbacks.
The alarm logic is being changed'to
initiate the alarm when the
cavitation setpoint is exceeded,
rather than the current design of after the time
delay.
Although original evaluations resulted in a setpoint of 10.7 degrees Fahrenheit,
it was determined based on initialpower ascension testing results that 9.9 degrees
Fahrenheit was acceptable.
Subsequent
increased
core fiow and power uprate
analyses
concluded that the original evaluations remain valid and no setpoint
changes
were required.
Based on followup assessments,
the setpoint is being
changed to 10.7 degrees Fahrenheit.
The allowable 10-minute time foroperating under cavitation conditions at WNP-2
is based on the measured
test results during a cavitation event at a BWR-4 plant
with a 251-inch diameter vessel, and additional conservatisms to allow for the test
results being consistent with a BWR-5.
It was concluded from testing and
calculations
that the cumulative time allowable for cavitations would be
15
minutes (cumulative for each pump for the reniaining life of the plant), taking
into account the presence ofjet pumps with set screw gaps in the past.
The recirculation fiowcontrol system does not perform any active safety function.
The primary relation of the system to the licensing basis analysis is as an initiator
of events.
The proposed
modification changes
provide adequate
equipment
protection against cavitation damage.
The proposed
change
does not alter assumptions
made in the licensing basis
documents
pertaining to reactor recirculation
system
pump response
during
transients or accidents.
The jet pumps are part ofthe reactor recirculation system
and are designed to provide forced circulation through the core to remove heat
from the fuel.
Because
the jet pump suction elevation is at two-thirds core
height, the vessel can be reflooded and coolant level maintained at two-thirds core
height even with the complete break of the recirculation loop pipe that is located
below the jet pump suction elevation.
The capability of reflooding the core to two-thirds core height is dependent upon
the structural integrity of the jet pumps.
Structural failure or system degradation
could adversely affect the water level in the core during the refiood phase of a
REACTOR FEW)WATER PUMP TRIP TEST
RESPONSE TO QUESTIONS
Qi
Attachment A
Page 13 of 13
Loss'of Coolant Accident (LOCA), as well as the assumed blowdown Qow during
a LOCA.
However,
a malfunction of a jet pump
is
considered
in the
Technical
Specifications.
The
Technical
Specifications
include
daily
surveillance
requirements
which are designed to detect jet pump failure and provide action
statements
should a jet pump failure be indicated.
The presence of cavitation
would not impact the ability of the surveillance to detect a jet pump failure.
The changes,
which were proposed
and accepted
by the Supply System
and
endorsed by General Electric, provide for avoiding recirculation pump runbacks
caused
by false indication of cavitation conditions or by a setpoint that is
inappropriate during some operating conditions.
This willalso allow Control
Room Operators time to validate the alarm and determine ifit is the result of an
actual condition or the result of spurious component failures or other problems.
In conclusion, this situation does not result in a condition where 1) the probability
of occurrence or the'consequences
of an accident or malfunction of equipment
important to safety previously evaluated in the safety analysis report may be
increased,
or 2) a possibility for an accident or malfunction of a different,type
than any evaluated previously in the safety analysis report may be created, or 3)
the margin of safety as defined in the basis for any technical specification is
reduced.
Therefore, prior NRC review would not be required.
Item 6
"WiHthe reactor feedwater pump trip test be rerun? Ifyes, then at what
initialconditions and on what schedule?"
The Supply System plans to rerun the feedwater pump trip test. Initialconditions
willbe consistent with those from the WNP-2 Power Ascension Test Program,
i.e., greater than 95 percent of thermal power.
The testing is planned to be
performed as a part of power ascension
testing at the completion of the R-12
Maintenance
and Refueling Outage
and in accordance
with Plant Procedure
(PPM) 8.3.339, "Test Instruction - Reactor Recirculation Adjustable Speed Drive
and Reactor Digital Feedwater Control Power Ascension Test Program."
The current sequence in the power ascension
testing schedule for this test is as
soon as practical after the completion of stable fullpower operation and required
100-percent-power calibrations and tests.
Att
tB
Response to Item 4
Page I of7
The listing below contains all EET and IET recommendations.
In all cases the recommendatlons
have been accepted
and entered
into the Plant
Tracking Log. Completed actions have been identified as well as those which will be completed prior to reactor startup (RXSU). Other actions wIII be
completed after startup (ARXSU).
The criteria for completion before startup include items that would adversely affect plant safety or clearly decrease
plant reliability or capability.
Corrective actions that met this criteria are Identified as items that require completion before the end of the R12 outage.
