IR 05000413/2012009

IR 05000413-12-009, 05000414-12-009; 4/10/2012 - 6/18/2012; Catawba Nuclear Station, Units 1 and 2; Special Inspection

ML12207A614
Person / Time
Site:	Catawba
Issue date:	07/25/2012
From:	Croteau R Division Reactor Projects II
To:	Henderson K Duke Energy Carolinas
References
EA-12-153, FOIA/PA-2013-0250 IR-12-009
Download: ML12207A614 (24)

Text

UNITED STATES uly 25, 2012

SUBJECT:

CATAWBA NUCLEAR STATION - NRC SPECIAL INSPECTION REPORT 05000413/2012009 AND 05000414/2012009 AND UNIT 1 PRELIMINARY YELLOW FINDING AND UNIT 2 PRELIMINARY GREATER THAN GREEN FINDING

Dear Mr. Henderson:

On June 18, 2012, the U.S. Nuclear Regulatory Commission (NRC) completed a reactive inspection pursuant to Inspection Procedure 93812, Special Inspection, at your Catawba Nuclear Station Units 1 and 2. The enclosed inspection report documents the inspection results which were preliminarily discussed with Mr. J. R. Morris and members of your staff on April 13, 2012. A final exit was held with Mr. George Hamrick by teleconference on June 18, 2012.

The special inspection commenced on April 10, 2012, in accordance with Management Directive 8.3, NRC Incident Investigation Program, and Inspection Manual Chapter (IMC) 0309, Reactive Inspection Decision Basis for Reactors, based on the initial risk and deterministic criteria evaluation made by the NRC on April 7, 2012. The special inspection reviewed the circumstances surrounding a dual unit loss of offsite power that occurred on April 4, 2012, and examined activities conducted under your license as they relate to safety, compliance with the Commissions rules and regulations, and with the conditions of your license.

The enclosed inspection report discusses a Unit 1 finding that has preliminarily determined to be Yellow, a finding with substantial safety significance, that will result in additional NRC inspections and potentially other NRC action and a Unit 2 finding that has preliminarily determined to be Greater than Green, a finding with greater than very low safety significance, Enclosures transmitted herewith contains SUNSI. When separated from Enclosures 3 and 4 this transmittal document is decontrolled. that may result in the need for further evaluation to determine significance and therefore the need for additional NRC action. As described in the enclosed report, a modification was installed on Unit 1 to replace the generator protective relaying with programmable modules. A programming error, due to incomplete design information, resulted in offsite power circuits being lost whenever the main generator tripped from high power. Therefore, these offsite power circuits did not meet Technical Specification 3.8.1 requirements for operability for greater than the Allowed Outage Time. This condition also existed for Unit 2 because offsite power was being provided to Unit 2 from Unit 1. There is no immediate safety concern because the condition has been corrected. These findings were assessed based on best available information using the applicable Significance Determination Process (SDP). The basis for the NRCs preliminary significance determination, including where the staff lacks information to reach a final determination, is described in the enclosed report. These findings also resulted in apparent violations of NRC requirements and are being considered for escalated enforcement action in accordance with the Enforcement Policy which can be found on the NRCs website at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html.

In accordance with IMC 0609, Significance Determination Process, we intend to complete our evaluation, using the best available information, and issue our final determination of safety significance within 90 days of the date of this letter. The significance determination process encourages an open dialogue between the NRC staff and the licensee; however, the dialogue should not impact the timeliness of the staffs final determination. Please address the specific differences between your risk analysis and NRCs risk analysis as identified in the enclosed Phase 3 analyses (Enclosures 2 and 3) in any response you submit regarding these findings.

Before we make a final decision on this matter, we are providing you with an opportunity to:

(1) attend a Regulatory Conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2)

submit your position on these findings to the NRC in writing. If you request a Regulatory Conference, it should be held within 30 days of the receipt of this letter and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. If a Regulatory Conference is held, it will be open for public observation. A public meeting notice and press release will also be issued to announce the conference. If you decide to submit only a written response, such submittal should be sent to the NRC within 30 days of your receipt of this letter. If you decline to request a Regulatory Conference or submit a written response, you relinquish your right to appeal the final SDP determination; in that, by not doing either you fail to meet the appeal requirements stated in the Prerequisite and Limitation Sections of Attachment 2 of IMC 0609. Please contact Jonathan Bartley at (404) 997-4607, and in writing, within 10 days from the issue date of this letter, to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision. The final resolution of this matter will be conveyed in a separate correspondence.

