Text

NRC Special Inspection Report 05000458/2015010 and Preliminary White Finding
	ML16047A268
Person / Time
Site:	River Bend
Issue date:	02/16/2016
From:	Sowa J; NRC/RGN-IV/DRP/RPB-C
To:	Olson E; Entergy Operations
	Warnick G
References
	EA-15-140 IR 2015010
	Download: ML16047A268 (78)
	v • d • e

February 16, 2016

SUBJECT:

RIVER BEND STATION - NRC SPECIAL INSPECTION REPORT 05000458/2015010 AND PRELIMINARY WHITE FINDING

Dear Mr. Olson:

On March 24, 2015, the U.S. Nuclear Regulatory Commission (NRC) completed its initial assessment of the circumstances surrounding a loss of control building ventilation, which occurred on March 9, 2015, at the River Bend Station. Based upon the risk and deterministic criteria specified in NRC Management Directive 8.3, NRC Incident Investigation Program, the NRC initiated a special inspection in accordance with Inspection Procedure 93812, Special Inspection. The basis for initiating the special inspection and the focus areas for review are detailed in the Special Inspection Charter (Attachment 2 of the enclosed inspection report).

Based on this initial assessment, the NRC sent an inspection team to your site on March 30, 2015.

On January 20, 2016, the NRC completed its special inspection. The enclosed report documents the inspection findings that were discussed on January 20, 2016, with Mr. Dean Burnett, Acting Director, Regulatory and Performance Improvement, and other members of your staff. The team documented the results of this inspection in the enclosed inspection report.

The enclosed inspection report documents a finding that has preliminarily been determined to be White, a finding with low to moderate safety significance that may require additional NRC inspections, regulatory actions, and oversight. As described in Section 2.6.a of the enclosed report, the team identified an apparent violation for a failure to adequately assess the increase in risk of operating the control building chilled water system chillers in various single-failure vulnerable configurations. As a result of this deficiency, the station reduced the reliability and availability of systems contained in the main control room and failed to account for the significant, uncompensated impairment of the safety functions of the associated systems.

Because actions have been taken to initiate condition reports, to investigate and resolve the technical issues with the control building chilled water system chillers, and to provide guidance to operations personnel, the failure to adequately assess the increase in risk of operating the control building chilled water system chillers in various single-failure vulnerable configurations does not represent a continuing safety concern. The NRC assessed this finding using the best available information, and Manual Chapter 0609, Significance Determination Process. The basis for the NRCs preliminary significance determination is described in the enclosed report. The finding is also an apparent violation of NRC requirements and is being considered for escalated enforcement action in accordance with the Enforcement Policy, which can be found on the NRCs website at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html.

The NRC will inform you in writing when the final significance has been determined.

We intend to complete and issue our final safety significance determination within 90 days from the date of this letter. The NRCs significance determination process (SDP) is designed to encourage an open dialogue between your staff and the NRC; however, the dialogue should not affect the timeliness of our final determination.

Before we make a final decision on this matter, we are providing you with an opportunity to (1) attend a Regulatory Conference where you can present your perspective on the facts and assumptions used to arrive at the finding and assess its significance, or (2) submit your position on the finding to the NRC in writing. If you request a Regulatory Conference, it should be held within 40 days of your receipt of this letter. We encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. The focus of the Regulatory Conference is to discuss the significance of the finding and not necessarily the root cause(s) or corrective action(s)

associated with the finding. If you choose to attend a Regulatory Conference, it will be open for public observation. The NRC will issue a public meeting notice and press release to announce the conference. If you decide to submit only a written response, it should be sent to the NRC within 40 days of your receipt of this letter. If you decline to request a Regulatory Conference or to submit a written response, you relinquish your right to appeal the NRCs final significance determination, in that by not choosing an option, you fail to meet the appeal requirements stated in the Prerequisites and Limitations sections of Attachment 2, Process for Appealing NRC Characterization of Inspection Findings (SDP Appeal Process), of NRC Inspection Manual Chapter 0609.

Please contact Greg Warnick at (817) 200-1144, and in writing, within 10 days from the issue date of this letter to notify us of your intentions. If we have not heard from you within 10 days, we will continue with our final significance determination and enforcement decision. The final resolution of this matter will be conveyed in separate correspondence.

Because the NRC has not made a final determination in this matter, no Notice of Violation is being issued for this inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violation described in the enclosed inspection report may change based on further NRC review.

In addition, NRC inspectors documented two NRC-identified findings and one self-revealing finding of very low safety significance (Green) in this report. Two of these findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these non-cited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the River Bend Station. If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the River Bend Station.

In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390, Public Inspections, Exemptions, Requests for Withholding, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC's Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Troy W. Pruett Director Division of Reactor Projects Docket Nos.: 50-458 License Nos.: NPF-47

Enclosure:

Inspection Report 05000458/2015010 w/ Attachments:

1. Supplemental Information 2. Special Inspection Charter 3. Detailed Risk Evaluation

REGION IV==

Docket: 05000458 License: NPF-47 Report: 05000458/2015010 Licensee: Entergy Operations, Inc.

Facility: River Bend Station, Unit 1 Location: 5485 U.S. Highway 61N St. Francisville, LA 70775 Dates: March 30, 2015, through January 20, 2016 Inspectors: D. Bradley, Resident Inspector J. Watkins, Reactor Inspector R. Deese, Senior Reactor Analyst C. Smith, Reactor Inspector E. Uribe, Reactor Inspector Approved By: T. Pruett, Director Division of Reactor Projects Enclosure

SUMMARY OF FINDINGS

IR 05000458/2015010; March 30, 2015 through January 20, 2016; River Bend Station; special inspection for the loss of control building ventilation on March 9, 2015.

The report covered one week of onsite inspection and in-office review from March 30, 2015, through January 20, 2016, by inspectors from the NRCs Region IV office. One preliminary White apparent violation, two Green non-cited violations and one Green finding were identified.

The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance Determination Process. Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process,

Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

TBD. The NRC identified an apparent violation of 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, paragraph (a)(4) with preliminary white significance.

Prior to March 30, 2015, before performing maintenance activities, the licensee failed to adequately assess the increase in risk that may result from proposed maintenance activities.

Specifically, the risk assessment performed by the licensee for plant maintenance failed to account for certain safety significant structures, systems, and components that were concurrently out of service. On multiple occasions, the licensee failed to adequately assess the risk of operating the control building chilled water system (HVK) chillers in various single-failure vulnerable configurations. As a result of this deficiency, the station reduced the reliability and availability of systems contained in the main control room and failed to account for the significant, uncompensated impairment of the safety functions of the associated systems. In response to the NRCs conclusions, the licensee initiated Condition Report CR-RBS-2016-00095. The licensee also completed engineering analyses to evaluate alternate cooling methods, including cross-connecting service water and the HVK chiller systems, in order to provide cooling to spaces housing electrical components.

This performance deficiency is more than minor, and therefore a finding, because it is associated with the configuration control attribute of the Mitigating Systems Cornerstone, and adversely affected the associated cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees failure to account for a loss of all HVK cooling scenario, either quantitatively or qualitatively, resulted in uncompensated impairment to all systems associated within the main control room. A loss of cooling to the control room could lead to multiple systems exceeding their equipment qualification temperatures and impact control room habitability. The finding was evaluated using Inspection Manual Chapter (IMC)0609, Appendix K, Maintenance Risk Assessment and Risk Management Significance Determination Process. Using Inspection Manual Chapter 0609, Appendix K, the finding was determined to require additional NRC management review using risk insights where possible because the quantitative probabilistic risk assessment (PRA) tools are not well suited to analyze failures from control room heat-up events. Thus, the analyst evaluated the safety significance posed by the heat-up of components cooled by the HVK chillers using Appendix K, Flowchart 1, Assessment of Risk Deficit, to the extent practical, with additional risk insights by internal NRC management review in accordance with Inspection Manual Chapter 0612, Power Reactor Inspection Reports. The significance of the finding was preliminarily determined to be

White.

The team determined the most significant contributing cause of the licensee failing to adequately assess the increase in risk from proposed maintenance activities was inadequate procedural guidance in Procedure ADM-0096, Risk Management Program Implementation and On-line Maintenance Risk Assessment, Revision 316. This finding has a resources cross-cutting aspect within the human performance area because leaders failed to ensure that personnel, equipment, procedures, and other resources are available and adequate to support nuclear safety [H.1]. (Section 2.6.a)

Green.

The team reviewed a self-revealing non-cited violation of 10 CFR Part 50,

Appendix B, Criterion XVI, Corrective Action, for the licensees failure to promptly identify and correct a condition adverse to quality related to Masterpact circuit breakers.

Specifically, the licensee did not promptly identify and correct a Masterpact breaker failure mechanism, even though related industry operating experience was available. The licensee determined the failure mechanism caused nine breaker failures since 2007, and may have contributed to an additional six failures where the cause was not conclusively determined.

In response to the NRCs conclusions, the licensee initiated Condition Report CR-RBS-2015-03951. Further, the licensee modified all vulnerable Masterpact circuit breakers to remove this failure mechanism.

This performance deficiency is more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the licensees untimely corrective action contributed to additional failures of Masterpact circuit breakers and decreased the reliability of Masterpact circuit breakers to respond during design basis events. The team performed an initial screening of the finding in accordance with NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. Using Inspection Manual Chapter 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions, the finding was of very low safety significance (Green) because it: (1) was not a deficiency affecting the design or qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and (4) did not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program. This finding has an operating experience cross-cutting aspect within the problem identification and resolution area because the licensee failed to systematically and effectively collect, evaluate, and implement relevant internal and external operating experience in a timely manner [P.5]. (Section 2.6.b)

Green.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B, Criterion V,

Instructions, Procedures, and Drawings, for the licensees failure to accomplish an operability determination in accordance with procedure EN-OP-104, Operability Determination Process, Revision 8. Specifically, the licensee referenced non-conservative data, contrary to steps 5.5 and 5.11 of procedure EN-OP-104, when assessing the reduced reliability of Masterpact circuit breakers as a degraded or nonconforming condition. The licensee restored compliance by completing a design modification to eliminate the failure mode and initiated Condition Report CR-RBS-2015-03952.

