ML17229A272

LER 97-002-00:on 970221,operation in Excess of Max Rated Thermal Power Occurred Due to Digital Data Processing Sys (Ddps) Calorimetric Error.Verified Acceptable Performance of Ddps Functions & Reviewed Software mods.W/970321 Ltr

ML17229A272
Person / Time
Site:	Saint Lucie
Issue date:	03/21/1997
From:	DIETZ R L, STALL J A FLORIDA POWER & LIGHT CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
L-97-081, L-97-81, LER-97-002, LER-97-2, NUDOCS 9703270101
Download: ML17229A272 (10)

Text

CATEGORYREGULAT55fINFORMATIONDISTRIBUTIOYSTEM(RIDS)ACCESSIONNBR:9703270101DOC."DATE:97/03/21NOTARIZED:NOFACILSO-'33'5St.LuciePlant,Unit1,FloridaPower6Light.Co.AUTH.NAMEAUTHORAFFILIATIONDIETZ,R.L.FloridaPoweraLightCo.STALL,J.A.FloridaPower&LightCo.RECIP.NAMERECIPIENTAFFILIATION"DOCKET05000335

SUBJECT:

LER97-002-00:on970221,operationinexcessofmaxRatedThermalPoweroccurredyfailuretoimplementeffectiveconfigurationforDigitalDataProcessingSyscomputerDZSTRZBUTZONCODE:ZE22TCOPZESRECEZUED:LTR)ENCLtSZZE:TITLE:50.73/50.9LicenseeEventReport(LER),IncidentRpt,etc.NOTES:RECIPIENTIDCODE/NAMEPD2-3PDINTERNAL:ACRSAEOD/SPD/RRABNRR/DE/ECGBNRR/DE/EMEBNRR/DRCH/HICBNRR/DRCH/HQMBNRR/DSSA/SPLBRES/DET/EIBEXTERNAL:LSTLOBBYWARDNOACPOOREPW.NRCPDRCOPIES,LTTRENCL11111111111111111~-1111111RECIPIENTIDCODE/NAMEWIENSPL.BILCENTERNNRR/DRCH/HHFBNRR/DRCH/HOLBNRR/DRPM/PECBNRR/DSSA/SRXBRGN2FILE01LITCOBRYCE,JH.NOACQUEENERPDSNUDOCSFULLTXTCOPIESLTTRENCL112211111111111111111111NNOTETOALL"RIDS"RECIPIENTS:PLEASEHELPUSTOREDUCEWASTE.TOHAVEYOURNAMEORORGANIZATIONREMOVEDFROMDISTRIBUTIONLISTSORREDUCETHENUMBEROFCOPIESRECEIVEDBYYOUORYOURORGANIZATION,CONTACTTHEDOCUMENTCONTROLDESK(DCD)ONEXTENSION415-2083FULLTEXTCONVERSIONREQUIREDTOTALNUMBEROFCOPIESREQUIRED:LTTR25ENCL25 aFloridaPower&LightCompany,6501SouthOceanDrive,JensenBeach,FL34957APLMAR2)1997L-97-08110CFR50.73U.S.NuclearRegulatoryCommissionAttn:DocumentControlDeskWashington,D.C.20555Re:St.LucieUnit1Docket50-335ReportableEvent:97-002DateofEvent:February21,1997OperationinExcessofMaximumRatedThermalPowerTheattachedLicenseeEventReportisavoluntaryreportsubmittedtoprovidenotificationofthesubjectevent.Verytrulyyours,'IJ.A.StallVicePresidentSt.LuciePlantJAS/RLDAttachmentcc:RegionalAdministrator,USNRCRegionIISeniorResidentInspector,USNRC,St.I.uciePlant'703270iOi97032XPDRADGCK050003358PDRlllgttlllElllPiHillttltlanFPLGroupcompany