Since the NRC has not made a final determination in this matter, no Notice of Violation is being issued for these apparent violations at this time. In addition, please be advised that the number and characterization of these apparent violations may change as a result of further NRC review. Additionally, one self-revealing finding of very low safety significance (Green) was identified during this inspection.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region II, and the NRC Resident Inspector at Catawba In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/Eugene Guthrie RA for/

Richard P. Croteau, Director Division of Reactor Projects Docket Nos.: 50-413, 50-414 License Nos.: NPF-35, NPF-52

Enclosure:

1. Inspection Report 05000413/2012009 and 05000414/2012009 w/Attachments: 1. Supplemental Information 2. Event Timeline 2. Phase 3 Analysis - Unit 1 w/Attachment 3. Phase 3 Analysis - Unit 2 w/Attachment

REGION II==

Docket Nos.: 50-413, 50-414 License Nos.: NPF-35, NPF-52 Report Nos.: 05000413/2012009, 05000414/2012009 Licensee: Duke Energy Carolinas, LLC Facility: Catawba Nuclear Station, Units 1 and 2 Location: York, SC 29745 Dates: April 10, 2012, through June 18, 2012 Inspectors: C. Rapp, Senior Project Engineer J. Montgomery, Reactor Inspector P. Braxton, Reactor Inspector Approved by: Richard P. Croteau, Director Division of Reactor Projects Enclosure 1

SUMMARY OF FINDINGS

IR 05000413/2012-009, 05000414/2012-009; 4/10/2012 - 6/18/2012; Catawba Nuclear Station,

Units 1 and 2; Special Inspection The report covered a special inspection by a senior project engineer and two reactor inspectors.

One preliminary Yellow finding and one preliminary Greater than Green finding, both of which were determined to be violations of NRC regulations, were identified. Also, one Green finding was identified. The significance of findings is indicated by their color (Green, White, Yellow,

Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP). Cross-cutting aspects are determined using IMC 0310, Components Within The Cross-Cutting Areas. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process.

Cornerstone: Mitigating Systems

• TBD: Self-revealing findings were identified for the licensees failure to follow EDM-141,

Procurement Specifications for Services. The licensee did not identify the need for the blocking feature for the instantaneous underfrequency protective function in both the vendor specification and the supporting information provided to the vendor. The offsite power supply to Unit 1 would have been lost anytime there was a generator trip from high power without this blocking feature. This finding resulted in an apparent violation (AV) of Technical Specification (TS) 3.8.1, AC Sources - Operating, for Unit 1 and TS 3.8.1, AC Sources -

Operating, and TS 3.8.2, AC Sources - Shutdown, for Unit 2 because the installed modification resulted in inoperability of the offsite power source for both units. Unit 2 was impacted whenever offsite power was provided from Unit 1. The finding does not represent an immediate safety concern because the licensee corrected the blocking function prior to unit restart. The violation was placed in the licensees corrective action program as PIP C-12-3403.

The performance deficiency (PD) was more than minor because it affected the availability and reliability of the Equipment Performance attribute and adversely affected the Mitigating Systems cornerstone objective in that an offsite power supply would not have been available to mitigate expected operational transients and design basis events. For Unit 1, the significance was preliminarily determined to be within the range for a finding of substantial safety significance (Yellow). For Unit 2, the significance was preliminarily determined to be within the range for a finding of greater than very low safety significance (Greater than Green). The safety significance will be designated as To Be Determined (TBD) because the safety characterization is not final. The PD was directly related to the aspect of accurate design documentation in the component of Resources in the cross-cutting area of Human Performance in that the engineering design procedures were not complete because there was no requirement for verification of non safety-related design changes. H.2(c) (Section 2.2.3)1 3

• Green: A self-revealing finding was identified for the licensees failure to follow EDM-141,

Procurement Specifications for Services. The licensee did not identify the blocking feature for the instantaneous underfrequency protective function in both the vendor specification and the supporting information provided to the vendor. The offsite power supply to Unit 2 would have been lost anytime there was a generator trip from high power and offsite power was provided from Unit 2 without this blocking feature. The licensee corrected the blocking function prior to unit restart.