This performance deficiency is more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the reliability of components powered by Masterpact circuit breakers was reduced and, by justifying operability using non-conservative data, the licensee did not recognize the actual unreliability. The team performed an initial screening of the finding in accordance with NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. Using Inspection Manual Chapter 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions, the finding was of very low safety significance (Green) because it: (1) was not a deficiency affecting the design or qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and (4) did not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program. This finding has a conservative bias cross-cutting aspect within the human performance area because the licensee failed to use decision-making practices that emphasize prudent choices over those that are simply allowable. Specifically, the licensee did not consider that the failure mechanism only occurs on a close command. Instead, the licensee included opening commands when summing the total demands and this resulted in a non-conservative failure rate [H.14]. (Section 2.6.c)

Green.

The team identified a finding for the licensees failure to identify and correct an adverse condition in a timely manner as required by plant procedures. Specifically, the licensee did not recognize degrading trends associated with incorrect racking of Magne Blast circuit breakers and failures of the Magne Blast circuit breaker for the Reactor Feed Water Pump Motor 1B in a timely manner. For both cases, the licensee failed to initiate corrective action in a timely manner as required by procedure EN-LI-102, Corrective Action Program. In response to the NRCs conclusions, the licensee updated circuit breaker procedures, replaced the Magne Blast circuit breaker for the Reactor Feed Water Pump Motor 1B, and initiated Condition Reports CR-RBS-2015-04259 and CR-RBS-2015-03437.

This performance deficiency is more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the licensees untimely corrective action contributed to the unreliability of the Magne Blast circuit breaker for Reactor Feed Water Pump Motor 1B and increased the potential for spurious trips of other Magne Blast circuit breakers during design basis events due to improper racking. The team performed an initial screening of the finding in accordance with NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. Using Inspection Manual Chapter 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions, the finding was of very low safety significance (Green) because it: (1) was not a deficiency affecting the design or qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and (4) did not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program. This finding has an avoid complacency cross-cutting aspect within the human performance area because the licensee failed to recognize and plan for the possibility of mistakes, latent issues, and inherent risk, even while expecting successful outcomes. Specifically, the licensee tolerated the adverse trends, did not plan for further degradation, and the latent conditions ultimately resulted in several Magne Blast circuit breaker failures in December 2014 before the trend was recognized [H.12]. (Section 2.6.d)

REPORT DETAILS

1. Basis for Special Inspection

On March 9, 2015, during emergency core cooling system and loss of coolant accident (ECCS/LOCA) testing of division I, control building chiller 1C shed from the electrical bus as expected, but failed to restart and sequence onto the emergency diesel generator as designed.

There are two control building chilled water (HVK) chillers in division I, chillers 1A and 1C. HVK chiller 1A had been inoperable and unavailable since August 11, 2014. Since no division I HVK chillers were available, operations personnel attempted to start both of the division II HVK chillers 1B or 1D. Both of the division II HVK chillers failed to start since the equipment had an electrical interlock that prevented a chiller from starting unless both of the division II air handling units (AHUs) were operating. Division II AHU 1B would not start due to an unknown breaker deficiency. Operations personnel attempted to restart HVK chiller 1C on division I without success. The operators entered abnormal operating procedure AOP-60, Loss of Control Building Ventilation, due to the loss of the control building ventilation (HVC) system.

A similar failure occurred during division II ECCS/LOCA testing on February 23, 2015.

Notable differences that made the March 9, 2015, failure more significant were:

During the February 23 event, AHU 2B would not start. The Station subsequently identified two relays in the startup sequencer for AHU 2B that were degraded. The station operations personnel were able to start division I AHU 1A as expected. As a result, the electrical interlock did not prevent HVK chiller 1C from starting and control building ventilation was restored. However, during the March 9 event, a known deficiency with the operating mechanism for Masterpact breakers caused the failure of the HVK chiller 1C to start. The station attempted to restore ventilation by starting a division II chiller, but AHU 1B would not start. The electrical interlock prevented HVK chiller 1B from starting since the required AHUs were not operating.

The breaker for AHU 1B is a Masterpact breaker which failed to close for a different reason that involved improper breaker installation (See Section 2.3.b).

HVK chiller 1A had been inoperable and unavailable since August 11, 2014. With chiller 1A out of service and HVK chiller 1C failing to start, the risk implications were more significant.

The March 9 event, and associated equipment failures, revealed a much broader concern with the licensees resolution of Masterpact breaker deficiencies in the safety-related standby gas treatment (STGS) and control building HVC systems. These systems support operability for control room air conditioning, equipment in the standby switchgear rooms, battery chargers, and inverters. Additionally, issues associated with GE Magne Blast circuit breakers that were partially inspected during the Special Inspection performed by the NRC to evaluate the causes of the December 25, 2014, unplanned reactor trip with complications (see NRC Inspection Report 05000458/2015009, ADAMS ML15188A532) called into question the overall adequacy of the licensees breaker maintenance program.

The NRC used Management Directive 8.3, NRC Incident Investigation Program, to evaluate the level of NRC response for this event. The deterministic criteria of interest were:

(1) the event included multiple failures in the control building ventilation system, which is a system to support operability for control room air conditioning, equipment in the standby switchgear rooms, battery chargers, and inverters; and

(2) the event involved repetitive failures of safety-related Masterpact breakers. The preliminary Estimated Conditional Core Damage Probability was determined to be 2.6E-6.

Based on the deterministic criteria and risk insights related to the multiple failures of the control building ventilation system, the nature of the Masterpact breaker failures, and the potential generic concern with the Magne Blast circuit breakers, the NRC decided to conduct a Special Inspection. This Special Inspection charter included a review of the recent surveillance testing failures associated with the control building ventilation system; a review of the identified Masterpact breaker deficiency and its impact on equipment operability; a continued review of issues associated with GE Magne Blast circuit breakers; and a review of the licensees corrective actions including extent of condition. In addition, the Special Inspection evaluated the licensees actions with regard to technical specification limiting conditions for operation applicability, when control building chillers are declared inoperable or non-functional.

The team used NRC Inspection Procedure 93812, Special Inspection Procedure, to conduct the inspection. The inspections included field walkdowns of equipment, interviews with station personnel, and reviews of procedures, corrective action documents, and design documentation. A list of documents reviewed is provided in 1 of this report; the Special Inspection Charter is included as Attachment 2.

2. Inspection Results

2.1 Charter Item 2: Develop a complete sequence of events related to the multiple Masterpact breaker failures to close when demanded during division I Emergency Core Cooling System (ECCS) surveillance testing and subsequent loss of ventilation recovery on March 9, 2015.

a. Inspection Scope

The team developed and evaluated a timeline of the events leading up to, during, and after the loss of control building chilled water on March 9, 2015. This included troubleshooting activities, maintenance practices, and operations procedures. The team developed the timeline, in part, through a review of work orders, action requests, station logs, and interviews with station personnel.

b. Findings and Observations

The team created the following timeline during their review of the events related to the loss of control building chilled water that occurred on March 9, 2015.

Date/Time Activity August 11, 2014 HVK chiller 1A is removed from service for maintenance and is not restored due to damage from a human performance error. The licensee replaced chiller 1A during the summer of 2015.

March 9, 2015 10:50 a.m.

Commenced surveillance procedure STP-309-0601, Division 1 ECCS Test.

11:00 a.m.

Entered abnormal operating procedure AOP-0060, Loss of Control Building Ventilation. Specifically, HVK chiller 1C failed to start automatically per procedure STP-309-0601. With HVK chiller 1A out of service, control room personnel attempted to start a division II chiller. Neither HVK chiller 1B or 1D started due to a failure of the division 2 air handling unit, ACU 1B, to start.

11:23 a.m.

Operations personnel completed time-critical steps 5.1.3 and 5.1.4 of abnormal operating procedure AOP-0060 to provide alternate cooling for the control room and vital switchgear. These actions included opening doors. Additionally, operations personnel started the safety-related control room fresh air system (CRFA) to mitigate heat-up of the control room.

The licensee initiated troubleshooting work order 408340 to restore HVK chiller 1C and troubleshooting work order 408341 to restore ACU 1B.

1:43 p.m.

Failed attempt to restart HVK chiller 1C with engineering personnel present and a computer connected to the local display panel.

Troubleshooting determined that the circuit breaker failed to close following receipt of a valid command to close.

Date/Time Activity 2:10 p.m.

Completed division I diesel generator full load rejection per procedure STP-309-0601.

2:31 p.m.

Successfully started HVK chiller 1C after depressing the local reset pushbutton per the troubleshooting work order.

2:40 p.m.

Exited abnormal operating procedure AOP-0060.

ACU 1B failed to start because of an out of alignment switch linkage rod. Further discussion of this failure mechanism is included in Section 2.3.b of this report.

During the March 9, 2015, loss of HVK chiller cooling, maximum temperatures in spaces cooled by HVK chillers did not reach or exceed equipment limitations. Specifically, the control room reached 91.4°F just prior to opening doors and initiating CRFA. The control room then returned to 70°F. The technical specification limit for the control room is 104°F. The largest change in temperature for other HVK cooled components occurred in the safety-related battery charger/inverter rooms. The temperature rose from 85°F to 90°F. The equipment qualification temperature limit is 104°F.

The team determined the licensee failed to identify and correct an adverse condition associated with Masterpact circuit breaker internal binding that occurred on March 9, 2015, for HVK chiller 1C. Further discussion of this performance deficiency and the internal binding failure mechanism of Masterpact circuit breakers are included in Section 2.6.b of this report.

2.2 Charter Item 5: Evaluate the licensees actions with regard to technical specification limiting conditions for operation applicability when control building chillers are declared inoperable or non-functional.

a. Inspection Scope

The River Bend Station control building chilled water system consists of two redundant, closed loop chilled water trains. The chilled water system supplies water during normal, shutdown, and design basis accident conditions to the cooling coils in the main control room air conditioning units, standby switchgear air conditioning units, and chiller equipment air conditioning units. Chilled water is supplied by two independent trains, either one of which is capable of meeting the total chilled water demand. Each train contains two 100-percent capacity electric motor-driven, centrifugal liquid chillers (HVK chillers), two 100-percent capacity chilled water recirculation pumps, two 100-percent capacity condenser cooling water pumps, and one chilled water compression tank. The service water systems provide the chiller condenser cooling water. The station typically operates with only one chiller running and the others in a standby status.

At the time of the inspection, the team identified that, during periods when the associated division of HVK chillers are out of service, the licensee would only enter the technical specification action statements for the main control room air conditioning system, which is supported by HVK chillers. The licensee did not enter the action statements for other supported equipment being inoperable, such as DC batteries, inverters, or AC/DC switchgear. To understand the licensees position on these HVK-cooled components the team reviewed operations procedures, station technical specifications and bases, control room logs, the licensees actions during prior periods where HVK chillers were removed from service, and met with members of the operations department.

b. Findings and Observations

Unresolved Item (URI) - Technical Specification Allowed Outage Time During Loss of Non-Technical Specification Supported Systems

Introduction.