Recommendations
Item
Recomm end atioas
1.
hT Cavitation Setpoint and Methodology
Date
RXSU
The GE Factory Automatic Numeric Controls (FANUC) system compares
Inputs from the four RTD's suction temperatures
with Inputs
from two reactor steam dome pressure
Inputs.
The
FANUC determines
the differential temperature
(hT) by selecting the highest
temperature
input and the lowest pressure
Input. The following actions are recommended
with respect to the
9.9'F setpolnt and the
methodology:
a. Given the capability inherent in the ASD system, evaluate whether a more effective hT cavltatlon protection method can be designed
and implemented.
b. If a more effective hT cavltatlon protection method cannot be provided,
then evaluate through analysis whether to use the 10.7'F
setpoint
recommended
by GE or the 9.9'F setpoint determined by the Supply System ln the Interim and document the basis for this
decision.
Further, determine whether or not a higher setpolnt can be implemented to provide greater operating
margin while still
providing protection to the Jet pumps.
c. Need to decide or clarifywhether the setpolnt is a trip setpolnt or an analytical limit.
d. Ifit is a setpoint, the analytical limitand the accuracy/drift for the temperature and pressure loops need to be defined.
e. Ifit is an analytical limit, a calculation needs to be performed to determine the trip setpoint.
Att
tB
Respond
to Item 4
Page2of7
15 Second Time Delay
RXSU
Analysis needs to be performed to evaluate increasing the time delay and provide justification that the resulting time delay is short
enough to prevent excessive damage to the Jet pumps from cavitation and long enough for the system to stabilize following a transient
which could activate the cavitation interlock.
Alarm Logic
RXSU
The alarm logic should be changed to annunciate the alarm when the time delay timer starts, not when the time out Is completed. This will
give Operations some wamlng of a potential runback. The alarm coupled with a longer time delay could also allow Operations time to Insert
control rods and possibly avoid Region A should the runback occur after the time delay. Add the operator response
when the alarm ls
received In the annunciator response procedure (e.g., Is the alarm real or due to a human error).
Runback Value of 15 Hi
ARXSU
The runback value of 15 Hz should be reviewed for possible revision based on the Issue of core stability. The original cavitation logic was
developed prior to the concern over core Instability In regions of high power and low core flow. The present logic allows for a spurious or
unnecessary
runback to place the reactor Into such a condition.
Varying these
parameters
may allow avoidance of Region A.
This
evaluation should also consider single loop operation.
Cavitatlon Logic Change
ARXSU
Recommend
considering a modification to allow the logic to vary the time delay (dependent
upon sensed
conditions) as a long term
approach to improve the cavitation interlock. The current cavitation logic has a number of issues that together indicate that assessment
of a change to the logic would be beneficial to the plant. Issues Identifie during this review are:
a. Adding setpolnt margin to the interlock setpolnt will make it necessary to achieve a higher thermal power in power ascension
before
the speed can be Increased above 15 Hz. This will make It more difficultto avoid the stability increased awareness
zone at the low end
of the thermal power core flowmap (see Figure 1) during power ascension.
b.
The Interlock ls based
on the dNerential temperature
conditions that exist at high core flow and low thermal power.
The single
setpolnt causes the intertock to be excessively conservative at lower core fiows and thermal powers making it necessary to raise thermal
power to high values before speed can be Increased.
c. The interlock setpolnt Is based on two loop operation and does not Initiate a runback when needed for a region of the thermal power-
Att
tB
Response to Itein 4
Page3 of7
core flow map in single loop operation.
Operator action is needed in single loop operation to avoid entry into the region not covered by
the cavitation interlock.
d.
Increasing the allowable time for cavltatlon although It may be acceptable
in that it will not cause excessive
equipment damage
Is
conceptually the non-conservative direction. Analyses should establish acceptable limits and recommendations for minimizing this risk.
An interlock change that would allow changing the setpolnt of the interlock versus core flow, thermal power (e.g., feedwater flow) and the
number of operating loops would be more accurate and allow Increasing speed at lower rod lines during power ascension.
The possibility of a flow biased delta temperature interlock trip should be evaluated as another means of avoiding a delta temperature trip
during a transient.
TR 650 Temperature Values
Complete
As indicated in Figure 12, the values recorded on TR 650 are significantly lower than the RTD values due to the MV/I converter.
The
calibration of the converter should be adjusted to provide values that are more consistent with the actual RTD readings.
A further review of the Simulator model Is required to determine why it did not sufficiently model the feedwater flow rates, temperatures
and
ARXSU
reactor water level controller. Recommend that the Simulator staff fullyreview these differences.