The performance deficiency was more than minor because, if left uncorrected, it would result in a more significant safety concern in that Unit 2 would have had a LOSP anytime the generator tripped from a high power condition. The inspectors determined the finding was of very low safety significance because the programming error was corrected prior to unit restart; therefore, there was no loss of safety function. The same cross-cutting aspect for the Unit 1 finding also applies to this finding; therefore, no separate cross-cutting aspect will be assigned to this finding. (Section 2.2.3)1

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity 1.0 Special Inspection Scope 1.1 Event Description On April 4, 2012, Catawba Nuclear Station Unit 1 was operating at 100 percent rated thermal power (RTP). Unit 2 was in cold shutdown with fuel in the reactor and residual heat removal (ND) in operation to remove decay heat. Power to Unit 2 vital busses was being supplied through Unit 1. At approximately 8:03 p.m., a ground fault occurred on the Unit 1 D reactor coolant pump (NCP). The pump breaker opened causing a reactor trip on low reactor coolant (NC) system loop flow. The reactor trip also caused a turbine trip and opening of the generator output breakers. However, breakers in the switchyard also opened causing a loss of all offsite power (LOSP) to Unit 1. This also resulted in Unit 2 losing power to all vital busses. The 1B emergency diesel generator (EDG)automatically started due to loss of power to the 1ETB essential bus. The 1A, 2A, and 2B EDGs automatically started 15 seconds later due to loss of power to their respective essential busses. The licensee started the 2A ND pump to restore decay heat removal on Unit 2. At 8:12 p.m., a Notice of Unusual Event (NOUE) was declared due to loss of offsite power to all essential busses. At about 11:00 p.m., the Standby Shutdown Facility (SSF) diesel generator (DG) was started to supply power to the security system batteries. However, the SSF DG was declared inoperable due to low output voltage. On April 5, 2012, at 1:37 a.m., power was restored to one essential bus on both Unit 1 and Unit 2 and the NOUE was terminated.

1.2 Inspection Scope A charter was issued to direct the scope of this special inspection. The inspectors reviewed calculations, design documents, licensing documents, work orders, modification packages, and corrective action documents as appropriate for each of the following charter items. The inspectors interviewed licensee personnel regarding the event. The inspector assessed the licensees implementation of their corrective action program, design control process, and procedure implementation. The inspectors conducted these activities in accordance with NRC Inspection Procedure 93812, Special Inspection Procedure. Documents reviewed not identified in the following charter items are listed in Attachment 1. Enclosure 1 5 2.0 Charter Items 2.1 Develop timelines associated with the installation of the digital relay modification (Zone G) and the event, including the design and implementation of the relay modification and the response of Catawba Units 1 and 2 to the loss of offsite power.

a. Discussion An event timeline is included as Attachment 2.

b. Findings

No findings were identified.

2.2 Assess the apparent causes and licensee follow-up actions for:

.1 1D NCP trip

a. Discussion: There are two three-conductor cables to the NCP motor rated at 8 kV and two connectors per phase for a total of six connectors which terminate in the NCP motorbox. The apparent cause of the ground fault was age-related degradation of the insulation layer of a Y phase motorbox connector. The licensees failure analysis contained thermographic data which showed that the temperature on one of the Y phase connectors was elevated compared to the other connectors. Furthermore, the failure analysis identified a pinhole failure opening closest to the connector. Additionally, examinations of the conducting cable revealed a darkening of the cable bundle and the absence of plating which is indicative of excessive heat that was transferred through the cable. Insulation resistance measurements performed on the cables from all three phases were comparable with the exception of areas near the Y phase failure site of which measured low indicating deterioration from localized heating. The licensee replaced the cables and their respective motor connector assemblies on all three phases of the 1D NCP pump motor during the repair of the failure on the Y phase cable.

Further discussions with the licensee revealed that a previous failure occurred on November 17, 2000, within the motor connector on this same phase at the insulating plug (apparatus bushing). PIP C-00-5883 was written for that event and stated the licensee replaced the failed bushing and insulating tee within the motor connectors.