The team identified an unresolved item related to the licensees treatment of the control building chilled water system (HVK) chillers as a non-technical specification support system for other technical specification systems.

Description.

The team noted that when an entire division of HVK chillers is out of service, such as chillers 1A and 1C for division I, the licensee would only enter the Technical Specification (TS) 3.7.3, Control Room Air Conditioning (AC) System, action statement for the condition of one control room AC subsystem being inoperable (condition A). The licensee did not enter TS action statements associated with inoperability of other components cooled by HVK chillers, such as the AC switchgear, DC switchgear, and vital inverters. The licensee, instead, has incorporated a safety evaluation for the Perry Plant (ML020950074), dated April 5, 2002, into the bases for TS 3.0.6 and applied that document as guidance:

no TS limits the duration of the non-TS support subsystem outage, even though the single-failure design requirement of the supported TS systems is not met. However, by assessing and managing risk in accordance with 10 CFR 50.65(a)(4), an appropriate duration for the maintenance activity can be determined.

The NRC team questioned whether the Perry Plants safety evaluation could be applied generically, if the licensee improperly incorporated the safety evaluation via the 10 CFR 50.59 process, if the guidance conflicted with section 9.2.10.3 of the Updated Safety Analysis Report (USAR) for River Bend Station, and if the safety evaluation for the Perry Plant conflicted with guidance found in Generic Letter 80-30, Clarification of the Term Operable As It Applies to Single Failure Criterion For Safety Systems Required by TS.

The aggregate impact of these decisions resulted in the River Bend Station placing TS systems cooled by HVK, such as the AC switchgear, DC switchgear, and vital inverters, in a single-failure vulnerable configuration for durations exceeding the allowed outage time specified in the TS.

Pending further evaluation of the above issue by NRC Headquarters staff via a Technical Specification interpretation request (ML15231A111) and subsequent review by NRC inspectors, this issue will be tracked as URI 05000458/2015010-01, Technical Specification Allowed Outage Time During Loss of Non-Technical Specification Supported Systems.

Further discussion of performance deficiencies associated with the HVK chiller system is included in Section 2.6.a of this report.

2.3 Charter Items 3, 4, and 7: For Masterpact circuit breakers, evaluate the causes of breaker failures, corrective actions, and licensee practices.

a. Inspection Scope

To determine the cause of the Masterpact breaker failures experienced at River Bend Station, the team reviewed condition reports, operating experience, vendor failure reports, and spoke with members of engineering and maintenance departments. This information was then compared to the timeline of Masterpact breaker failures and component design documentation. The team also performed walkdowns, reviewed completed surveillance test results, and reviewed corrective actions including modifications. The team assessed the cause evaluation process to verify actions were at a level of detail commensurate with the significance of the problem.

b. Findings and Observations

The River Bend Station uses Masterpact 480 VAC circuit breakers as a replacement for obsolescent GE AK/AKR series breakers. Masterpact breakers were first installed for safety-related applications in 2007 and have experienced three different types of failures:

1. Internal, mechanical binding during anti-pump mode - This is the failure mechanism that occurred on HVK chiller 1C on March 9, 2015. Overall, the station determined the failure mechanism caused nine breaker failures since 2007 and may have contributed to an additional six failures where a definitive cause could not be determined.

2. Spurious trip of a closed breaker - This failure has only occurred once, in January 2015, and is documented in Condition Report CR-RBS-2015-2365. The licensee replaced the circuit breaker and sent the circuit breaker off for vendor analysis. The vendor analysis determined there were no identified or repeatable problems with the circuit breaker. The vendor could not rule out potential failure modes such as momentary overcurrent or inadvertent manual operation. The licensee continues to monitor Masterpact breakers for spurious trips.

3. Position switch (52PS) linkage rod misaligned - This failure has only occurred once at the River Bend Station and is the failure mechanism that occurred on HVK AHU 1B on March 9, 2015. This position switch changes state based on whether the breaker is racked to the connected position or not. Because of the misalignment, the 52PS contact in the breaker did not change state, and the breaker cubicle did not have control power. The failure of AHU 1B to start is unrelated to the internal mechanical binding failure mechanism discussed in Section 2.6.b. As a corrective action, the licensee adjusted the control rod to be 1/8 longer to ensure proper position switch fit-up for all 32 Masterpact breakers that were vulnerable to this failure mechanism. This fit-up verification has been added to preventative maintenance tasks, system drawings, and to procedures for spare cubicles. The licensee also initiated Condition Report CR-RBS-2015-1922.

The team determined the licensee did not promptly identify and correct the internal binding Masterpact breaker failure mechanism, even though related industry operating experience existed. Further discussion involving the failure mechanism, and the licensees failure to identify and correct the failure mechanism, is included in Section 2.6.b of this report.

The team noted that the licensee correctly initiated condition reports for the spurious trip of a closed Masterpact breaker and the misaligned 52PS linkage rod. For these one-time failures, the team did not identify any performance deficiencies.

Additionally, the team determined that the licensee failed to accomplish an operability determination in accordance with procedure EN-OP-104, Operability Determination Process, Revision 8. Specifically, the licensee referenced non-conservative data when assessing the reduced reliability of Masterpact circuit breakers as a degraded or nonconforming condition in the operability determination associated with Condition Report CR-RBS-2014-6284. Further discussion involving the licensees failure to perform an operability determination in accordance with their procedure is included in Section 2.6.c of this report.

2.4 Charter Items 6 and 7: For Magne Blast circuit breakers, evaluate the causes of breaker failures, corrective actions, and licensee practices.

a. Inspection Scope

To determine the cause of the Magne Blast breaker failures experienced at River Bend Station, the team reviewed corrective action documents, operating experience, vendor failure reports, and spoke with members of engineering and maintenance departments.

This information was then compared to the timeline of Magne Blast breaker failures and component design documentation. The inspectors assessed the licensees corrective actions including extent of condition and extent of cause.

b. Findings and Observations

The River Bend Station uses Magne Blast circuit breakers for both 13.8 kV nonsafety-related loads and 4.16 kV safety-related loads. Of note, there have been zero failures over the past 5 years for the safety-related 4.16 kV Magne Blast circuit breakers. These safety-related breakers provide power to the division III high pressure core spray system and are routinely cycled during surveillance testing. The focus of this discussion is on the non-safety 13.8 kV breakers and associated failures.

Nonsafety-related Magne Blast circuit breakers follow an approximately 18-year refurbishment cycle and have experienced two types of failures over the past five years:

1. Failure to close due to improper circuit breaker racking - The racking process involves orienting the circuit breaker correctly in the housing such that all internal components are fully engaged, and the circuit breaker can fully perform its function. If a circuit breaker is improperly racked, it may experience intermittent faults, trip prematurely, or not close at all. The licensee has experienced nine issues related to improper racking of Magne Blast circuit breakers over a five year period.

2. Material condition of the Reactor Feed Water Pump Motor 1B circuit breaker -

The licensee experienced eight failure-to-close issues for the Reactor Feed Water Pump Motor 1B (FWS-P1B) circuit breaker over a 19 month period. This one breaker accounts for 80% of the failure-to-close issues at the site out of a population of 28 nonsafety-related 13.8 kV Magne Blast circuit breakers.

Of note, some of the Magne Blast circuit breaker failures have involved both failure mechanisms.

The team identified a finding for the licensees failure to identify and correct an adverse condition, in a timely manner, as required by plant procedures. Specifically, the licensee did not recognize degrading trends associated with incorrect racking of Magne Blast circuit breakers, and failures of the Magne Blast circuit breaker for the Reactor Feed Water Pump Motor 1B, in a timely manner. For both cases, the licensee failed to initiate corrective actions in a timely manner, as required by procedure EN-LI-102, Corrective Action Program. Further discussion related to the failure to identify and correct an adverse condition associated with Magne Blast circuit breakers, including the licensees corrective actions, is included in Section 2.6.d of this report.

c. Closed: Unresolved Item (URI) - Vendor and Industry Recommended Testing Adequacy on Safety-related and Safety-significant Circuit Breakers Background. As part of the review of circuit breaker failures at the River Bend Station, the team reviewed URI 05000458/2015009-01, Vendor and Industry Recommended Testing Adequacy on Safety-related and Safety-significant Circuit Breakers, (see NRC inspection report 05000458/2015009, ADAMS ML15188A532).

That report noted that the licensees maintenance programs for division I, II, III, and nonsafety-related 4.16 kV and 13.8 kV breakers installed in the plant did not meet the standards recommended by the vendor, licensee corporate, or Electric Power Research Institute (EPRI) guidelines. The licensees programs were based on EPRI documents TR-106857-V2 and TR-106857-V3, which were a preventive maintenance program basis for low and medium voltage switchgear. However, the licensee only implemented portions of the recommended maintenance program, and did not provide the team with engineering analysis or technical basis to justify the changes. The EPRI developed the guidance for Magne Blast breakers, based on industry operating experience, NRC Information Notices, and General Electric Service Information/Advisory Letters (SILs/SALs). The licensee had not been performing the entire vendor or EPRI recommended tests, inspections, and refurbishments on the breakers since they were installed. The aggregate impact of missing these preventive maintenance tasks needed to be evaluated to determine if the reliability of the affected breakers had been degraded.

Closure. The licensee has used procedures EN-DC-324, Preventive Maintenance Program and EN-DC-335, PM Basis Template, to modify the preventive maintenance schedules and the refurbishment schedules for their safety-related and nonsafety-related 480V, 4.16kV, and 13.8kV nonsafety-related breakers. Specifically, River Bend Station has the following circuit breakers:

57 safety-related 480V Masterpact breakers

5 safety-related 4.16kV Magne Blast breakers

28 nonsafety-related 13.8kV Magne Blast breakers.

The primary failure mechanism for breakers is age related degradation of the lubrication, which may cause the breaker to operate slowly.

The licensee provided the team with copies of: General Electric Instructions and Recommended Parts for Maintenance, manual for the AM-4.16-250-9, 1200 and 2000 ampere with ML-13 mechanism breakers (GEK-41902 C), EPRI Guidance on Routine Maintenance for Magne Blast Circuit Breakers (TR-109641, supplement to NP-7410-V2P2), Service Advice Letter Lubrication Recommendations Type AM Circuit Breakers ML-13 and ML-13A Mechanisms (SAL) 354.1, and BWR Owners Group Final Results for the Simulated Life Cycle Management Evaluation of D6A15A1 Grease in Magne Blast Circuit Breakers. The SAL and the BWR Owners Group report contain information that would allow the user to extend the maintenance periodicity of the breakers, if using the GE Lubricant D6A15A1 grease (Mobil 28), as opposed to the original grease.

