IR 05000461/2017009
| ML17226A321 | |
| Person / Time | |
|---|---|
| Site: | Clinton  |
| Issue date: | 08/14/2017 |
| From: | Louden P Division Reactor Projects III |
| To: | Bryan Hanson Exelon Generation Co |
| References | |
| EA-17-098 IR 2017009 | |
| Download: ML17226A321 (16) | |
Text
B.
UNITED STATES ust 14, 2017
SUBJECT:
CLINTON POWER STATIONNRC INSPECTION REPORT 05000461/2017009 AND PRELIMINARY WHITE FINDING
Dear Mr. Hanson:
On August 3, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Clinton Power Station, Unit 1. The inspectors presented the results of this inspection during an exit meeting with Mr. B. Kapellas and other members of your staff. The results of this inspection are documented in the enclosed report.
The enclosed inspection report documents a self-revealed finding with an associated apparent violation that the NRC has preliminarily determined to be White, with low to moderate safety significance of Title 10 Code of Federal Regulations (CFR) 50, Appendix B, Criterion III, Design Control and an associated Technical Specification (TS) violation of TS 3.8.1, AC Sources-Operating. This finding involved the licensees failure to evaluate the change in the actual drop out voltages for replacement relays associated with the Division 1 Emergency Diesel Generator (EDG) Room Vent Fan, which was a component subject to the requirements of 10 CFR Part 50, Appendix B. The change in drop out voltages prevented the fan from operating during an under voltage condition, resulting in the Division 1 EDG being unable to perform its intended safety function and becoming inoperable. We assessed the significance of the finding using the significance determination process (SDP) and readily available information. We are considering escalated enforcement for the apparent violation consistent with the NRCs Enforcement Policy, which can be found at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html.
Because we have not made a final determination, no notice of violation is being issued at this time. Please be aware that further NRC review may prompt us to modify the number and characterization of the apparent violation(s). This finding does not represent an immediate safety concern based upon the licensees actions to restore the Division 1 EDG room vent fan to the original design and declaring the Division 1 EDG operable.
We intend to issue our final significance determination and enforcement decision, in writing, within 90 days from the date of this letter. The NRCs SDP is designed to encourage an open dialogue between your staff and the NRC; however, neither the dialogue nor the written information you provide should affect the timeliness of the staffs final determination. Before the NRC makes a final decision on this matter, you may choose to communicate your position on the facts and assumptions used to arrive at the finding and assess its significance by either; (1) attending and presenting at a Regulatory Conference, or (2) submitting your position in writing. The focus of a Regulatory Conference is to discuss the significance of the finding.
Written responses should reference the inspection report number and enforcement action number associated with this letter in the subject line. Your written response should be sent to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Center, Washington, DC 20555-0001, with a copy to Ms. Karla Stoedter, Chief, Branch 1, Division of Reactor Projects, U.S. Nuclear Regulatory Commission, Region III, 2443 Warrenville Road, Lisle, IL 60532.
If you request a Regulatory Conference, it should be held within 40 days of the receipt of this letter. Please provide information you would like us to consider or discuss with you at least 10 days prior to any scheduled conference. If a Regulatory Conference is held, it will be open for public observation. If you decide to submit only a written response, such submittal should be sent to the NRC within 40 days of your receipt of this letter. If you choose not to request a Regulatory Conference or to submit a written response, you will not be allowed to appeal the NRCs final significance determination.
Please contact Ms. Karla Stoedter at 630-829-9731, and in writing, within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision.
The final resolution of this matter will be conveyed in separate correspondence.
This letter, its enclosure, and your response (if any) will be made available for public inspections and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document room in accordance with 10 CFR 2.930, Public Inspections, Exemptions, Requests for Withholding.
Sincerely,
/RA Julio F. Lara Acting for/
Patrick L. Louden, Director Division of Reactor Projects Docket No. 50-461 License No. NPF-62 Enclosure:
Inspection Report 05000461/2017009 cc: Distribution via LISTSERV
SUMMARY
Inspection Report 05000461/2017009; 03/07/2017 - 08/03/2017; Clinton Power Station; Unit 1,
Operability Determinations and Functionality Assessments.