NRCFORM366(4-as)U.S.NUCLEARREGULATORYCOMMISSIONLICENSEEEVENTREPORT(LER)(Seereverseforrequirednumberofdigits/charactersforeachblock)APPROVEDSYOMSNO.S)50%105EXPIRES05QOISSESTIMATEDBURDENPERRESPONSETOCOMPLYWITHTHISMAHDATINFORMATIONCOILECTIOHREQUEST:50.0HRS.REPORTEDLESSONLEARNEDAREINCORPORATEDINTOTHEUCENSINOPROCESSANDSACKTOSE)USIRY.FORWAIE)COMMBITSREOARDIHOBURDENESTIMATOTHEINFORMATIONANDRECORDSMANAOEMEHTBRANCHIT%F33)UWNUCLEARREOIAATORYCOMMISSION,WASHINOTON,DC20555400)ANDTOTHEPAPERWORKREDUCTIONPROJECT131500)04),OFHCE0MANAOEMENTANDBUDGET,WASHIHOTON,DC20503.PAcIUTYNAMEl1)TITlEIa)ST.LUCIEUNIT1DocKETNLssBERl2)05000335PAOEIS)1OF5OperationinExcessofMaximumRatedThermalPowerDuetoDigitalDataProcessorCalorimetricErrorMONTHDAYSEQUENTIALREV)SIONNUMBERNUMBERMONTHDAYYEARFACIUTYNAMENIADOCKETNUMBER0221OPERATINGMODE(9)LEVEL(10)9797-002-0020.2201(b)20.2203(a)(2)(I)20.2203(a)(2)(ill)20.2203(e)(2)(iv)03219720.2203(e)(2)(v)20.2203(a)(3)(ii)50.3B(o)(1)60.3B(c)(2)FACIUTYNAMENIA50.73(e)(2)(I)50.73(a)(2)(ill)50.73(e)(2)(v)50.73(a)(2)(vli)DOCKETNUMBER50.73(e)(2)(vlii)73.71OTHERSpecifyInAbstractbeloworInNRCForm3SSANAMER,L.DIETZ,LicensingEngineerTELEPHONENUMBEROnckdeArseCode)(561)467-7157cAusESYSTEMCOMPONENTMANUFACTURERToNPRDSCAUSESYSTEMCOMPONENTMANUFACTURERToNPRDSYES(Ifyes,completeEXPECTEDSUBMISSIONDATE):XNoMONTHDAYYEARSUBMISSIONDATE(16)ABSTRACT(L(mitto1400spaces,I.e.,approximately15single-spacedtypewrittenlines)(16)ThisLERisavoluntaryreport.OnFebruary21,1997,St.LucieUnit1wasoperatingatasteady-statepowerlevelof100%RatedThermalPower(RTP)asdeterminedfromtheDigitalDataProcessingSystem(DDPS)display.Whileperformingafeedwaterflowinstrumentloopcalibration,maintenancepersonneldeterminedthatproperscalingconstantswerenotbeingusedforthefeedwaterflowinputsignalstotheDDPS.ThisconditioncausedtheDDPScalorimetriccalculationofreactorcorethermalpowertobenon-conservativeinthatfacilitysteady-stateoperationwiththeDDPSindicating100%RTPresultedinactualreactorpowerat100A3%RTP.Plantoperationwaslimitedtonotmorethan99%RTP(indicated)whiletheproblemwasthoroughlyinvestigatedandcorrected.OnMarch1,1997,St.LucieUnit1wasreturnedto100%RTP.ThecauseofthiseventwasfailuretoimplementeffectiveconfigurationcontrolsfortheDDPScomputersoftware.Correctiveactionsinclude:1)AcceptableperformanceofallcriticalDDPSfunctionswasverifiedpriortorestorationoffullpoweroperations.2)Reviewofaccountabilitiesforsoftwaremodificationsandidentificationofprogramimprovements.3)DevelopmentofverificationandvalidationrequirementsthatchallengeallcriticalattributesforsoftwarechangeswithintheDDPS.4)DevelopmentofcontrolledoperatingprocedurestoaddressDDPSoperation.5)UseoftheSt.LucieTotalEquipmentDataBaseorcontrolledprocedurestoensureconfigurationcontrolofcriticalDDPSconstants.6)ModificationofthesoftwarevendorblanketpurchaseordertoclarifythatcompliancewithFPLadministrativeproceduresisrequired.NRCFORM3SS(4.SS)