The River Bend Station uses the Mobil 28 grease in all breakers, except the diesel generator output. The BWR Owners Group report contains information that states that breakers lubricated with Mobil 28 have a service life of 20 years, based on extensive age testing performed by General Electric. The use of improved grease can justify an extended maintenance periodicity, but other considerations must be taken into account in order to develop a comprehensive preventive maintenance program.

The General Electric and EPRI documents that are used by the industry are not procedures themselves. They are to be used by the end user as guidance in preparing each users procedures for performing maintenance and overhauls, based upon the end users application. The General Electric and EPRI reference documents are clear that the maintenance of the breakers is highly dependent upon the frequency of operation and the environment in which the breakers are operated. Breakers that interrupt large currents, operate in extreme conditions of dust, moisture or corrosive gases, or are cycled frequently require more frequent maintenance than breakers that are infrequently cycled and operated in dry, clean atmospheres. The River Bend Station considered the frequency of operation and the atmosphere in which their breakers are operated when preparing their breaker preventive maintenance program. The General Electric manual S3221.418.000-003I states that a breaker is rated for 5000 operations before any parts need replacing.

The five safety-related, division III, 4.16kV breakers, which have not experienced a failure within the last five years, were all refurbished between September 3, 1997, and May 18, 1999. These breakers are all operated in a clean, mild, control room type environment and are cycled very infrequently compared to normal industry use.

The most frequently operated 4.16kV safety-related breaker is the division III diesel generator output breaker, which is cycled monthly under surveillance procedure STP-309-0203. Over an 18 year period, this breaker would have been cycled less than 220 times. This represents less than one twentieth of the manufacturers estimated operations life.

The remaining 4.16kV safety-related breakers are cycled less often than the division III diesel generator output breaker to demonstrate their operability. The River Bend Station replaced the diesel generator output breaker in October 2014, 17 years after it was last refurbished, and has scheduled the replacement of the remaining four division III breakers by May 30, 2017. All of the breakers are scheduled to be replaced within 18 years of their last refurbishment.

The 28 nonsafety-related 13.8kV breakers have experienced 14 reported issues over the last five years. There are several breaker position switches and auxiliary contacts that must be properly connected in order to connect control power, charging spring motors, trip and close coils, and convey status of the breaker (closed or open). These are all dependent on the breaker being properly racked in or out. The 13.8kV nonsafety-related breakers are on a schedule to be refurbished/replaced between 2022 and 2026. Further discussion on improper racking of circuit breakers is included in Section 2.6.d of this report.

Square D/Schneider Masterpact 480V breakers were installed at the River Bend Station to replace the obsolete General Electric Type AK and AKR breakers. The River Bend Station has 310 in-use Masterpact breakers. There are 66 safety-related 480V cubicles with 57 in-use breakers. The Schneider vendor manual for the Masterpact breakers has suggested maintenance, inspection, and replacement intervals that are also dependent upon frequency of operation and atmosphere, similar to the guidance given in the General Electric manual and the EPRI documents. The lubricant used on the Masterpact breakers is Mobilith SHC 100, which is rated for a 60+ year service life, and the breakers are rated for 12,500 lifetime operations before replacement (not refurbishment). These breakers require minimal maintenance, which mostly consists of cycling the breaker open and closed, both remotely and locally. This includes testing the electronic trip unit, inspecting the main contacts and arc chambers based upon number of cycles of operation, and then replacing the parts if they have reached their expected lifetime. The Micrologic Trip Units on the breakers have a contact wear indicator, which measures the contact wear from 0-100% and is displayed on the Liquid Crystal Display (LCD). Visual inspection of the contacts is warranted when the contact wear is greater than 50%. The trip units are tested under the protective relaying test procedures, using primary injection and the Original Equipment Manufacturer (OEM) Full Function Test Kit.

Depending on the current carrying capacity and frame size of the breaker, the replacement schedule ranges from 3,000 to 10,000 electrical operations (open-close cycles). No breakers in service at River Bend Station experience this number of operations; therefore, they should require minimum maintenance over their expected 40-year life.

While there have been some issues with the racking of circuit breakers and with the material condition of the Reactor Feed Water Pump Motor 1B breaker, the team determined that a systematic lack of maintenance, which would lead to an overall increase in breaker failures, does not exist. Of note, in December 2014, the licensee instituted Standing Order 299, and, in March 2015, revised procedure OPS-0052, Breaker Racking and 13.8kV to 480 VAC Transformer Disconnect Operations, to require an electrician to be present to check several key indicators and gaps on the breaker mechanism before a breaker is racked down/up.

Based upon the technical information provided and reviewed, the team noted the low number of breaker operations, the mild operating environment, and the general lack of evidence of a high failure rate over the last five years. As a result of these observations, the team determined the licensee has reasonable justification for an extension of the maintenance periodicity of the 480V safety-related and nonsafety-related, 4.16kV safety-related, and 13.8kV nonsafety-related breakers. The team did not identify a performance deficiency with the licensees extension of circuit breaker maintenance periodicity.

URI 05000458/2015009-01, Vendor and Industry Recommended Testing Adequacy on Safety-related and Safety-significant Circuit Breakers is closed with no associated finding or violation of NRC requirements identified.

2.5 Charter Item 8: Evaluate pertinent industry operating experience and potential precursors to the event, including the effectiveness of any action taken in response to the operating experience.

a. Inspection Scope

The team evaluated the licensees application of industry operating experience related to this event. The team reviewed applicable operating experience and generic NRC communications with a specific emphasis on breaker maintenance practices. This was done to assess whether the licensee had appropriately evaluated the notifications for relevance to the facility, and incorporated applicable lessons learned into station programs and procedures.

b. Findings and Observations

The team identified two issues regarding the origination and use of operating experience. First, the licensee did not promptly identify and correct a Masterpact breaker failure mechanism even though related industry operating experience existed.

Further discussion involving the operating experience aspect of the licensees failure to identify and correct a Masterpact failure mechanism is included in Section 2.6.b of this report.

The team also noted that the vendor for Masterpact breakers, NLI, did not distribute a vendor notice to River Bend Station as they described in a 2012 Hope Creek Non-Conformance Report (NCR-400). Since the internal, mechanical binding failure mechanism for Masterpact breakers had occurred at Hope Creek prior to the River Bend Station event, there may have been an additional opportunity to identify this failure mechanism. This observation was discussed with the NRCs Vendor Inspection Branch.

2.6 Specific findings identified during this inspection.

a. Failure to Adequately Assess Risk During Chiller Unavailability

Introduction.

The NRC identified an apparent violation of 10 CFR 50.65 Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, paragraph (a)(4) with preliminary white significance.

Prior to March 30, 2015, the licensee failed to adequately assess the increase in risk that may result from proposed maintenance activities. Specifically, the risk assessment performed by the licensee for plant maintenance failed to account for certain safety significant structures, systems, and components that were concurrently out of service.

On multiple occasions, the licensee failed to adequately assess the risk of operating the control building chilled water system (HVK) chillers in various single-failure vulnerable configurations. As a result of this deficiency, the station reduced the reliability and availability of systems contained in the main control room and failed to account for the significant, uncompensated impairment of the safety functions of the associated systems.

Description.

The team reviewed the operational history of the HVK system and the licensees actions related to implementation of technical specifications for various HVK system configurations. This chilled water system supplies water during normal, shutdown, and design basis accident (DBA) conditions to the cooling coils in the main control room air conditioning units, standby switchgear rooms air conditioning units, and chiller equipment rooms air conditioning units. Chilled water is supplied by two independent trains, either one of which is capable of meeting the total chilled water demand. Each train contains two 100-percent capacity electric motor-driven, centrifugal liquid chillers (HVK chillers), two 100-percent capacity chilled water recirculation pumps, two 100-percent capacity condenser cooling water pumps, and one chilled water compression tank. The service water systems provide the chiller condenser cooling water. Any one running HVK chiller is sufficient to meet 100 percent of the total chilled water demand. The division I HVK chillers are labeled 1A and 1C. The division II HVK chillers are labeled 1B and 1D. The station typically operates with only one chiller running and the other three in a standby status.

The team noted that when an entire division of HVK chillers is out of service, such as chillers 1A and 1C for division I, the licensee would only enter the Technical Specification (TS) 3.7.3, Control Room Air Conditioning (AC) System, action statement for the condition of one control room AC subsystem being inoperable (condition A). The licensee did not enter TS action statements associated with inoperability of other components cooled by HVK chillers, such as the AC switchgear, DC switchgear, and vital inverters. Note that HVK chillers are not tracked directly in TS but instead are a support system for other TS systems. When the team questioned this practice, the licensee stated that the bases for TS 3.7.3 explicitly discuss chillers as among the minimum subset of components needed to demonstrate operability. Further, the licensee stated the bases for TS 3.8.4, 3.8.7, and 3.8.9 do not contain a discussion of chillers as a required subcomponent for operability. Instead, the licensee utilized guidance found in the bases for TS 3.0.6 as follows:

In some cases, the non-TS support system has two redundant 100 percent capacity subsystems, each capable of supporting both TS divisions (e.g.,

HVR-UC11A and B). Loss of one support subsystem does not result in a loss of support for either division of TS equipment. Both TS divisions remain operable, despite a loss of support function redundancy, because the TS definition of operability does not require a TS subsystems necessary support function to meet the single-failure design criterion. Thus, no TS limits the duration of the non-TS support subsystem outage, even though the single-failure design requirement of the supported TS systems is not met. However, by assessing and managing risk in accordance with 10 CFR 50.65(a)(4), an appropriate duration for the maintenance activity can be determined. Use of administrative controls to implement such a risk-informed limitation is an acceptable basis for also allowing a temporary departure from the design basis configuration during such maintenance. This allowance is permitted regardless of whether the maintenance is corrective or preventive.

The licensee added this discussion in the bases of TS 3.0.6 on September 30, 2010, and is based on a safety evaluation that had been issued by the NRC for the Perry Plant (ML020950074), dated April 5, 2002. The licensee evaluated the change via the 10 CFR 50.59 process and determined NRC approval did not need to be obtained because, this change merely provides clarification on existing guidance.

