ML21021A283

From kanterella
Revision as of 23:38, 22 February 2021 by StriderTol (talk | contribs) (StriderTol Bot insert)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search
FAQ 20-06: GGNS Turbine Controls Upgrade Scrams One-Time Exemption
ML21021A283
Person / Time
Site: Grand Gulf  Entergy icon.png
Issue date: 01/21/2021
From: Joylynn Quinones-Navarro
NRC/NRR/DRO/IRAB
To:
Nuclear Energy Institute
joylynn Quinones-Navarro NRR/DRO
References
Download: ML21021A283 (9)
v • d • e


Text

NEI 99-02 FAQ 20-06 GGNS Turbine Controls Upgrade Scrams One-Time Exemption Proposed NRC Response Plant: Grand Gulf Nuclear Station - GGNS Date of Event: August 8, 2020 Submittal Date: December 22, 2020 Licensee

Contact:

Jim Shaw Tel/email: 601-437-2103 jshaw5@entergy.com John Giddens Tel/email: 601-368-5756 jgidden@entergy.com NRC

Contact:

Timothy Steadham Tel/email: 601-437-2387 tsteadh@entergy.com Performance Indicator: 1E01, Unplanned Scrams per 7000 Critical Hours Site-Specific FAQ (see Appendix D)? Yes or No FAQ to become effective when approved or _________________.

Question Section NEI 99-02 Guidance needing interpretation (including page and line citation):

  • NEI 99-02, Revision 7, Page 10, Lines 25-26 The number of unplanned scrams during the previous four quarters, both manual and automatic, while critical per 7,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />.
  • NEI 99-02, Revision 7, Appendix D, Page D-1, Lines 20 - 22 Then, if the licensee believes that there are unique circumstances sufficient to warrant an exception to the guidance as written, the licensee should submit a Frequently Asked Question to NEI for consideration at a public meeting with the NRC.
  • NEI 99-02, Revision 7, Appendix E, Page E-1, Line 12, 18-19 There are several reasons for submitting an FAQ:
3. To request an exemption from the guidance for plant-specific circumstances, such as design features, procedures, or unique conditions.

Event or circumstances requiring guidance interpretation:

Grand Gulf Nuclear Station shut down on February 22, 2020 for a refueling and maintenance outage with more than $200 million in upgrades planned to improve plant performance. During this refueling outage, the most comprehensive of these upgrades was a $160 million project which replaced and upgraded the existing Electro-Hydraulic Turbine Control System. The existing system was obsolete and becoming less reliable, resulting in multiple plant transients (e.g., LER 2016-004, LER 2018-001, and LER 2018-010).

This upgrade was a complex project which was further complicated by the COVID-19 pandemic.

The complexity of the work and the impacts of the pandemic resulted in an extended refueling outage which lasted 93 days. Although difficult to quantify, up to 33 days of the outage length has been estimated to be the result of pandemic impacts. This extended refueling outage along with other plant shutdowns has resulted in the plant having a low number of critical hours to be included in the unplanned scrams indicator calculation which makes the indicator more sensitive to events.

Subsequent to the plants startup from the refueling outage the plant has experienced 2 reactor scrams that were a direct consequence of the Turbine Controls Upgrade Project. These events were as follows:

1. On May 25, 2020, GGNS experienced a reactor scram due to a turbine trip (Licensee Event Report 2020-002-01). The root cause of the event was that the turbine controls engineering vendor established an air gap design for new turbine speed monitoring probes without documenting or validating critical assumptions for turbine shaft movement during operation.

The vendor based the assumption on previous operating experience which did not include turbines similar to GGNS. This unvalidated assumption led to an inadequate air gap design resulting in speed probe contact with the speed wheel resulting in the subsequent plant trip.