Additionally, the inspectors were informed that the NCP cables were originally placed into service in 1985.

b. Findings

No findings were identified. Enclosure 1 6

.2 Factors which allowed the NCP failure to propagate to the main switchyard breakers and

opening the PCBs a. Discussion: The loss of the 1D NCP resulted in reduced flow to the NC system initiating a Unit 1 reactor trip. In response to the reactor trip, the Unit 1 turbine tripped and the main generator breakers 1A and 1B opened causing the main generator to go off-line.

The opening of breakers 1A and 1B should have blocked the Zone G underfrequency protection relays; however, the relays actuated when the main generator frequency decayed below the underfrequency setpoint of 57.9 Hz. The underfrequency protective relays opened the switchyard breakers 14, 15, 17, and 18, isolating Unit 1 from offsite power causing a LOSP. The Unit 2 essential buses were aligned to Unit 1 for an outage resulting in a LOSP on Unit 2.

The licensee determined that the Unit 1 Zone G underfrequency block feature was not enabled when the new relays were programmed by the vendor. The licensee had provided a design specification to the vendor which included this block feature, but it was not specified in the functional requirements provided to the vendor. The licensee also provided the McGuire Nuclear Station logic drawings which did not require this block feature due to a different design for generator protection. Consequently, the vendor generated logic drawings and programming sheets that were in error. The licensee used these documents to develop their factory and post-modification testing procedures.

Because this modification was not safety-related, many of the design change processes were not applicable; therefore, there was less rigor and review for this modification.

Multiple barriers failed to identify that the required block was missing.

The licensee follow-up activities included performing an extent of condition review on all the Zone G relays to determine if there were any other programming errors with the relays. This review identified that there were no other missing functions in the relay logic or significant programming changes needed. The licensee also identified several enhancements to provide more security in the Zone G protection as part of the corrective actions. These enhancements include adding a distance element that will provide protection for the main generator from a fault in the lines leaving the switchyard.

b. Findings

See Section 2.2.3.b

.3 The licensees design and implementation of the Zone G relay modification, including the

design, implementation, and testing phases of the modification a. Discussion: The purpose of EC 89962, Zone G Relay Modification, was to replace electromechanical and static main generator relays with multifunction, microprocessor-based relays. These relays were designed to detect faults and other abnormal conditions and isolate any element of the power system that could jeopardize the continued operation or integrity of the remainder of the system. The original design used one train of protective relays mostly arranged in a two-out-of-two scheme for each Enclosure 1 7 protective relaying function. The new design provided two redundant trains of relays connected in a two-out-of-two scheme for each train. One of the functions was an underfrequency relay to protect the generator by opening the switchyard breakers connected to the generator. This function allowed for the unit to be isolated from the grid while the main generator continued to power station loads in cases where the grid experienced a significant disturbance such as a load rejection.

The design requirements included an off-line block for the generator underfrequency relay functions. The off-line condition was based on the position of generator breakers 1A and 1B. The intent of the modification was that the unit was considered offline if these breakers were open and the underfrequency protection was blocked. The licensee determined that the off-line block was omitted by the relay vendor for the instantaneous underfrequency relay function due to a programming error. The inspectors identified that the licensee missed multiple opportunities to discover the programming error during the testing phase of the modification. These opportunities were missed mainly because the licensee did not develop testing procedures from the original design specifications. Instead, the licensee used a calculation that was generated during the vendors design portion of the modification as the basis for the testing procedures. Consequently, the programming error propagated through the rest of the implementation phase and was undetected either during factory or post-modification testing (PMT). Also, the relay replacement was not a safety-related modification; therefore, much of the additional review and rigor in the licensees design control process was not applicable to this modification.

The licensee used relays from two different vendors to avoid common cause failure issues. Due to the two-out-of-two train logic, one relay from each vendor would have to actuate to produce a protective trip. One of the relays internally blocked the underfrequency function based on generator voltage. If generator voltage was below a specific value, these relays would block the underfrequency function for that train. Any controlled shutdown would not result in a LOSP because the underfrequency function would be blocked for that train preventing the two-out-of-two logic from opening the switchyard breakers. Only in the case of a generator trip from high power would a LOSP occur because the underfrequency setpoint was reached before the internal block could initiate.