Pending further evaluation of the use of the Perry Plants safety evaluation by the licensee and subsequent review by NRC inspectors, this issue will be tracked as an unresolved item, URI 05000458/2015010-01, Technical Specification Allowed Outage Time During Loss of Non-Technical Specification Supported Systems. Further discussion of the URI is included in Section 2.2.b of this report.

The team then reviewed the licensees practices for assessing and managing risk, when removing HVK chillers from service, per 10 CFR 50.65(a)(4) and as described in the bases for TS 3.0.6. The River Bend Station utilizes a quantitative, level-1 probabilistic safety analysis (PSA) computer model named, Equipment Out of Service Monitor (EOOS). Licensee procedure ADM-0096, Risk Management Program Implementation and On-line Maintenance Risk Assessment, Revision 316, implements the requirements of 10 CFR 50.65(a)(4) and provides guidance on how and when to perform risk assessments using quantitative and qualitative tools.

Section 5.3 of procedure ADM-0096, Risk Assessment Overview, states the following regarding use of the EOOS computer model:

The Risk Assessment Program is a Risk-Informed Program, not a Risk Tool Based Program. This means that the quantitative results provided by the EOOS software must be blended with the qualitative guidance, in order to provide a complete risk picture of the situation. Decisions should never be made based on the EOOS quantitative results aloneQualitative factors (such as industry operating experience, personnel judgment, etc.) must also be used for fully assessing the effects of equipment out of service on plant risk.

The team noted that HVK chillers were modeled in EOOS and that the licensee would, using the computer program, disable the affected HVK chillers for a given maintenance period to yield a quantitative risk value.

The team then assessed the application of procedure ADM-0096 to specific work periods where multiple HVK chillers were removed from service simultaneously. For example, starting on December 15, 2014, the licensee removed HVK chillers 1A, 1B, and 1D from service for 41.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . During this work window, only the 1C chiller was available to provide cooling for both divisions of control room air conditioning, both divisions of AC switchgear, both divisions of DC switchgear, and both divisions of vital inverters. The licensee had assessed risk as 7.9 (Yellow) which included the quantitative tool (EOOS) and some qualitative factors for fire scenarios.

The team discovered that EOOS, however, did not model a control room heat-up scenario, such as during a loss of all HVK chillers event. The subsequent effects of failures of numerous control room components across multiple safety systems were, therefore, also not modeled due to the complexity of the event. The team reviewed procedure ADM-0096 for guidance on limitations of the PRA model and noted section 5.2.3 stated the following:

When the quantitative assessment tool is not available or the assessment scope is outside the scope of the EOOS risk monitor, qualitative assessments shall be performed.

The team also reviewed NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Revision 4A. Section 11.3.7.1 of NUMARC 93-01 discusses establishing action thresholds based on qualitative considerations.

This [qualitative] approach typically involves consideration of the following factors from the assessment:

Duration of out-of-service condition, with longer duration resulting in increased exposure time to initiating events

The number of remaining success paths (redundant systems, trains, operator actions, recovery actions) available to mitigate the initiating events The above factors can be used as the basis for establishment of a matrix or list of configurations and attendant risk management actions.

The team determined that the licensee did not consider the listed factors for qualitative assessments for a loss of control room cooling event. Specifically, the licensee did not establish a more limiting duration for placing control building chilled water system chillers in single-failure vulnerable configurations and, instead, relied upon the associated TS allowed outage time of 30 days. Further, the licensee did not consider the remaining success path, cross-connecting the HVK chillers with service water, and apply, as an example, just-in-time training or daily control room briefings on the procedure during single-failure vulnerable configurations with the potential to lose control room air conditioning.

The team noted that procedure ADM-0096 does not provide further guidance on how to qualitatively assess risk of a loss of all HVK cooling. Interestingly, attachment 7 of procedure ADM-0096 describes how to qualitatively assess and manage risk for removing non-TS auxiliary building cooling (HVR) due to EOOS limitations:

Auxiliary Building unit coolers HVR-UC11A(B) are non-Technical Specification equipment that provide cooling for safety-related equipment in the AB141 and AB170 locations. Each of these unit coolers are capable of providing the required cooling for both safety-related divisions. These unit coolers do not impact quantitative risk as determined using the EOOS risk monitor. To qualitatively address risk if HVR-UC11A(B) are unavailable, the following actions should be taken if one of HVR-UC11A(B) will be out of service[bulleted list of 13 actions].

Ultimately, the team determined that the licensee failed to adequately assess the risk of operating the control building chilled water system chillers in various single-failure vulnerable configurations. As a result of this deficiency, the station reduced the reliability and availability of systems contained in the main control room and failed to account for the significant, uncompensated impairment of the safety functions of the associated systems.

The licensee, in the example starting December 15, 2014, did not perform a qualitative risk assessment for a complete loss of control room cooling due to the inadequate procedural guidance in procedure ADM-0096. With an inadequate risk assessment of HVK system maintenance, the licensee did not appropriately determine the duration of the maintenance activity as described in the bases for TS 3.0.6.

To understand the exposure time for inadequate risk assessments, the team reviewed maintenance and TS data from control room logs. The team determined that the licensee operated in single-failure vulnerable configurations for the HVK system for 591 hours0.00684 days 0.164 hours 9.771825e-4 weeks 2.248755e-4 months over a 12 month period or approximately 6.7% of a year.

In response to the NRCs conclusions, the licensee initiated Condition Report CR-RBS-2016-00095. The licensee also contracted for an engineering analysis to credit alternate cooling methods, including cross-connecting service water and the HVK chiller systems, in order to cool vital electrical components and mitigate a loss of HVK event.

Analysis.

The team determined that the licensees failure to adequately assess the risk of operating the control building chilled water system chillers in various single-failure vulnerable configurations was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the configuration control attribute of the Mitigating Systems Cornerstone, and adversely affected the associated cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. As a result of this deficiency, the station reduced the reliability and availability of systems cooled by control building chilled water system chillers by not determining an appropriate duration of maintenance activities.

The team noted that, from section 7 of IMC 0612 Appendix E, Examples of Minor Issues, that discusses the Maintenance Rule, the performance deficiency is more than minor since the risk assessment failed to account for (at least qualitatively) the loss or significant, uncompensated impairment of a key operating or shutdown safety function.

Specifically, the licensees failure to account for a loss of all HVK cooling scenario, either quantitatively due to EOOS model limitations or qualitatively due to procedure inadequacies, represents a significant impairment to all systems associated with the main control room. A loss of cooling to the control room could lead to multiple systems exceeding their equipment qualification temperatures and lead to subsequent failures. A loss of cooling to the control room could also impact control room habitability. The team also reviewed NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Revision 4A. Section 11.3.7.1 of NUMARC 93-01 discusses establishing action thresholds based on qualitative considerations.

This [qualitative] approach typically involves consideration of the following factors from the assessment:

Duration of out-of-service condition, with longer duration resulting in increased exposure time to initiating events

The number of remaining success paths (redundant systems, trains, operator actions, recovery actions) available to mitigate the initiating events The above factors can be used as the basis for establishment of a matrix or list of configurations and attendant risk management actions.

The team determined that the licensee did not consider the listed factors for qualitative assessments for a loss of control room cooling event. This conclusion further supports the IMC 0612 Appendix E examples of more than minor performance deficiencies associated with the Maintenance Rule.

The finding was evaluated using Inspection Manual Chapter (IMC) 0609, Appendix K, Maintenance Risk Assessment and Risk Management Significance Determination Process. Using Inspection Manual Chapter 0609, Appendix K, the finding required additional internal NRC management review using risk insights where possible because the quantitative probabilistic risk assessment (PRA) tools are not well suited to analyze failures from control room heat-up events. Thus, the analyst evaluated the safety significance posed by the heat-up of components cooled by control building chilled water (HVK) chillers using Appendix K, Flowchart 1, Assessment of Risk Deficit, to the extent practical, with additional risk insights by internal NRC management review in accordance with Inspection Manual Chapter 0612, Power Reactor Inspection Reports.

In accordance with Step 4.1.2 of Appendix K, the analyst performed a detailed risk evaluation for the greater than green Flowchart 1 result. See attachment 3 of this report, Detailed Risk Evaluation, for further information. The detailed risk evaluation resulted in a preliminarily determination of White (low to moderate safety significance).

Because actions have been taken to initiate Condition Reports, to investigate and resolve the technical issues with the control building chilled water system chillers, and to provide guidance to operations personnel, the failure to adequately assess the increase in risk of operating the control building chilled water system chillers in various single-failure vulnerable configurations does not represent a continuing safety concern.

The team determined the most significant contributing cause of the licensee failing to adequately assess the increase in risk from proposed maintenance activities involved inadequate procedural guidance in procedure ADM-0096. This finding has a resources cross-cutting aspect within the human performance area because leaders failed to ensure that personnel, equipment, procedures, and other resources are available and adequate to support nuclear safety [H.1].

Enforcement.

10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, paragraph (a)(4), requires, in part, that before performing maintenance activities (including but not limited to surveillance, post-maintenance testing, and corrective and preventive maintenance) the licensee shall assess and manage the increase in risk that may result from the proposed maintenance activities. Contrary to the above, prior to March 30, 2015, before performing maintenance activities, the licensee failed to adequately assess the increase in risk that may result from proposed maintenance activities. Specifically, the risk assessment performed by the licensee for plant maintenance failed to account for certain safety significant structures, systems, and components that were concurrently out of service.

On multiple occasions, the licensee failed to adequately assess the risk of operating the control building chilled water system chillers in various single-failure vulnerable configurations. As a result of this deficiency, the station reduced the reliability and availability of systems contained in the main control room and failed to account for the significant, uncompensated impairment of the safety functions of the associated systems. In response to the NRCs conclusions, the licensee initiated Condition Report CR-RBS-2016-00095. The licensee also contracted for an engineering analysis to credit alternate cooling methods, including cross-connecting service water and the HVK chiller systems, in order to cool vital electrical components and mitigate a loss of a HVK event.

This is an apparent violation of 10 CFR 50.65(a)(4): AV 05000458/2015010-02, Failure to Adequately Assess Risk During Chiller Unavailability.

b. Failure to Identify and Correct Circuit Breaker Failure Mechanism

Introduction.

The team reviewed a Green, self-revealing non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Actions, for the licensees failure to promptly identify and correct a condition adverse to quality related to Masterpact circuit breakers. Specifically, the licensee did not promptly identify and correct a Masterpact breaker failure mechanism even though related industry operating experience (OE)existed. The station determined the failure mechanism caused nine breaker failures since 2007 and may have contributed to an additional six failures where the cause could not be conclusively determined.