The 5% / second rate limiter In the ASD speed control logic did not limit the ASD speed Increase during the January 1997 flow transients
ARXSU
which resulted from the Phase
Lock Loop (PLL) faults. Mechanisms
independent
of the ASD to limit RRC pump runback should
be
evaluated.
10.
Document the basis for the 1% / second and 5% / second rate limitersetting.
ARXSU
Simulator Staff evaluate the simulator ASD model versus the plant ASD for the Delta-T cavitatlon logic. Additionally, evaluate the simulator
ARXSU
recirc loop temperature and dome pressure/temperature
response to this transient.
Develop and Implement corrective actions as necessary.
4
Engineering General Manager work with the Nuclear Training Manager to enhance existing procedures for design and system engineering to
ARXSU
provide Information to the Simulator group to Identify deficiencies and improve the fidelityof the Simulator
12.
To provide clear guidance for the Simulator group, the Engineering General Manager and the Nuclear Training Manager, need to develop a
ARXSU
procedure, or enhance existing procedures such as P.P.M. 1.4.1, with acceptance
guide lines for who is responsible for gathering the plant
data and provide an acceptable time frame for updating the Simulator. Currently ANSI standard 3.5 allows 1 year to up grade the Simulator
Au
tB
ResIN
to Item 4
Page 4 of7
after change ln the plant Is made. This guidance should also address that in preparing for a special test, engineering should provide and the
Simulator group should implement the necessary
information to allow the Simulator to correctly model the proposed test.
13.
The Simulator group and Operations should set up a ",priority meeting'hich would allow setting the priorities for which Simulator up grades
ARXSU
should be made immediately and those that are not as Important, can be delayed. This meeting could be Incorporated
In into the TAG
meeting or be separate.
14.
Discuss with operations trainers, that when providing training for evolution's of this type, Nuclear Training should enhance the quality of the
ARXSU
training by conducting a refresher of all the trips and Interlocks for the component being tested.
15.
The Engineering General Manager should develop a task force, consisting of an Operations representative,
a System Engineer, a Design
ARXSU
Engineer, and a Training representative
to review P.P.M. 4.12.4.7 for possible lnstrumentatlon,
procedure,
and training enhancements
to
provide the operators improved guidance and greater flexibilityln maxlmizlng plant operations white avoiding stability region "A".
17.
Perform Feed Turbine test again to demonstrate the integrated plant response.
18.
Develop an appropriate method of properly Identifying critlcal parameters to compare, before and after conditions of systems that are to be
modified.
Consider adding this guidance to Engineering document PDS-9 when developed.
16.
Implement Corrective Actions associated with PER 29T-0248 (Feedturbine trip following SCRAM). PER 297-0248 tracks to completion.
ARXSU
ARXSU
ARXSU
19.
Develop a better means of establishing clear design bases for new modifications and provide a means to compare the new bases with older
ARXSU
bases.
Add this guidance to the appropriate Engineering Instruction.
20.
21.
Develop more comprehensive
modeling systems to better predict test results, prior to running the actual tests when practicable.
When not
practicable, model limitations must clearly be defined and understood.
Consider the following:
Know what parameters are going to change.
Know what Interlocks are influenced by these parameters.
Know ifwe can accurately predict that the interlocks willbe activated during the test and Ifthey cannot be modeled.
Know how we willmanage the issue In the test.
Review and consider the benefits of developing a tool such as
flow/tree diagrams that would list potential system Interactions during PMT.
The diagrams could be used to brainstorm ail predicted system responses
and then determine what steps should be taken to revise the
design or mitigate transients.
Ensure
that testing
Is completed
for both the grounding scheme
(FCR &T-0244-0-20) and the watt transducer
(FCR 87-02444-43)
modifications.
ARXSU
RXSU
At
tB
Respo
to Item 4
Page 5 of7
22.
The impact of the DFWLC setpoint modification (Work OQer ¹DDN2) on plant operation should be reviewed by reactor engineering and
Complete
operations to determine whether a revision to these setpoints is needed)
23.
Recommend
that engineering
ensure
that all ASD/DFW modifications planned for this outage
(Identified in section
7, Analysis) are
ARXSU
thoroughly reviewed using PDS-9 guidance including consideration of the recommendations from this Event Evaluation Report.
24.
Discuss the Impact of the causal factors of this event at an Engineering AllHands meeting.
Include the following in this discussion:
An event overview including fiindings of cause
The need for comprehensive review of Vendor supplied modifications,
How our mind set and other factors Impacted our ability to challenge certain assumptions during the ASD/DFW design phase,
Impact of the recent improvements in expectations for creating a challenging environment including positive reinforcement for staff
response to date,
Any changes to various Engineering Instructions or policies resulting from this review, and
Any other recommendations
deemed appropriate by management.