NRCFORM388AI4.9SILICENSEEEVENTREPORT(LER)TEXTCONTINUATIONU.S.NUCLEARREGULATORYCOMMISSIOST.LUCIEUNIT105000335YEARSEQUENTIALREVISION97-002-002OF5TEXTiifmorespaceisrequired,useadditionalcopiesofNRCArm3684Il17IOnFebruary21,1997,St.LucieUnit1wasoperatingatasteady-statepowerlevelof100%RatedThermalPower(RTP)asdeterminedfromtheDigitalDataProcessingSystem(DDPS)[EIIS:IO]display.UtilityInstrumentationandControl(ILC)personnelwereperformingafeedwaterflowinstrumentloopcalibrationfollowingmaintenanceonafeedwaterflowtransmitter[EIIS:SJ:PDT].Duringthiscalibration,itwasdiscoveredthatscalingconstantsforallsixofthefeedwaterflowinputsignalstotheDDPScomputer[EIIS:IO:CPU]wereincorrect,i.e.,theinputsignalrangeof4-20milliamperescorrespondedtoaflowventuri[EIIS:SJ:FE]differentialpressurespanofapproximately0-790inchesofwaterratherthanthecorrectspanof0-800inchesofwater.SincetheDDPSusesthefeedwaterflowparameterincalorimetriccalculationsofreactor[EIIS:RCT]corethermalpower,thisdiscrepancywasnon-conservativeinthatscalingconstantscorrespondingtolessthanthefullrangeofflowventuridifferentialpressuresresultinacalculatedvalueofpowerthatislessthantheactualreactoroutput.ControlroomoperatorswerenotifiedbyILCpersonnelthatthereactorwasoperatingatacorethermalpowerlevelapproximately0.6%RTPgreaterthanthevaluedisplayedontheDDPS,andactionwaspromptlyinitiatedtoreducepower.At17:55ESTonFebruary21,1997,St.LucieUnit1wasstabilizedataconservativevalueof99%RTP(indicated).Theunitwasreturnedto100%RTPat05:45ESTonMarch1,1997.InJune,1994,feedwaterflowscalingconstantswererevisedinaccordancewithapprovedplantprocedures.ThesescalingconstantswereproperlyinstalledintotheoperatingDDPSsoftware,butwerenotupdatedinthecontrolroomDDPSdatareferencemanual.In1996,thesoftwarewasmodifiedbythevendorusingthevendor'sversionofthesourcecodetoaccommodateinstallationofanewcoreperformancemonitorthatinterfaceswiththeDDPS.WhenthismodificationwasloadedintotheDDPScomputerduringthe1996refuelingoutage,theproperscalingconstantswereoverwrittenandreplacedwiththepre-1994valuesbasedonthecontrolroomDDPSdatareferencemanual.ThisconditionwasnotdiscovereduntiltheinstrumentloopcalibrationwasperformedonFebruary21,1997.ThecauseofthiseventwasfailuretoimplementeffectiveconfigurationcontrolsfortheDDPScomputersoftware.lnJune1994,achangetothespan/staticshiftadjustmentforeachofthesixDDPSfeedwaterflowtransmitterswasimplementedinaccordancewithanapprovedplantworkorder.Tobecompatiblewiththespanadjustments,theexistingfeedwaterflowscalingconstantscorrespondingtoaspanof0-790.6inchesofwater'differentialpressurewererevisedtocorrespondtoaspanof0-800inchesofwaterdifferentialpressure.ThenewscalingconstantswereloadedintothecorrectDDPSoperatingsoftwarelocations,butwerenotrecordedinthecontrolroomDDPSdatareferencemanualwhichismaintainedattheDDPSconsole.NRCFORMmAIi-95I