2. On August 08, 2020, GGNS experienced a reactor scram due to a Main Turbine High Pressure Control Valve (MTHPCV) malfunction (Licensee Event Report 2020-003-00). The root causes of the scram were: 1) The responsible engineers established a design for the MTHPCV actuator assembly without fully evaluating or validating the effects of vibration on the equipment and 2) project leaders did not ensure full implementation of Entergy processes as intended to verify vendor quality of the valve actuator assembly.

These design errors were the result of the same vendor not validating assumptions as part of the Turbine Controls Upgrade Project.

In the development of the ROP thresholds, SECY-99-007, Recommendations or Reactor Oversite Process Improvements, provided the following guidance, When establishing the thresholds it was taken as guiding principles that they should not result in a large number of false positives (page H-2). There are multiple ways an indicator can be influenced to result in false positives including:

  • For the unplanned scrams indicator, it was discussed in SECY-99-007 that, Rate indicators are susceptible to false positives when the denominator is small, as when a plant has been in an extended outage.
  • For the MSPI indicators, infrequently tested equipment can make the indicator vulnerable to single events.
  • Multiple PI exceedances can be the result of a single event or condition.

To prevent false positives when identified during the PI development or maintenance process, guidance has been put in place including:

  • Establishment of a lower threshold of critical hours (2400) for the unplanned scrams PI for determining when the indictor would not be valid solely due to low critical hours.
  • Establishment of a risk cap for MSPI components.
  • Allowances for treatment of multiple PI exceedances in the Safety System Functional Failures (page 32) and Occupational Exposure Control Effectiveness PI guidance (page 66).

GGNS is in a unique condition not addressed in the guidance in that it is experiencing low critical hours making the PI more sensitive to PI exceedances and multiple PI exceedances due to a common cause. As a result, Entergy believes the GGNS PI is more susceptible to a false positive than was intended in the development of the PI. Therefore, Entergy believes that there are unique circumstances sufficient to warrant an exception to the guidance as written.

Page 2 of 9

If licensee and NRC resident/region do not agree on the facts and circumstances, explain:

NOTE: The following verbiage (in Times New Roman font and italics) was provided by the NRC resident and is the Region IV perspective on the events.

It is RIVs position that the two scrams referenced in the proposed FAQ be counted as two separate occurrences rather than one.

The licensees position is that with the PI accounting as written in NEI 99-02, this would represent an inaccurate representation of licensee performance due, in part, to two extenuating factors: reduced critical hours due to COVID-19 outage delays and a common cause of the two scrams being related to the same modification.

Over the past few years Grand Gulf has been significantly challenged maintaining equipment reliability resulting in an unusually high number of unplanned scrams. Since 2016 the plant has scrammed 15 times (2016-3, 2017-1, 2018-3, 2019-3, 2020-5) and crossed the green-to-white threshold 3 times. The average number of scrams per site industry wide during this same period is approximately 0.5 scrams per unit.

Because of this Grand Gulf has been in Column 2 of the ROP Action Matrix for all but 5 quarters since the 3rd quarter of 2016. Because of the site challenges with scrams and unplanned shutdowns Grand Gulf has experienced lower than average critical hours, with the exception of 2019. Review of the PI data since 2016 shows the following critical hours: 2016- 4602.4, 2017- 6605.4, 2018- 6057.5, 2019-8220. In 2020 it is estimated that Grand Gulf will have 5528.6 critical hours. While lower than 7000 critical hours, this is not an outlier to previous yearly operational performance data.

95001 inspections were conducted in response to the first two white PI inputs. The first inspection resulted in a parallel white PI inspection finding due to the identification of two significant weakness and seven general weaknesses. The second 95001 inspection was successfully completed. Many of the scrams that were included in these inspections were the result of malfunctions or deficiencies with the legacy turbine control system. To address this the licensee determined the appropriate corrective action was to replace the legacy turbine controls system with a more reliable system during the 2020 spring refueling outage, which was the Turbine Controls Upgrade Project, the subject of this FAQ.