ARXSU
25.
As a part of Its overall Strategic Planning process,
Engineering
should (after the outage
concludes)
conduct a review session
using
brainstorming techniques to identify other potential mind set barriers that exist within the organization which hinder progressive thinking.
This session should include various levels of engineering staff and be designed to reward both the Identification of limiting assumptions and
suggestions to overcome those potential barriers.
The outcome should be documented
and functional suggestions
should be Incorporated
into engineering guidance documents and/or the Engineering Strategic Plan as appropriate.
ARXSU
Following (or as a part of) the session discussed
above, a review of current major modifications should be conducted to Identify any Impact
from the mind sets identified.
Design Engineering should review current engineering guidance documents (especially Engineering Standards
Manual PDS-9,) to ensure
ARXSU
that adequate guidance exists for reviewing:trip setpoints of interfacing systems, and industry experience with similar modifiicatlons
27.
While the Engineering Strategic Plan (as weil as recent changes to Project Review Group and Design Scoplng procedures)
establishes
a
foundation for improved standards
In this area, prior to initiating any major system tests Engineers and Operations should meet early ln the
design phase to identify and agree
on acceptable
standards
for the outcome of the test.
This guidance should be Incorporated
into
applicable procedures.
ARXSU
28
PDS-9 (put In place after the time frame discussed
here) addresses
the current expectatlons for the analysis and planning of new design
ARXSU
modifications.
Elsewhere
ln this report are suggested
changes to enhance
PDS-9.
Management
must ensure that PDS-9 Is properly
applied.
'T
~pe
Att
nt B
Response to Item 4
Page6of7
29.
Supply System personnel have become extremely knowledgeable on ASD/DFW through research, training, and experience over the life of'RXSU
the project. GE personnel contacted for this report described Supply System personnel as "some of the most knowledgeable ln the
Industry't
this point. The Team re'commends sending the system engineer to ASD school at the next available opportunity.
30
31
Engineering should review the existing Engineering Instructions to ensure that adequate
guidance ls provided regarding Supply System
ARXSU
involvement and overslgnt of vendor modifications. To be worked In conjunction with item 24 above.
Engineering and Training management
should review and agree to standards of Control Room Simulator fidelity. We recognize that the
ARXSU
Simulator was not intended as a modeling tool, but rather as a training tool and as such needs only to provide sufficient fidelityas to support
high quality training.
32
The Engineering Support Personnel Training Advisory Group (ESP TAG) should consider the benefit of training Design/Project Engineers on
ARXSU
the Impact of and considerations for changing a component design from a low precision (or analog) design to a high precision (or digital)
design.
Recommendations
from the IET
Item
33
Recommen dation
Date
Take action to inform the nuclear Industry, particularly the BWR 5 and 6 designs, of this potential via INPO networks and evaluate
its
ARXSU
reportability In accordance with regulatory requirements
34
The RRC pump cavltatlon protection requirements
and any modifications need to be reviewed consistent
with the plant operations
ARXSU
requirements and the experience gained as a result of the feedwater pump trip test.
The mind set that 'more conservative setpolnts are
better" needs to be carefully evaluated on a case by case basis.
Engineering should be tasked with the development of revised Interiock
setpolnt and or the time delay values to ensure design Intent Is achieved.
35
Engineering and operations perform a review of the design features of the DFW and ASD/RRC system under similar transient conditions to
ARXSU
ensure other operating parameters were not impacted by these changes.
36
Rerun Section 8.15 of PPM 8.3.339 after setpolnt modifications.
t'7
Response: The Supply System plans to rerun the feedwater pump trip test.
Initial conditions will be consistent with those required
by the WNP-2 Power Ascension Test Program, l.e. greater than 95% of thermal power. The testing Is planned to be performed as a
At
B
Res
Item 4
Page7 of7
part of power ascension
testing at the completion of Refueling Outage
12 and In accordance
with PPM 8.3.339.
The present
sequence
in the power ascension
testing schedule for this test Is as soon as practical after the completion of stable full power
operation and required 100% power calibrations and tests.
37
Senior management
should require accountability for the success of failure or functions or projects under their cognizance.
This should be
ARXSU
an element of each strategic plan as well as each short term task plan.
Senior management must set policy and performance expectations ln all areas and recognize the challenge ln Integrating complex changes
and interfacing with outside organizations.
38
The EET should analyze the plausible causes for the event and validate their findings.
RXSU