This modification was also installed on Unit 2 during the refueling outage that was in progress when the Unit 1 LOSP occurred. The licensee used the same vendor to program the Unit 2 relays and the same post-modification testing procedures used on Unit 1; therefore, the programming error also was undetected on Unit 2. If Unit 2 had been restarted and operated at power, a turbine trip would have resulted in a LOSP on Unit 2. However, the LOSP on Unit 1 allowed the licensee to identify and correct the programming error on Unit 2 prior to restart. The inspectors observed the licensees follow-up actions of reprogramming of the relays to include the block and the post-modification testing to verify the blocking function actuated. Enclosure 1 8

.1 Unit 1 Zone G Modifications

Introduction:

Self-revealing findings were identified for the licensees failure to follow EDM-141, Procurement Specifications for Services. The licensee did not identify the blocking feature for the instantaneous underfrequency protective function in both the vendor specification and the supporting information provided to the vendor. The offsite power supply to Unit 1 would have been lost anytime there was a generator trip from high power without this blocking feature. This finding resulted in an apparent violation (AV) of Technical Specification (TS) 3.8.1, AC Sources - Operating, for Unit 1 and TS 3.8.1, AC Sources - Operating, and TS 3.8.2, AC Sources - Shutdown, for Unit 2 because the installed modification resulted in inoperability of the offsite power source for both units. Unit 2 was impacted when offsite power was provided from Unit 1.

Description:

On April 4, 2012, a reactor trip and turbine trip occurred from 100 percent RTP. About 15 seconds after the generator output breakers opened, Zone G protective relays isolated the offsite power supply on instantaneous under-frequency causing a LOSP due to the programming error. TS 3.8.1 required in part two offsite circuits be operable when operating in MODES 1-4. The basis for TS 3.8.1 stated that the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems. The failure to include this block resulted in the offsite power supply to Unit 1 being inoperable. Prior to and during the previous Unit 1 refueling outage, power to the Unit 1 essential buses was aligned to Unit 2. After Unit 1 was returned to 100 percent RTP, the power to Unit 1 A train essential bus was aligned back to Unit 1 on July 23, 2011. The power to Unit 1 B train essential bus was aligned back to Unit 1 on November 5, 2011. Therefore, Unit 1 had one inoperable offsite circuit beginning on July 23, 2011, and two inoperable offsite circuits beginning on November 5, 2011.

In preparation for the Unit 2 refueling outage, power to Unit 2 A train essential bus was aligned to Unit 1 on February 4, 2012, and Unit 2 B train essential bus was aligned to Unit 1 on February 18, 2012. However, due to the modification error on Unit 1, Unit 2 would have also lost power to its essential buses anytime the Unit 1 turbine tripped from high power. Therefore, Unit 2 did not have two operable offsite power sources as required by TS 3.8.1 while operating in MODES 1-4. This power alignment was maintained during the entire Unit 2 outage until the LOSP event on April 4. Therefore, Unit 2 did not have one operable offsite power source as required by TS 3.8.2 while in MODES 5 and 6.

EDM-141, revision 0, section 4.1 required that the scope and functional requirements be clearly and comprehensively described and include necessary design information. The underfrequency blocking function was not specified in the functional requirements provided to the vendor. Further, design information provided by the licensee was in the Enclosure 1 9 form of uncontrolled diagrams and a logic drawing from the McGuire Nuclear Station which did not include this blocking function.

Analysis:

The failure to clearly provide scope and function requirements as required by EDM-141 was a PD. The PD was more than minor because it affected the availability and reliability of the Equipment Performance attribute and adversely affected the Mitigating Systems cornerstone objective in that an offsite power supply would not have been available to mitigate expected operational transients and design basis events. The inspectors used IMC 0609 and assessed the safety significance for each of the following plant conditions:

• For Unit 1, the inspectors used IMC 0609, Attachment 4, and determined there was a loss of safety function which required a Phase 2 analysis. A Phase 2 analysis was performed using IMC 0609, Appendix A, and the site-specific worksheets and determined the safety significance to be White which required a Phase 3 analysis (Enclosure 2). The Phase 3 analysis used a cumulative exposure time of 250 days which was based on the time windows used for the analysis. The SDP model was modified to include credible operator actions to restore offsite power for accident sequences other than LOSP in the dominant sequences. The dominant accident sequence was a reactor transient (TRANS) occurs; offsite electrical power fails; emergency power system succeeds; auxiliary feedwater (CA) fails; primary feed-and-bleed fails; and operators fail to recover offsite power within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Recovery for loss of a single essential bus was credited in the analysis for one of the analyzed time windows. The risk increase was preliminarily determined to be within the range for a finding of substantial safety significance (Yellow); however, the safety characterization is not final. Therefore, the safety significance will be designated as To Be Determined (TBD). The licensees analysis preliminarily determined the significance of this finding to be in the range for a finding of low to moderate safety significance (White). The major difference was the values used by the licensee for certain events which affected recovery credit. The finding does not represent an immediate safety concern because the licensee reprogrammed the relays with the blocking function prior to unit restart.

• For Unit 2, the inspectors used IMC 0609, Attachment 4, for the at-power condition and determined there was a loss of safety function which required a Phase 2 analysis. The inspectors used IMC 0609, Appendix A, and the site-specific worksheets and determined the safety significance to be greater than Green which required a Phase 3 analysis. A Phase 3 analysis was performed using 42 days as the exposure time. Recovery of onsite power from Unit 2 was credited in the analysis. The dominant accident sequence was: a loss of offsite power (LOSP)transient due to the performance deficiency; emergency AC Power from both EDGs fails; auxiliary feedwater succeeds; PORVs/SRVs remain closed; SSF cooling to the RCP seals succeeds; and failure to recover offsite power in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> leading to core damage. The risk increase was preliminarily determined to be within the range for a finding of greater than very low safety significance; however, the safety characterization is not final. Therefore, the safety significance will be designated as Enclosure 1 10 To Be Determined (TBD). The finding does not represent an immediate safety concern because the licensee reprogrammed the relays with the blocking function prior to unit restart. The licensees analysis preliminarily determined the significance of this finding to be in the range for a finding of very low safety significance (Green).

The major difference was the values used by the licensee for LOSP events affecting both units vs. a single unit which allowed for improved recovery credit from the opposite unit.

The inspectors also used IMC 0609, Appendix G, Attachment 1, Phase 1 Operational Checklists for Both PWRs and BWRs, for the shutdown condition and determined that the finding increased the likelihood of a loss of offsite power which required a Phase 2. The Phase 2 was evaluated as part of the Phase 3 analysis for the at-power condition. The risk increase for the shutdown condition was determined to be bounded by the risk increase for the at-power condition.

The PD was directly related to the aspect of accurate design documentation in the component of Resources in the cross-cutting area of Human Performance in that the engineering design procedures were not complete because there was no requirement for verification of non safety-related design changes. H.2(c)

Enforcement:

Unit 1 TS 3.8.1 required in part that two qualified circuits between the offsite transmission network and the Onsite Essential Auxiliary Power System shall be operable when operating in MODES 1, 2, 3 or 4. TS 3.8.1, Condition A required that with one offsite circuit inoperable, restore the offsite circuit to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. TS 3.8.1, Condition C required that with two offsite circuits inoperable, restore one offsite circuit to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Contrary to the above, from July 23, 2011, until November 11, 2011, when operating in MODE 1, one qualified circuit between the offsite transmission network and the Onsite Essential Auxiliary Power System was inoperable and not restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, and from November 11, 2011, until April 4, 2012, when operating in MODES 1, 2, 3, or 4, two qualified circuits between the offsite transmission network and the Onsite Essential Auxiliary Power System were inoperable and one offsite circuit was not restored to an operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Consequently, Unit 1 experienced a LOSP when a Unit 1 reactor trip/turbine trip occurred on April 4, 2012. The licensee programmed the Zone G relays to block the underfrequency protective trips whenever the generator output breakers were open.

This violation is in the licensees CAP as PIP C-12-3403. Because this violation of TS is associated with a finding of preliminary Yellow safety significance it is being considered for escalated enforcement and is identified as AV 05000413/2012009-01, Failure to Provide Vendor with Accurate Design Information.