Turbine Controls Upgrade Project (Engineering Change EC-72780) is a large umbrella project that included modification activities upgrading or replacement of components and systems in the following areas:

1. Generator auxiliaries
2. Primary water instrumentation and controls
3. Turbine control valve actuators
4. Total replacement of the hydraulic system for the high-pressure electrohydraulic control system, and
5. New turbine/generator control system (the Ovation platform)

To accomplish this, the licensee completed at least 23 separate project modifications/activities. Each one of these activities was a major evolution. Because of the large and diverse scope of activities, sometimes completed by different vendors, the staff believes that it would be inappropriate to treat events that resulted from malfunctions or failures of different components as similar events.

The first scram (included as part of this FAQ) occurred due to a failure of the speed sensors for the main turbine when two of the speed sensors contacted the rotating speed wheel installed on the turbine shaft.

The contact was due to shaft movement during turbine control valve stroking. The turbine speed wheels and speed sensors were upgraded as part of installation of a digital turbine control and protection system Page 3 of 9

modification as per Engineering Change EC-72780. The licensee concluded the root cause was that the responsible engineers established an air gap design for the new speed monitoring probes without documenting or validating critical assumptions for turbine shaft movement during operation. The licensee reviewed other portions of this modification during their root cause evaluation as part of the extent of condition and extent of cause reviews and determined that all other portions of the modification were completed satisfactorily. As a result, The extent of condition evaluation resulted in no additional conditions requiring action to be taken. The extent of cause evaluation was also completed with a similar conclusion that no additional actions [for Grand Gulf turbine control upgrade] need to be taken.

The extent of cause review identified other projects that warranted further review at other Entergy sites such as ANO, River Bend, and Waterford. The root cause was reviewed and approved by station management on July 30, 2020.

The second scram that is the subject of this FAQ occurred on August 8, 2020, as a result of main turbine control valve oscillations. The licensee determined that the root causes for this scram was that the responsible engineers established a design for the actuator assembly without fully evaluating and validating the effects of vibration on the equipment and inadequate vendor oversight. These valves were likewise modified by EC-72780.

While the region has not yet had the opportunity to independently inspect and assess these events, the licensee causal evaluations provide relevant information. These evaluations indicate that there were at least three separate and distinct performance issues related to human error, design adequacy, and equipment performance. The staff believes that the licensee had an opportunity to address the deficiencies with EC-72780 as a result of the first scram that possibly could have prevented the second scram. As previously discussed, following the first scram the licensee determined that both the extent of condition and extent of cause evaluations resulted in no additional conditions requiring action to be taken. Not counting these two scrams independently could mask the deficiencies related to the root cause evaluation and corrective actions of the first scram, which would be inconsistent with the underlying premise of the PI.

Per IMC0308, Attachment I, the objective of this PI is as follows: This indicator monitors the number of unplanned scrams. It measures the rate of scrams per year of operation at power and provides an indication of initiating event frequency. These two events are separate and distinct with each one being completely independent from the other with respect to their impact on challenging plant stability and each one acting as its own initiating event challenging plant stability on their own (e.g., one did not happen right after the other). Additionally, the circumstances of the events were not directly related in the components that were affected (overspeed trip sensor vs. control valves hydraulics) and two different functional disciplines (Instrumentation and Control vs Mechanical). In fact, the staff asserts that the only commonality between these two events is that the related outage activities were done under the umbrella of the same plant modification, the Turbine Controls Upgrade Project, EC-72780, which as noted above represents a collection of many separate and independent modification activities. This PI is a direct measure of the initiating event likelihood and, in these two cases, the two unplanned scrams in question were separate and independent from each other and caused by different equipment failures. NEI 99-02 explicitly states that examples of the types of scrams that are included are those that result from equipment failures.