NRCFORM386AI4.96)LICENSEEEVENTREPORT(LER)TEXTCONTINUATIONU.S.NUCLEARREOULATORYCOMMISSIOST.LUCIEUNIT105000335YEARSEQUENTIALREVISION97-002-003OF5TEXT/ifmorespecsisreriuired,useedditionelcopiesofNRC.cform36EAII17)TheDDPSsoftwareisconsideredqualityrelated.Atthetimethe1994revisionwasmadetothefeedwaterflowscalingconstants,Ql2-PR/PSL-3,Revision0,ControlofComputerSoftware,providedgenericadministrativecontrolsforcomputersoftwareinwhichtheoutputisusedforsafetyrelatedandqualityrelatedpurposes.Significantrevisionstostrengthenthisprocedurehavebeenmadesince1994.DuringtherefuelingoutageofApril-July,1996,anon-linecore'performancemonitoringsystemwhichinterfaceswiththeDDPSwasinstalledinaccordancewithanapprovedPlantChange/Modification(PC/M).TheDDPSsoftwarechangesneededtoaccommodatethisnewinstallationweredevelopedbythevendorusingthevendor'sversionofthesourcecode(whichdidnotcontainthe1994revisedscalingconstants).UponloadingthemodifiedsoftwareintotheDDPScomputer,thecorrectfeedwaterflowconstantswereoverwrittenwiththosecorrespondingtoarangeof0-790.6inchesofwaterdifferentialpressure.AdministrativeProcedure(AP)4000060,MaintenanceDepartmentalControlofComputerSoftware,wasimplementedFebruary26,1996,toprovidethemethodologybywhichthemaintenancedepartmentandsupportgroupscontroltheprocurement,development,andrevisionofsoftwaretocomplywithQl2-PR/PSL-3.Thevalidationandverification(V&V)methodthatwasusedtoconfirmtheDDPSpropersoftwareconfigurationfollowingmodificationstoaccommodatethe1996PC/Mwasselectedfromthisprocedure,butdidnotV&Votherfunctionsofthesoftware,suchasthecalorimetriccalculation,thatwerenotrelatedtothemodification.Duringpostmodificationtesting(PMT)forthe1996PC/M,thecontrolroomcopyoftheDDPSdatareferencemanualwasusedtoperformaverificationofeachDDPSinputconstant.However,thismanualisnotacontrolleddocumentandhadnotbeenupdatedtoreflectthe1994revisiontothefeedwaterflowscalingconstants.Thispreventeddiscoveryoftheproblematthattime,i.e.,thevaluesusedtoverifythefeedwaterflowscalingconstantswerethesamepre-1994valuesasthoseresidinginthesoftwarethathadbeenloadedintotheDDPScomputerfromthevendorsourcecode,Thefeedwaterflowscalingconstanterrorwasdeterminedtobe.non-conservativeby0.6348RTP.Twoadditionaldiscrepancies,unrelatedtothe1996modification,werealsodiscoveredinthecalorimetriccalibrationandweredeterminedtoresultinacombinedconservativeerrorof0.2%RTP.Therefore,thenetcalorimetricerrorwas0.43%non-conservative.Anoperabilityassessmentwasperformedwhichdeterminedthatthefeedwaterflowscalingdiscrepancycombinedwiththecalorimetricmeasurementunertaintywaslessthantherequiredoverallcalorimetricaccuracyrequirementof2%atmaximumratedthermalpower.Inaddition,reactorprotection,corephysics,andreactorfuelparametersimpactedbythecalorimetricerrorwereevaluatedtoensurethatassumptionsmadeintheplantsafetyanalysisprovidedsufficientmargintoboundthisevent.Thisevaluationconcludedthattheexistingplantsafetyanalysisremainsvalid.Therefore,thehealthandsafetyofthepublicwerenotadi>>elyaffectedbythisevent.NRCFoRM388A(4-96I