Unit 2 TS 3.8.1 required in part that two qualified circuits between the offsite transmission network and the Onsite Essential Auxiliary Power System shall be operable when operating in MODES 1, 2, 3 or 4. TS 3.8.1, Condition A, required that with one offsite circuit inoperable, restore the offsite circuit to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. TS 3.8.1, Condition C, required that with two offsite circuits inoperable, restore one offsite circuit to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. TS 3.8.2 required in part that one qualified Enclosure 1 11 circuit between the offsite transmission network and the Onsite Essential Auxiliary Power distribution system shall be operable when operating in MODES 5 and 6. TS 3.8.2, Condition A, required in part that with one offsite circuit inoperable, immediate actions should be taken to restore the offsite circuit to an operable status. Contrary to the above, from February 4, 2012, until February 18, 2012, while operating in MODE 1, one qualified circuit between the offsite transmission network and the Onsite Essential Auxiliary Power System was inoperable and not restored within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and from February 18, 2012, until March 10, 2012, while operating in MODES 1, 2, 3, or 4, two qualified circuits between the offsite transmission network and the Onsite Essential Auxiliary Power System were inoperable and one offsite circuit was not restored to an operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. In addition, from March 10, 2012, to March 19, 2012, and from March 28, 2012, to April 5, 2012, one qualified circuit between the offsite transmission network and the Onsite Essential Auxiliary Power System was inoperable when operating in MODES 5 and 6 and action was not taken to restore the offsite circuit to an operable status. Consequently, a LOSP occurred on Unit 2 when Unit 1 experienced a reactor trip/turbine trip. The licensee realigned Unit 2 to independent offsite power supply to restore power to the Unit 2 essential buses. This violation is in the licensees CAP as PIP C-12-3403. Because this violation is associated with a preliminary Greater than Green finding, it is being considered for escalated enforcement and is identified as AV 05000414/2012009-02, Unit 2 Offsite Power Circuits Inoperable Due to Improper Unit 1 Zone G Modification.

.2 Unit 2 Zone G Modification

Introduction:

A self-revealing Green finding was identified for the licensees failure to follow EDM-141. The licensee did not identify the blocking feature for the instantaneous underfrequency protective function in both the vendor specification and the supporting information provided to the vendor. The offsite power supply to Unit 2 would have been lost anytime there was a generator trip from high power when offsite power was provided from Unit 2 without this blocking feature.

Description:

As described previously, the Unit 2 Zone G modification was installed during the ongoing refueling outage and the programming error would not have been identified prior to unit restart. As a result, a LOSP would have occurred on Unit 2 anytime there was a generator trip from a high power condition.

Analysis:

The failure to follow EDM-141 was a PD. The PD was more than minor because, if left uncorrected, it would result in a more significant safety concern in that Unit 2 would have had a LOSP anytime the generator tripped from a high power condition. This finding affected the Mitigating Systems cornerstone. The inspectors used IMC 0609, Attachment 4, and determined the finding was of very low safety significance (Green) because the programming error was corrected prior to unit restart; therefore, there was no loss of safety function. The same cross-cutting aspect for the Unit 1 finding also applies to this finding; therefore, no separate cross-cutting aspect will be assigned to this finding. Enclosure 1 12

Enforcement:

There was no violation of NRC regulatory requirements; therefore, this finding is not subject to formal enforcement. Because this finding was of very low safety significance and did not involve a violation of regulations, this finding is identified as FIN 05000414/2012009-03, Improper Unit 2 Zone G Modification.

.4 Whether the Zone G modification errors have potential generic risk implications

a. Discussion The inspectors identified two potential concerns. The first issue was providing insufficient design information to vendors that are not familiar with nuclear plant modification processes in that can result in critical features being missed. Furthermore, licensee engineering controls may not be of sufficient rigor to provide adequate review of vendor work for modifications that are not safety-related allowing errors to go undetected. The second issue was that modifications which are not safety-related could affect reliability or functionality of TS or important to safety structures, systems and components (SSCs). This could result in a higher initiating event or failure frequency than assumed in the licensees probabilistic risk assessment thereby increasing the overall risk profile of the plant.

b. Findings

No findings were identified.