The Region IV staff is unaware of any significant outage delays incurred as a direct result of the COVID-19 public health emergency (PHE). During the outage period of February - May 2020 many discussions were held between Grand Gulf site management and staff, and the NRC resident inspectors and regional management. While challenges related to testing and preventative measures in response to the PHE were discussed, minimal delays to the outage timeline were indicated by the licensee, even when questioned Page 4 of 9

directly about potential outage schedule impacts. It is Region IVs recollection that the majority of outage schedule delays were due to difficulties with implementing the turbine control valve modifications due to equipment issues (and subsequently needed re-work) that was the major cause of any outage schedule delays.

Therefore, the NRC staff contends that these events represent the results of distinct errors and should be counted separately to meet the intent of what this PI is designed to measure.

Potentially relevant FAQs:

FAQ 16-03, Tornado Missile Protection (TMP) Potential Safety System Functional Failure In this FAQ, the NRC evaluated if multiple tornado protection design issues identified over a period of time should be counted as a single issue/event for PI purposes or as multiple issues/events. These issues were the result of engineering work that did not comprehensively incorporate the tornado missile protection concepts into the structural design. The NRC determined that only the first identified issue needed to be counted and that additional failures identified as a result of the same evaluation need not be reported separately.

FAQ 17-01 Grand Gulf June 2016 Power Change In this FAQ, the NRC evaluated an event at GGNS, where following a failure of the former Turbine Control System, the unit experienced multiple power changes which were greater than 20% rated thermal power. In this FAQ the NRC determined that multiple power changes of greater than 20% rated thermal power would only be counted once based on the event rather than 3 separate events which each resulted in multiple power changes.

These two FAQs, although for different indicators, addressed issues where multiple PI exceedances for a common cause resulted in the increased potential for a false positive result from the indicator. The current condition at GGNS is similar to these FAQs in that multiple events have occurred which impact the indicator and were the result of the same vendor not validating assumptions as part of the Turbine Controls Upgrade Project.

Response Section Licensee Proposed Resolution of FAQ:

Only the first scram needed to be counted by the PI and subsequent scrams as a result of the Turbine Upgrade Project need not be reported separately. A comment will be entered stating that the scram reported in Licensee Event Report 2020-003-00 is being reported under this one PI entry for Licensee Event Report 2020-002-01.

If appropriate, provide proposed rewording of guidance for inclusion in next revision:

Because it is believed this FAQ is site-specific and issue-specific, no wording changes are proposed to the existing NEI 99-02 Rev. 7 guidance.

Page 5 of 9

NRC Proposed Response Grand Gulf submitted this PI FAQ based on their view that the plant is in a unique situation not addressed in existing PI guidance (NEI 99-02) because the plant has experienced low critical hours and multiple PI exceedances due to a common cause. The licensee believes the plants IE01 PI is more susceptible to a false positive than was intended in the development of the PI and that this unique circumstance warrants an exception to the guidance as written.

Specifically, the licensee is requesting that both the May 25, 2020 scram reported in LER 2020-002-01 and the August 8, 2020 scram reported in LER 2020-003-00 be counted together as one scram, with the basis being that the design errors were the result of the same vendor not validating assumptions as part of the Turbine Controls Upgrade Project. The licensee referred to previous PI FAQs 16-03 and 17-01 as potentially applicable and stated, These two FAQs, although for different indicators, addressed issues where multiple PI exceedances for a common cause resulted in the increased potential for a false positive result from the indicator.

The IE01 PI was initially described in SECY-99-007 as follows:

This measure is a count of events that upset plant stability and challenge safety functions. The indicator includes all scrams while the reactor is critical that are not directed by a normal operating or test procedure. It also includes scrams that occur during the execution of procedures in which there is a high probability of a scram but the scram was not planned. Examples of the types of scrams included are those that result from unplanned transients, equipment failures, spurious signals, human error, or those directed by abnormal, emergency, or annunciator response procedures. This is the same as the WANO indicator that is used by all U.S. plants, except that it also counts manual scrams because, from a risk perspective, they are just as important as automatic scrams.