Description.

The team reviewed the history of Masterpact circuit breaker failures at the River Bend Station, with a focus on relevant operating experience. Between 2007 and 2009, River Bend Station replaced all of their General Electric (GE) AKR circuit breakers with Nuclear Logistics Incorporated (NLI) Masterpact breakers.

As experienced by River Bend Station, the NLI Masterpact circuit breaker is vulnerable to an intermittent failure mechanism under certain scenarios. Generally, the control logic is set up such that the breaker is continuously receiving a close command when the breaker is in the closed position. This is known as a standing close signal. When the breaker later receives an open command, the breaker briefly experiences simultaneous open and close commands. This dual open and close signal activates the mechanical anti-pump feature. The anti-pump feature is designed to prevent a circuit breaker from rapidly changing state between an open and closed position due to a dual command.

Instead, the anti-pump feature causes the breaker to default to an open position for electrical safety by moving the close lever out of the way of the close coil plunger.

The associated failure mechanism, documented by Hope Creek starting in 2012, involves internal mechanical binding as the anti-pump feature engaged. NLIs Nonconformance Report NCR-573 best describes the failure mechanism as follows:

The plant logic scheme which allows a standing close signal was determined to be the root cause. The pressure from the anti-pump latch pushing on the close coil plunger (down when energized) caused the rear of the lever to rock up in the back, and would intermittently catch on the top frame of the mechanism. Any mechanism vibration could allow the anti-pump lever to reset properly.

Overall, River Bend Station has experienced nine Masterpact breaker failures where the cause involved the standing close signal. The number may be higher because the causes were not conclusively determined for other Masterpact breaker failures.

The table below summarizes the timeline for the relevant condition reports, the operating experience for Masterpact breaker failures from internal binding, and when the licensee had the material available for review.

Date Originator Description River Bend Reviewed 3/21/2007 River Bend Failure of breaker to close for control building Yes CR-RBS-2007-0721 chiller (HVK) 1C after initial breaker installation.

Cause was indeterminate at the time. Evaluation in 2015 lists the standing close signal as a possible cause.

1/7/2008 River Bend Failure of breaker to close for HVK chiller 1A Yes CR-RBS-2008-0103 during divisional swap of running chillers. Cause was indeterminate at the time. Evaluation in 2015 lists the standing close signal as a possible cause.

9/12/2008 River Bend Failure of breaker to close for HVK chiller 1D Yes CR-RBS-2008-5397 during divisional swap of running chillers. Cause was indeterminate at the time. Evaluation in 2015 lists the standing close signal as a possible cause.

6/18/2010 River Bend Failure of breaker to close for containment cooler Yes Review of OE 31842 1B during divisional swap. Sent breaker to NLI Review of OE 243841 and identified internal binding during anti-pump mode. Sluggish response from a degraded relay also contributed.

4/10/2012 Hope Creek Failure of a breaker to close for a diesel room Yes, reviewed Review of OE 306166 fan. Cause was a failure to address a design 9/29/2013 by discrepancy between GE AKR breakers and NLI system Masterpact breaker control circuitry.

engineer.

9/15/2012 NLI Vendor analysis of the failure of Hope Creek No, NCR-440 Masterpact breakers described in OE 306166.

communicated Failure Analysis Cause was due to control logic allowing dual from NLI to FA-04215193-1 open and close signals via relays. These dual Hope Creek signals caused the anti-pump feature to engage only.

Hope Creek Update and led to internal binding. NLI stated they Review of OE 306166 would issue a technical bulletin to Masterpact users, but River Bend did not receive a bulletin.

2/17/2013 River Bend Failure of breaker to close for HVK chiller 1A Yes CR-RBS-2013-1058 during integrated emergency core cooling system (ECCS) testing. Cause was indeterminate at the time. Evaluation in 2015 lists the standing close signal as a possible cause.

3/3/2013 River Bend Failure of breaker to close for HVK chiller 1D Yes CR-RBS-2013-1871 during integrated ECCS testing. Cause was indeterminate at the time. Evaluation in 2015 lists the standing close signal as a possible cause.

9/9/2013 Hope Creek Failure of breaker to close for a stator water No. Although Review of OE 308489 cooling pump. Cause was determined to be the OE was similar to previous Masterpact breaker failures downloaded experienced at Hope Creek.

by the licensee, it was never reviewed.

7/25/2014 River Bend Failure of breaker to close for control building air Yes CR-RBS-2014-3651 handling unit (ACU) 1A during post-modification (analog to digital controls) testing. Cause was initially thought to be closing coil malfunction but later determined to be due to the standing close signal.

7/25/2014 River Bend Failure of breaker to close for ACU 2A during Yes CR-RBS-2014-3651 post-modification (analog to digital controls)testing. Cause was initially thought to be closing coil malfunction but later determined to be due to the standing close signal.

7/28/2014 River Bend Failure of breaker to close for ACU 1A during Yes No CR post-modification (analog to digital controls)testing. Cause was initially thought to be closing coil malfunction but later determined to be due to the standing close signal.

7/28/2014 River Bend Failure of breaker to close for ACU 1B during Yes No CR post-modification (analog to digital controls)testing. Cause was initially thought to be closing coil malfunction but later determined to be due to the standing close signal.

7/30/2014 River Bend Failure of breaker to close for ACU 2A during Yes CR-RBS-2014-3714 post-modification (analog to digital controls)testing. Cause was initially thought to be closing coil malfunction but later determined to be due to the standing close signal.

7/30/2014 River Bend Failure of breaker to close for ACU 2A during Yes CR-RBS-2014-3779 post-modification (analog to digital controls)testing. Cause was initially thought to be closing coil malfunction but later determined to be due to the standing close signal.

8/2/2014 River Bend Failure of breaker to close for ACU 1A during Yes CR-RBS-2014-3779 post-modification (analog to digital controls)

Review of OE 313038 testing. Cause was initially thought to be closing coil malfunction but later determined to be due to the standing close signal. Affected breakers sent to NLI for failure mode analysis.

9/6/2014 NLI Vendor analysis of the failure of Hope Creek No, NCR-573 Masterpact breakers described in OE 308489.

communicated Failure Analysis Cause was due to the breaker logic control from NLI to FA-042-351021500-1 scheme allowing a standing close signal that Hope Creek caused internal binding. NLI noted that this is only.

the same issue as documented in NCR-440.

12/9/2014 NLI NLI Provided NCR-573 to River Bend Station as Yes NCR-573 preliminary thoughts on the ongoing failure mode analysis. Upon receiving this information, River River Bend Bend Station initiated a condition report to CR-RBS-2014-6284 assess operability of components utilizing Masterpact breakers.

3/9/2015 River Bend Failure of breaker to close for HVK chiller 1C Yes CR-RBS-2015-1829 during integrated ECCS testing. Cause was the standing close signal.

3/10/2015 River Bend Failure of breaker to close for HVK chiller 1C Yes CR-RBS-2015-1858 during integrated ECCS testing. Cause was the standing close signal.

3/23/2015 River Bend All Masterpact circuit breakers modified to N/A remove the standing close signal and therefore preclude the internal binding failure mode from occurring again.

Licensee procedure EN-OE-100, Operating Experience Program, Revision 23, defines the required reviews and actions when an Entergy plant receives OE. Step 5.2[2](b)discusses the criteria used to determine the potential impact of OE on a station. This would include similar equipment, although not necessarily used in the same application; or when a similar design exists (if design is determined to be a main contributor to the issue); or if a similar event has already been experienced. Step 5.2[3](h) requires vendor documents to be screened as A1, the highest level of review, if the document is applicable to an Entergy site. Step 5.2[3](j) requires all OE for circuit breakers to be screened as A2 or B1 priority for engineering review.

The team determined the licensee missed two opportunities to identify and correct the Masterpact circuit breaker internal binding failure mechanism prior to December 2014.

In both cases, engineering personnel did not follow the guidance of the licensees procedure EN-OE-100.

The first example involved the failures at Hope Creek in 2012, which were communicated to the industry in OE 306166. Although the circuit breaker system engineer at the River Bend Station reviewed the operating experience, the response document stated these breakers have been in service for five years. RBS have [sic] not experienced this condition. This OE, as reviewed by the licensee, discussed the cause as a failure to recognize a design discrepancy that can yield a dual open/close signal to the breaker. The apparent cause evaluation performed by Hope Creek, as reviewed by the River Bend Station, discussed the failure mechanism in detail:

The potential failure mechanism of the breaker trip/close latch getting caught by the close coil or trip coil plunger while the breaker is in an indeterminate state is identified as the cause of the failure.NLI and Square D testing confirmed that the trip/close latch can become jammed when the close coil is de-energized at approximately the same time as the shunt trip coil is energized Further, the team noted that the River Bend Station itself had experienced a similar failure on June 18, 2010, as documented in OE 38142 and OE 243841. In this case, a containment unit cooler failed to start, and the cause involved internal binding during engagement of the anti-pump feature combined with a sluggish relay response. The containment unit coolers did not have the standing close signal normally applied.

Instead, the slow response of the relay enabled the conditions of dual open/close signal and contributed to the internal binding failure. Although not identical to the failure in OE 306166, the team determined that the licensee did not fully assess the aggregate of internal and external OE.

The second example involved the failures at Hope Creek in 2013, which were communicated to the industry in OE 308489. In this case, River Bend Station had downloaded the OE from the industry database but never reviewed the material. When the team asked about the requirement to review all circuit breaker OE per procedure EN-OE-100, the licensee stated that the OE did not require review since it had not been flagged as significant in the industry database. The licensees explanation differed from steps 5.2[2](b) and 5.2[3](j) of the licensees operating experience procedure. Since OE 308489 discussed similar failures to OE 306166, this failure to review OE represented a second missed opportunity for the licensee to identify their vulnerable design.

Although River Bend Station became aware of the failure mechanism in December 2014, they elected to schedule the corrective action (modification to standing close signal) for June 2015, after the refueling outage in February and March 2015. As a result of this deferral, they experienced further failures in February and March, which caused the licensee to move-up the circuit modification date to within the refueling outage.

The team noted that the licensee correctly initiated a CR to review the NLI NCRs and relevant OE when provided by NLI in December 2014. The team also acknowledges that NLI did not distribute a vendor notice to River Bend Station as they described in NCR-400. This observation was discussed with the NRCs Vendor Inspection Branch.

In response to the NRCs conclusions, the licensee initiated Condition Report CR-RBS-2015-03951. Further, the licensee modified all vulnerable Masterpact circuit breakers to remove this failure mechanism.