NRCFORM3SBAI4-96)LICENSEEEVENTREPORT(LER)TEXTCONTINUATIONU.S.NUCLEARREGULATORYCOMMISSIST.LUCIEUNIT105000335YEARSEQUENTIALREVISION97-002-004OF5TEXT(ifmorespeceisrequired,useedditionelcopiesofIVRCForm368AiI17)Facilityoperationwaslimitedtoaconservativevalueof99%RTPuntiltheproblemwasthoroughlyinvestigatedandcorrected.Primarysystemmanualcalorimetriccalculationswereperformedtoverifyreactorpowerremainedbelow100%RTP.2)Thecorrectfeedwaterflowscalingconstantswereenteredintoboththeon-lineandtheback-upDDPScomputers,andothercalorimetricconstantswereverifiedtobecorrectusinginformationfrotheplantTotalEquipmentDataBase(TEDB).TheincreaseincalculatedcalorimetricpowershownontheDDPSdisplaywasverifiedtobeaspredicted.Aprimarysystemmanualcalorimetriccalculationwasperformedandresultswerewithin0.2%ofDDPSindicatedpower.3)Thecorrectfeedwaterflowscalingconstantsweredocumented,andmaster/backupcopiesoftheupgradedsystemwerefiledinaccordancewithanapprovedSt..LuciePlantSoftwareConfiguration/ChangeControl,ComputerSoftwareChangeRequest(AdministrativeProcedure4000060,Revision2).AcceptableperformanceofothercriticalDDPSfunctionswasverifiedtoensurethatotherinadvertentsoftwarechangeshadnotbeenmade,andsurveillanceswereperformedforotherplantsystemswhosecalibrationscanbeinfluencedbyDDPScalculatedcalorimetricpowertoensurethatthesesystemcalibrationshadnotbeencompromised.5)I&CperformedathreepointcalibrationofallDDPScalorimetricinputstoverifytheproperscalingconstantsandinputcircuitoperation.MinordiscrepancieswereidentifiedinthefeedwaterResistanceTemperatureDetectorandReactorCoolantPumpKWscalingcurvesthatwerenotrelatedtotheeventreportedinthisLER.Engineeringdeterminedthatthesediscrepanciesaccountedforacombinedconservativeerrorof0.2%.FPLwillrevisethesoftwaretocorrecttheseerrorsintheSt.LucieUnit1DDPS.ThescalingcurvesforthesecomponentswerealsoverifiedintheSt.LucieUnit2DDPStoensurethatsimilardiscrepanciesdidnotexist.6)Toensureadequatepostmodificationtestingisperformed,FPLwillreviewsoftwaremodificationaccountabilitiesandidentifyprogramimprovementstobemade.7)FPLwilldevelopgenericV&VrequirementstochallengeallcriticalattributeswithinbothSt.LucieUnit1andUnit2DDPSforallsoftwarechanges.8)ControlledoperatingprocedureswillbedevelopedtoaddressbothSt.LucieUnit1andUnit2DDPSoperationandidentifyspecificpointidentificationandlocations.9)FPLwillensureconfigurationcontrolforallcriticalSt.LucieUnit1andUnit2DDPSconstantsbyenteringthemintotheTEDBorensuringtheyaredocumentedinacontrolledprocedure.10)FPL'sblanketpurchaseorderwiththesoftwarerendorhasbeenmodifiedtoclarifythatdevelopmentofnewsoftwareandupgrading/changingexistingsoftwareshallbeperFPL'sAdministrativeProcedureAP-4000060.NACFORM388AI4-96I NRCFORIN388AI4-95),LICENSEEEVENTREPORT(LER)TEXTCONTINUATIONU.S.NUcLEARREGULATORYcolNMISSIOST.LUCIEUNIT1YEARSEQUENTIALREVISION0500033597-002-005OF5TEXT(Ifmorespaceisrequired,useadditionalcopiesofNRCForm366AIl17INoneLER335/86-005,St.LucieUnit1,TechnicalSpecificationDeviationDuetoPersonnelError,07/21/86.LER389/92-008,St.LucieUnit2,DigitalDataProcessSystemCalorimetricErrorduetoInstrumentCalibrationError,Revision1,03/31/93.NACFoAM388AI4-96)

I