This definition has been carried forward throughout the history of the ROP, and the current version of IMC 0308, Technical Basis for Performance Indicators, and NEI 99-02, Revision 7, Regulatory Assessment Performance Indicator Guideline, both define the IE01 PI as This indicator monitors the number of unplanned scrams. It measures the rate of scrams per year of operation at power and provides an indication of initiating event frequency. The initial description and current definition of the PI do not include any concern about the cause of initiating events (scrams) and whether multiple scrams have a common or similar cause. The IE01 PI is concerned about the risk posed by scrams, as more fully discussed in Appendix H of SECY-99-007, not the cause of scrams, and thus is simply a count of the number of unplanned scrams, manual or automatic, that have occurred regardless of cause.

The IE01 PI is baselined to an occurrence rate per 7,000 critical hours and includes a built-in lower limit of 2,400 critical hours, under which the indicator output is N/A to preclude misleadingly high values at low critical hours. The Green/White threshold is 3 scrams per 7,000 critical hours, the White/Yellow threshold is 6 scrams per 7,000 critical hours, and the Yellow/Red threshold is 25 scrams per 7,000 critical hours. Because the indicator is a rate, the PI automatically accounts for more or less than 7,000 actual critical hours. For calendar year 2020 Grand Gulf reported 5,502.6 critical hours. During this timeframe, and more specifically in the final three quarters of the year, Grand Gulf experienced five reactor scrams. The combination of 5 scrams and 5,502.6 critical hours would result in an IE01 indicator greater than 6 scrams per 7,000 critical hours. The five reactor scrams in this time period were:

Page 6 of 9

The staff evaluated whether the situation presented by Grand Gulf is unique and warrants an exception from the PI guidance, as requested by the licensee. Because the number of critical hours accumulated by the licensee (5,502.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />) is more than double that required for the IE01 PI to be considered valid and free from misleadingly high values (2,400 hours0.00463 days <br />0.111 hours <br />6.613757e-4 weeks <br />1.522e-4 months <br />), the staff views the number of critical hours accumulated by Grand Gulf to be sufficient for the PI to be considered valid. Thus, the staff focused on whether the two scrams that are the subject of this FAQ (May 25 and August 8) should be counted as one scram. The licensee referenced FAQs 16-03 and 17-01 in their rationale for why the two scrams should count as one.

FAQ 16-03, Tornado Missile Protection (TMP) Potential Safety System Functional Failure, was described by the licensee as follows:

In this FAQ, the NRC evaluated if multiple tornado protection design issues identified over a period of time should be counted as a single issue/event for PI purposes or as multiple issues/events. These issues were the result of engineering work that did not comprehensively incorporate the tornado missile protection concepts into the structural design. The NRC determined that only the first identified issue needed to be counted and that additional failures identified as a result of the same evaluation need not be reported separately.

This FAQ was submitted to interpret the following statement in the discussion of the MS05, Safety System Functional Failures, PI: A single event or condition that affects several systems: counts as only one failure on page 32, line 9, of NEI 99-02, Revision 7. The issue involved industry-wide structural design reviews and walkdowns to identify gaps in the original design and plant construction related to tornado-missile protection. That FAQ noted that the single event could be considered the potential occurrence of a tornado and/or the single condition could be considered the engineering work performed many years ago that did not comprehensively incorporate the tornado missile protection concepts into the structural design.

Further, the issues being identified at the time were (1) not indicative of current plant performance since that dated to initial design and construction, (2) were part of a comprehensive industry-wide reevaluation of the original facility tornado missile protection design, and (3) were of very low safety significance. The FAQ concluded, in part, that:

The first SSFF identified should be counted under the SSFF performance indicator.

Additional items identified as part of the RIS 2015-06 evaluation would not need to be counted separately, as they would be treated as additional failures under NEI 99-02 because they were part of the single event or condition that affects several systems.