Analysis.

The failure to promptly identify and correct an adverse condition to quality associated with Masterpact breakers was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the licensees untimely corrective action contributed to additional failures of Masterpact circuit breakers and decreased the reliability of Masterpact circuit breakers to respond during design basis events. The team performed an initial screening of the finding in accordance with NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. Using Inspection Manual Chapter 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions, the finding was of very low safety significance (Green) because it:

(1) was not a deficiency affecting the design or qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality;

(2) did not represent a loss of system and/or function;

(3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and

(4) did not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program.

This finding has an operating experience cross-cutting aspect within the problem identification and resolution area because the licensee failed to systematically and effectively collect, evaluate, and implement relevant internal and external operating experience in a timely manner [P.5].

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that measures shall be established to assure that conditions adverse to quality are promptly identified and corrected. Contrary to the above, prior to December 9, 2014, the licensee failed to assure that a condition adverse to quality was promptly identified and corrected. Specifically, although industry operating experience existed on design problems and failure mechanisms associated with Masterpact circuit breakers anti-pump feature, the licensee did not identify and correct their deficient design in a timely manner. The licensee restored compliance by completing a design modification to eliminate the failure mechanism and initiated Condition Report CR-RBS-2015-03951.

Because the finding is of very low safety significance (Green) and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000458/2015010-03, Failure to Identify and Correct Circuit Breaker Failure Mechanism.

c. Failure to Accomplish an Operability Determination In Accordance With Procedures

Introduction.

The team identified a Green, non-cited violation of 10 CFR Part 50 Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the licensees failure to accomplish an operability determination in accordance with procedure EN-OP-104, Operability Determination Process, Revision 8. Specifically, the licensee referenced non-conservative data, contrary to steps 5.5 and 5.11 of procedure EN-OP-104, when assessing the reduced reliability of Masterpact circuit breakers as a degraded or nonconforming condition.

Description.

The team reviewed an operability determination associated with Condition Report CR-RBS-2014-6284, initiated on December 9, 2014. This condition report documented the vulnerability of Masterpact circuit breakers to experience mechanical binding when the anti-pump feature engaged. See Section 2.6.b of this report for a further discussion of the failure mechanism.

The licensee concluded that the Masterpact breakers, which were experiencing intermittent failures to operate, were operable as follows:

The River Bend [Station] specific failure rate is 8.24E-3 (23 failures/2790 demands) or 0.82%. The industry failure rate (generic mean demand failure probability) documented in NUREG/CR-6928 and Entergy report PRAES-01-003 for a circuit breaker failing to close or failing to open on demand is 2.5E-03/demand or 0.25%. The industry failure rate is based on the failure mode of fail to operate for all circuit breakers and includes all failure mechanisms contributing to the total number of failures per total number of demands for operation.

The RBS failure analysis of the eight breakers susceptible to the failure mode during normal plant operations showed the failure rate was 0.82%. This represents a small reduction in breaker reliability compared to the overall industry failure rate of 0.25%. However, the increased failure rate is comparable to and bounded by other components listed in NUREG/CR-6928 (for instance, the failure rate for a chiller start is 1.0E-2 or 1%). Engineering concludes that the overall failure rate remains low and that the probability of multiple concurrent failures impacting redundant safety trains is low, so the ability of the impacted systems to perform their safety functions is still maintained. Any additional failures of these Masterpact breakers will be evaluated for impact on reliability.

The reduction in reliability introduced by this failure mechanism is acceptable for plant operation. The reduction in reliability does not challenge the ability of the HVC, HVK, and SGTS systems to perform their safety functions in all applicable modes of operation. As a result, the HVC, HVK, and SGTS systems meet the requirements for an operable-degraded nonconforming condition. However, a simple Operator performed Compensatory Action was assigned as an enhancement, to reduce the likelihood of a breaker malfunction of this type during Modes 1, 2 and 3. Based on this Operability Evaluation, the affected Masterpact breakers for the HVC, HVK, and SGTS systems are recommended to be designated Operable-Comp Measures.

Standing Order 298 documented the enhancement, as defined by the licensee. The enhancement involved operators manually resetting Masterpact breakers when they were tripped. This action, per vendor guidance, released any internal binding that may have occurred prior to the next close command.

The licensee, when questioned, stated that the standing order did not provide the basis for operability and they did not consider the action as a compensatory measure to enhance or maintain operability. Instead, the licensee stated, because of the small reduction in reliability for Masterpact breakers, the SSCs were operable but degraded/nonconforming. The licensee explicitly stated that the standing order improved reliability for an already operable SSC.

The team challenged this operability determination and noted that the licensees operability procedure incorporated guidance found in NRC Inspection Manual Chapter (IMC) 0326, Operability Determinations and Functionality Assessments for Conditions Adverse to Quality or Safety, revised January 31, 2014. Mirroring the guidance of IMC 0326 section B.04, Reduced Reliability as a Degraded or Nonconforming Condition, licensee procedure EN-OP-104 step 5.11[12] states:

When an SSC experiences multiple failures, especially repetitive failures (i.e.

failures for the same or similar cause) such as those addressed in licensees maintenance rule programs, and when the failures exceed the number of expected failures based on operating experience, the reliability of the affected SSC is reduced.

An SSC that has been identified as having reduced reliability should be considered Degraded or Nonconforming and should be evaluated to determine whether the SSC is OPERABLE.When an SSCs capability or reliability is degraded to the point where there is no longer a Reasonable Expectation that it can perform its Specified Safety Function, the SSC should be judged INOPERABLE.

The licensee and the inspection team noted that there is no specific, numerical guidance on an allowable failure rate or increase in failure rate to justify operability for a system experiencing reduced reliability.

Step 5.5[4] of procedure EN-OP-104 requires action to collect information and define the condition associated with the operability evaluation, including determining the failure mechanism. Step 5.5[6] describes the required evaluation of the capability of a system including the magnitude of the degraded or nonconforming condition. Step 5.5[7]

describes the process to make a recommendation on operability status, including determining if a SSC should be considered inoperable. Step 5.11[12] describes the process for evaluating reduced reliability as a degraded/nonconforming condition.

Ultimately, the team determined that the licensee used non-conservative data to generate their Masterpact breaker failure rate of 0.82%. This directly led to a failure of the licensee to properly assess and document the basis for operability per their procedures.

The team obtained the Masterpact breaker failure data and noted the 0.82% failure rate determined by the licensee used the following assumptions. First, only the eight safety-related Masterpact breakers subject to a standing close signal were included. Next, all demands for those breakers to open or close were counted. Lastly, the licensee compared the number of failures to open or close to the total demands (23 failures/2790 demands) to arrive at a failure rate of 0.82%. The inspectors noted that the breaker failures included any type of failure, such as problems with relays, fuses, breaker cubicle interlocks, and internal binding.

When the team independently reviewed the relevant vendor documents and industry operating experience, they noted that the Masterpact internal binding failure mechanism manifests itself only when the breaker is commanded to close. That is, the internal binding failure mechanism does not prevent a breaker from opening. Instead, the act of opening a breaker subject to the failure mechanism enables the internal binding to occur, such that the subsequent close command may result in a failure. The team reviewed the 2790 demands at River Bend Station as documented in Condition Report CR-RBS-2014-6284 from December 9, 2014, and noted the following:

Failure to Close: 23 failures/1395 demands = 1.65% failure rate Failure to Open: 0 failures/1395 demands = 0% failure rate If data is included through March 10, 2015, then additional failures are incorporated for a total of 29 failures against total of 2972 demands, resulting in the following failure rates:

Failure to Close: 27 failures/1486 demands = 1.82% failure rate Failure to Open: 2 failures/1486 demands = 0.14% failure rate The team determined that, by including commands to open as demands, the licensee diluted the failure rate as discussed in all relevant documents for the Masterpact circuit breaker internal binding failure mechanism during anti-pump mode. Of note, the highest failure rate discussed in the licensees operability determination as examples of other equipment failure rates was 1%. The team determined that this operability determination, as written, would not justify a reduced reliability argument for operability at the 1.65% failure rate for closing Masterpact breakers.

The scenario of concern involves design basis accidents with a concurrent loss of offsite power. Safety-related Masterpact breakers would be required to rapidly load-shed from the electrical bus and then later re-sequence back onto the bus as a load after the diesel generators were started. This process would set up the conditions for the internal binding failure mode to occur for the vulnerable Masterpact breakers.

The team reviewed the actions prescribed by the licensees standing order and determined the guidance would have been adequate to serve as a compensatory action to maintain operability. Specifically, the post-accident loads of concern that are powered by Masterpact breakers are the standby gas treatment system (SGTS) and the HVC/HVK system. The team noted that the STGS is not credited for accident mitigation until 20 minutes after the accident per calculation G13.18.9.5*061, Alternate Source Term LOCA Off-Site and Control Room Dose

Analysis.

Further, the HVC/HVK system is not required to initiate for 30 minutes per abnormal operating procedure AOP-0060, Loss of Control Building Ventilation, Revision 9, and associated calculation G.13.18.12.3*161, Standby Switchgear Room Temperatures Following Loss of Offsite Power and Loss of HVAC. Of note, the licensee initially stationed operators at the affected Masterpact breakers to maintain operability on December 9, 2014, and this requirement was later relaxed, following development of the reliability-based operability determination.

The licensee restored compliance by completing a design modification to eliminate the failure mechanism and initiated Condition Report CR-RBS-2015-03952.

Analysis.

The failure to accomplish an operability determination in accordance with operability procedure EN-OP-104, Operability Determination Process, Revision 8, was a performance deficiency. Specifically, contrary to section 5.5, Operability Evaluation, and section 5.11[12], Reduced Reliability as a Degraded or Nonconforming Condition, the licensee referenced non-conservative data when assessing the reduced reliability of Masterpact circuit breakers. This performance deficiency is more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the reliability of components powered by Masterpact circuit breakers was reduced and, by justifying operability using non-conservative data, the licensee did not recognize the actual unreliability. The team performed an initial screening of the finding in accordance with NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. Using Inspection Manual Chapter 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions, the finding was of very low safety significance (Green)because it:

(1) was not a deficiency affecting the design or qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality;

(2) did not represent a loss of system and/or function;

(3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and

(4) did not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program.

This finding has a conservative bias cross-cutting aspect within the human performance area because the licensee failed to use decision-making practices that emphasize prudent choices over those that are simply allowable. Specifically, the licensee did not consider that the failure mechanism only occurs on a close command. Instead, the licensee included opening commands when summing the total demands, and this resulted in a non-conservative failure rate [H.14].