.5 The common SSF DG not achieving its 600V design rating

a. Discussion: The SSF DG was installed in about 1983 to address station blackout (SBO)events. The SSF DG supplied power to various plant components including the SSF makeup pump and a bank of pressurizer heaters. Both of these components were necessary to meet the SSF design requirement that the plant be maintained in Hot Standby for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. A power factor controller (PFC) was used to simulate reactive load when operating the SSF DG in the PARALLEL mode for testing by biasing voltage regulator output. The PFC was intended to be bypassed so there would not be any affect on voltage regulator output when the SSF DG was loaded onto an isolated bus. At that time the PFC was set at 0.98 which meant that the PFC had minimal bias on voltage regulator output. Therefore, when a LOSP event occurred in 2006, the SSF EDG was started and performed as expected due to the PFC having minimal effect on voltage regulator output. The routine monthly surveillance tested the SSF DG in PARALLEL mode and no isolated bus testing was performed until 2009 when the NRC questioned if the SSF DG was capable of maintaining required output of 700 kW to an isolated bus for the required time. However, due to personnel safety concerns and physical restrictions, the testing method bypassed the PFC. Therefore, this testing did not identify the problem. As a result of a 2009 NRC inspection observation, the PFC was changed to 0.93 in April 2010 using a work order. No post-modification testing or design review was performed because it was a setpoint change and not a modification to the function of the PFC. When the SSF DG was started and loaded during the recent Enclosure 1 13 LOSP event, the decreased PFC setting resulted in a much larger effect on the voltage regulator output causing actual output voltage to drop to 400V. The licensee observed that output voltage was normal until the SSF DG output breaker was closed to power the security batteries. Based on this observation, the licensee compared wiring diagrams from the McGuire Nuclear Stations SSF DG and determined the PFC was not being bypassed from the voltage regulators control circuit. The licensee determined that incorrect wiring had existed since the SSF was installed.

b. Findings

Introduction:

An Unresolved Item (URI) was identified to review the licensees root cause evaluation (RCE) and isolated bus testing results.

Description:

The licensee was performing a RCE on the condition and was to perform testing to determine if the SSF DG could provide power to the SSF NC make-up pump for the required 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The results of the RCE and the SSF DG testing will be reviewed for a PD and any violation of regulatory requirements. This URI will be identified as URI 05000413, 414/2012009-04, SSF EDG Low Output Voltage.

2.3 Assess the licensees activities related to the problem investigation performed to date.

a. Discussion: The licensee initiated both a reactor trip investigation and Prompt Investigation Response Team (PIRT) to assess the event. The inspectors reviewed the PIRT report and determined it was thorough and assessed both the design aspects of the Zone G modification and the human performance during the event. The PIRT was comprised of multidisciplinary members from the McGuire and Oconee nuclear stations and the corporate office.

b. Findings

No findings were identified.

2.4 Determine the impact of the SSF DG low voltage and any significance affecting plant recovery from the LOSP.

a. Discussion: The SSF DG was used only to charge security battery loads and did not affect the recovery from the LOSP. The degraded voltage was adequate to charge the security batteries and did not affect the function of security systems.

b. Findings

No findings were identified. Enclosure 1 14

4OA6 Exit Meeting

A preliminary exit meeting was held on April 13, 2012, and the results presented to Mr.

Jim Morris. A final exit was held on June 18, 2012, with Mr. George Hamrick to present the final inspection results. No proprietary information was identified.

ATTACHMENTS: 1.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

P. Barrett, Regulatory Compliance

A. Driver, Licensing Engineer

B. Ferguson, System Engineering Manager

B. Gragg, System Engineering Manager - McGuire

T. Hamilton, Engineering Manager

G. Hamrick, Plant Manager

R. Hart, Regulatory Compliance Manager

J. Morris, Catawba Superintendent

C. Noland, Duke Safety Assurance Manager

S. Putnam, Safety Assurance Manager - Catawba

T. Simril, Operations Manager

NRC Personnel

A. Hutto, Senior Resident Inspector

LIST OF REPORT ITEMS

Opened and Closed

05000414/2012009-03 FIN Improper Unit 2 Zone G Modification (Section 2.2.3)

Open

05000413/2012009-01 AV Failure to Provide Vendor with Accurate Design Information (Section 2.2.3)

05000414/2012009-02 AV Unit 2 Offsite Power Circuits Inoperable Due to Improper Unit 1 Zone G Modification (Section 2.2.3)

05000413, 414/2012009-04 URI SSF DG Low Output Voltage (Section 2.2.5)