Page 7 of 9

The staff determined that the conclusion of FAQ 16-03 would not apply to the Grand Gulf situation discussed in this FAQ. Even if one were to view the 2020 turbine controls project at Grand Gulf as a single condition, there remain many differences between the tornado-missile issue and the Grand Gulf turbine controls project. The turbine controls modification was installed in spring 2020, well within a timeframe that would be indicative of current licensee performance. The turbine control modification was done to address site-specific equipment issues in recent years, not as part of a generic industry-wide effort looking at original design and construction. Finally, Grand Gulf is asserting that two different initiating events (scrams) with two different causes be counted as one event using the logic provided by FAQ 16-03. That FAQ discussed multiple mitigating systems rendered inoperable by a single initiating event (a tornado), which is a different situation than grouping together multiple different initiating events that occurred at different times.

FAQ 17-01, Grand Gulf June 2016 Power Change, was described by the licensee as follows:

In this FAQ, the NRC evaluated an event at GGNS, where following a failure of the former Turbine Control System, the unit experienced multiple power changes which were greater than 20% rated thermal power. In this FAQ the NRC determined that multiple power changes of greater than 20% rated thermal power would only be counted once based on the event rather than 3 separate events which each resulted in multiple power changes.

In the instance discussed in FAQ 17-01, a single event that occurred during turbine control valve testing resulted in oscillating turbine control valves, which ultimately led to a reactor scram due to power oscillations. The time from initial control valve oscillation to reactor scram lasted 42 minutes and consisted of multiple power oscillations of greater than 20% in that timeframe.

The FAQ addressed whether the event should count as an unplanned scram or unplanned power change and whether each unplanned power change/oscillation greater than 20% in that 42-minute span would count as a separate unplanned power change. Similar to FAQ 16-03, this FAQ involved just one initiating event and the ensuing time period in which operators were attempting to stabilize the plant and respond to the event.

In its evaluation of FAQ 17-01 the staff stated that The key factor in determining the number of transients that would count towards the PI is the number of separate issues, faults or discrete events that occurred. The staff decided to apply this concept to the Grand Gulf event rather than attempt to count each individual power change. In that review, the staff ultimately found three discrete events that would count as unplanned power changes: the equipment issue that led to the initial power oscillations, the decision by operators to not insert a manual scram, and another instance where operators elected to use the surveillance procedure rather than insert a manual scram.

In its current review, the staff determined that FAQ 17-01, which dealt with an initiating event and a continuous 42-minute period responding to the initiating event, would not apply to two discrete scrams several months apart. Were the logic applied by the staff in FAQ 17-01 applied to this FAQ, the two scrams would likely be considered discrete events and would both count separately since each of the scrams was a completely independent initiating event.

The licensee asserts in this FAQ that only the May 25 scram and not the August 8 scram should count since both involved the same vendor not validating assumptions as part of the turbine Page 8 of 9

controls upgrade project. The staff noted that the licensee performed a root cause evaluation with an extent of condition and extent of cause evaluation following the May 25 scram. The licensee was questioned by the staff at a December 29, 2020, public meeting about whether the extent of condition or extent of cause of the May 25 scram should have identified the vendor assumption issue that the licensee stated contributed to the August 8 scram, given that both involved unvalidated vendor assumptions. The licensee responded that the causes were significantly different such that the extent of condition or extent of cause would not have found the August 8 issue. The staff does not find that the causes of the two scrams could be so similar that they should count as one scram, yet be different enough that the second scram would not be within the scope of an extent of condition or extent of cause review. Further, the staff notes that the purpose of the IE01 PI is to count unplanned scrams to measure the rate of occurrence of initiating events, of which the cause of the scrams does not factor in.

The staff has determined that the May 25 and August 8 scrams count as two discrete scrams in the IE01 PI.

Page 9 of 9

Retrieved from "https://kanterella.com/w/index.php?title=ML21021A283&oldid=3182352"