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Quality related station procedure EN-OP-104, Operability Determination Process, Revision 8, steps 5.5 and 5.11[12] require the licensee to properly assess and document the basis for operability. Contrary to the above, from December 9, 2014, to March 10, 2015, the licensee failed to properly assess and document the basis for operability. Specifically, the licensee referenced non-conservative data when assessing the reduced reliability of Masterpact circuit breakers as a degraded or nonconforming condition. The licensee restored compliance by completing a design modification to eliminate the failure mode and initiated Condition Report CR-RBS-2015-03952. Because the finding is of very low safety significance (Green) and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000458/2015010-04, Failure to Accomplish an Operability Determination In Accordance With Procedures.

d. Failure to Identify and Correct an Adverse Condition in a Timely Manner

Introduction.

The team identified a Green finding for the licensees failure to identify and correct an adverse condition in a timely manner as required by plant procedures.

Specifically, the licensee did not recognize degrading trends associated with incorrect racking of Magne Blast circuit breakers and failures of the Magne Blast circuit breaker for Reactor Feed Water Pump Motor 1B in a timely manner. For both cases, the licensee failed to initiate corrective action in a timely manner as required by procedure EN-LI-102, Corrective Action Program, Revision 24.

Description.

The team reviewed the history of Magne Blast circuit breaker failures at the River Bend Station, with a focus on repetitive failures. Of note, the licensee experienced eight failure-to-close issues for Reactor Feed Water Pump Motor 1B (FWS-P1B) circuit breaker over a 19 month period. The reactor feed water system provides normal makeup water for the reactor during power operations and can also provide makeup water for certain emergency scenarios.

Additionally, the licensee has experienced nine issues related to improper racking of Magne Blast circuit breakers over a five year period. The racking process involves orienting the circuit breaker correctly in the housing such that all internal components are fully engaged and the circuit breaker can fully perform its function. If a circuit breaker is improperly racked, it may experience intermittent faults, trip prematurely, or not close at all.

The table below summarizes, for the past five years, all of the occasions where FWS-P1B failed to close and where, for any Magne Blast breaker, improper racking issues were identified during corrective action.

Date Description Condition FWS-P1B Improper Report Failed to Racking of start Circuit CR-RBS- Breaker Identified 2/9/2011 FWS-P1A would not fully rack 2011-2090 No Yes in after maintenance 2/9/2011 FWS-P1C would not fully rack 2011-2089 No Yes in after maintenance 6/20/2013 FWS-P1B failed to start 2013-4402 Yes Yes during plant startup due to 2013-4428 racking 6/21/2013 FWS-P1B failed to start 2013-4419 Yes No during plant startup due to closing coil failure 6/21/2013 FWS-P1B failed to start 2013-4428 Yes No during plant startup. A subsequent attempt was successful 6/21/2013 FWS-P1C would not fully rack 2013-4431 No Yes in after maintenance 10/31/2013 FWS-P1B failed to start due 2013-6860 Yes No to failure of electrical contacts 4/1/2014 13.1 kV feeder breaker to 2014-1586 No Yes 2F/2H/3B switchgear could not be fully racked in 6/17/2014 Make-up water structure 2015-2940 No Yes transformer supply breaker failed to close due to racking 12/12/2014 FWS-P1B failed to start due 2014-6350 Yes Yes to racking 12/25/2014 FWS-P1C failed to start after 2014-6601 No Yes a reactor trip due to racking 12/28/2014 FWS-P1B failed to start due 2014-6649 Yes Yes to racking 12/31/2014 FWS-P1B failed to start due 2014-6691 Yes No to failure of electrical contacts 2014-6696 2014-6699 1/31/2015 FWS-P1B failed to start, 2015-0667 Yes No breaker was removed and sent to vendor for failure modes analysis Licensee procedure EN-LI-102, Corrective Action Program, Revision 24, defines adverse trend as a negative change in performance data that knowledge, experience, and judgement indicate is unacceptable because of the adverse impact on safety or reliability. Step 5.2[3](f)(5) requires the initiator of a condition report to include any pertinent trend information. The licensees Condition Review Group (CRG) is required to review condition reports (CRs) for adverse trends per step 5.4[6](e) of procedure EN-LI-102. Attachment 9.1 of that procedure specifies repetitive equipment failures should be classified category B, which yields an elevated cause determination process via an apparent cause evaluation. Lastly, step 5.6[2](m)(2) of that procedure requires, in part, that corrective actions for adverse conditions be specific, measurable, and timely to address the issue.

The team noted that the licensee correctly initiated a CR for each failure-to-start for the FWS-P1B breaker. The aggregate of those CRs, however, were not assessed for an adverse trend until December 31, 2014, under Condition Report CR-RBS-2014-6696. At this point in time, there had been a total of seven failures in a 19 month period, including four failures within the previous 20 days.

Likewise, the team noted that the licensee correctly initiated a CR for each time a circuit breaker racking problem was identified during corrective action or troubleshooting. The aggregate of those CRs, however, were never identified specifically as an adverse trend by the licensee and entered into the corrective action program. The licensee did establish Standing Order 299 on December 26, 2014, as a corrective action under Condition Report CR-RBS-2014-6601 to ensure electrical maintenance personnel were present for circuit breaker racking. This standing order served as an enhancement of their circuit breaker racking process until the governing procedure could be updated. At this point in time, there had been a total of eight problems related to racking of circuit breakers in a five year period.

The team determined that the licensee did not follow procedure EN-LI-102 to identify adverse trends and correct the adverse conditions in a timely manner. In response to the NRCs conclusions, the licensee updated circuit breaker procedures, replaced the Magne Blast circuit breaker for the Reactor Feed Water Pump Motor 1B, and initiated Condition Reports CR-RBS-2015-04259 and CR-RBS-2015-03437.

Analysis.

The failure to identify and correct an adverse condition in a timely manner, as required by procedure EN-LI-102, was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the licensees untimely corrective action contributed to the unreliability of the Magne Blast circuit breaker for Reactor Feed Water Pump Motor 1B and increased the potential for spurious trips of other Magne Blast circuit breakers during design basis events due to improper racking. The team performed an initial screening of the finding in accordance with NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. Using Inspection Manual Chapter 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions, the finding was of very low safety significance (Green) because it:

(1) was not a deficiency affecting the design or qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality;

(2) did not represent a loss of system and/or function;

(3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and

(4) did not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program.

This finding has an avoid complacency cross-cutting aspect within the human performance area because the licensee failed to recognize and plan for the possibility of mistakes, latent issues, and inherent risk, even while expecting successful outcomes.

Specifically, the licensee tolerated the adverse trends, did not plan for further degradation, and the latent conditions ultimately resulted in several Magne Blast circuit breaker failures in December 2014 before the trend was recognized [H.12].

Enforcement.

This finding does not involve enforcement action because no violation of a regulatory requirement was identified. This issue was entered into the licensees corrective action program as Condition Reports CR-RBS-2015-04259 and CR-RBS-2015-03437. Because this finding does not involve a violation and is of very low safety significance, it is identified as FIN 05000458/2015010-05, Failure to Identify and Correct an Adverse Condition in a Timely Manner.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On April 2, 2015, the team debriefed Mr. E. Olsen, Site Vice President, and other members of the licensee's staff following the onsite portion of the inspection. The licensee representatives acknowledged the findings presented.

On January 19, 2016, the team debriefed Mr. E. Olsen, Site Vice President, and other members of the licensee's staff. The licensee representatives acknowledged the findings presented.

On January 20, 2016, the team conducted an exit with Mr. D. Burnett, Acting Director, Regulatory and Performance Improvement, and other members of the licensee's staff. The licensee representatives acknowledged the findings presented. The team asked the licensee whether any materials examined during the inspection should be considered proprietary and none were identified.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

E. Olson, Site Vice President

D. Burnett, Acting Director, Regulatory & Performance Improvement

J. Clark, Manager, Regulatory Assurance

F. Corley, Manager, Design & Program Engineering

T. Creekbaum, Engineer

R. Gadbois, General Manager, Plant Operations

T. Gates, Manager, Operations Support

K. Huffstatler, Senior Licensing Engineer, Licensing

K. Jelks, Engineering Supervisor

P. Lucky, Manger, Performance Improvement

J. Maher, Manager, Systems & Components Engineering

W. Mashburn, Director, Engineering

J. Reynolds, Senior Manager, Operations

P. Sicard, PRA Engineer

S. Vazquez, Director, Engineering

T. Venable, Manager, Operations

NRC Personnel

G. Warnick, Branch Chief

J. Sowa, Senior Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000458/2015010-01 URI Technical Specification Allowed Outage Time During Loss of Non-Technical Specification Supported Systems (Section 2.2.b)

05000458/2015010-02 AV Failure to Adequately Assess Risk During Chiller Unavailability (Section 2.6.a)

Attachment 1

Opened and Closed

05000458/2015010-03 NCV Failure to Identify and Correct Circuit Breaker Failure Mechanism (Section 2.6.b)

05000458/2015010-04 NCV Failure to Accomplish an Operability Determination In Accordance With Procedures (Section 2.6.c)

05000458/2015010-05 FIN Failure to Identify and Correct an Adverse Condition in a Timely Manner (Section 2.6.d)

Closed

05000458/2015009-01 URI Vendor and Industry Recommended Testing Adequacy on Safety-related and Safety-significant Circuit Breakers (Section 2.4.c)

LIST OF DOCUMENTS REVIEWED

IR 05000458/2015010

Text

SUBJECT:

Dear Mr. Olson:

Enclosure:

SUMMARY OF FINDINGS

Cornerstone: Mitigating Systems

REPORT DETAILS

1. Basis for Special Inspection

2. Inspection Results

a. Inspection Scope

b. Findings and Observations

a. Inspection Scope

b. Findings and Observations

Introduction.

Description.

a. Inspection Scope

b. Findings and Observations

a. Inspection Scope

b. Findings and Observations

a. Inspection Scope

b. Findings and Observations

Introduction.

Description.

Analysis.

Enforcement.

Introduction.

Description.

Analysis.

Enforcement.

Introduction.

Description.

Analysis.

Analysis.

Enforcement.

Introduction.

Description.

Analysis.

Enforcement.

4OA6 Meetings, Including Exit

Exit Meeting Summary

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

NRC Personnel

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

Opened and Closed

Closed

LIST OF DOCUMENTS REVIEWED

Navigation menu

Search