The enclosed inspection report documents a finding that has preliminarily been determined to be White, a finding with low to moderate safety significance, that may require additional U.S. Nuclear Regulatory Commission (NRC) inspections, regulatory actions, and oversight, with an associated violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, and Technical Specification (TS) 3.8.1, AC Sources-Operating. The significance of inspection findings is indicated by their color (i.e., greater than Green or Green, White, Yellow, Red) and determined using Inspection Manual Chapter (IMC) 0609, Significance Determination Process, dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310, Aspects Within the Cross-Cutting Areas, dated December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated November 1, 2016. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, dated July 201
NRC-Identified
and Self-Revealed Findings
Cornerstone: Mitigating Systems
Preliminary
- White.
A self-revealed finding preliminarily determined to be of low to moderate safety significance, and an associated apparent violation of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion III, Design Control, was identified on March 9, 2017, for the licensees failure to implement measures for the selection and review for suitability of application replacement relays for the Division 1 Emergency Diesel Generator (EDG) Room Vent Fan, which were components subject to the requirements of 10 CFR Part 50, Appendix B. Specifically,
Engineering Changes 330624 and 366624 failed to evaluate the change in the actual drop out voltages for replacement relays on the associated fan circuitry, and instead, introduced new relays into the circuit that resulted in the failure of the fan to operate during an under voltage condition. This rendered the Division 1 EDG inoperable for a time longer than its technical specification allowed outage time, which was a violation of Technical Specification 3.8.1, AC Sources-Operating. The licensee entered this issue into the corrective action program as action request (AR) 03982792. Corrective actions for this issue included restoring the circuit to allow the ventilation fan to operate and returning the emergency diesel generator to an operable condition.
The inspectors determined that the licensees failure to verify the suitability of the replacement relays for the Division 1 EDG room vent fan was contrary to the requirements of 10 CFR Part 50, Appendix B, Criterion III and a performance deficiency which was within the licensees ability to foresee and correct. The performance deficiency was determined to be more than minor because it was associated with the design control attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of the systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to verify the suitability of the replacement relays prior to installation in the Division 1 EDG room vent fan circuitry resulted in the inoperability and unavailability of the Division 1 EDG from May 18, 2016 to March 11, 2017, when one of the unsuitable relays was replaced. Using IMC 0609, Appendix A, Significance Determination Process for
Findings At-Power, dated June 19, 2012, a Significance and Enforcement Review Panel preliminarily determined the finding to be of low to moderate safety significance. The inspectors determined that this finding affected the cross-cutting area of human performance in the aspect of challenge the unknown, where individuals stop when faced with uncertain conditions. Risks are evaluated and managed before proceeding.
Specifically, a questioning attitude was not used to understand the consequence of the differences in relay features resulting with installing a relay that was incompatible with the current design. [H.11] (Section 1R15)
REPORT DETAILS
REACTOR SAFETY
Cornerstone: Mitigating Systems
1R15 Operability Determinations and Functionality Assessments
.1 Operability Evaluations
a. Inspection Scope
The inspectors reviewed the following issue:
- 1AP11E427X2-41A Making a loud clicking sound (AR 03982792)
The inspectors selected this potential operability issue based on the risk significance of the associated components and systems. The inspectors evaluated the technical adequacy of the evaluation to ensure that Technical Specifications (TS) operability was properly justified and the subject component or system remained available such that no unrecognized increase in risk occurred. The inspectors compared the operability and design criteria in the appropriate sections of the TS and Updated Safety Analysis Report (USAR) to the licensees evaluation to determine whether the components or systems were operable. Where compensatory measures were required to maintain operability, the inspectors determined whether the measures in place would function as intended and were properly controlled. The inspectors determined, where appropriate, compliance with bounding limitations associated with the evaluations. Additionally, the inspectors reviewed corrective action documents initiated to verify that the licensee was identifying and correcting any deficiencies associated with operability evaluations.
This operability inspection constituted one sample as defined in IP 71111.15-05.
b. Findings
Failure to Evaluate Replacement Relays for Suitability
Introduction.
A self-revealing, preliminary White finding associated with an Apparent Violation (AV) of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion III, Design Control, and an associated violation of TS 3.8.1 was identified for the licensees failure to implement measures for the selection and review for suitability of application replacement relays for the Division 1 Emergency Diesel Generator (EDG) Room Vent Fan, which were components subject to the requirements of 10 CFR Part 50, Appendix B. Specifically, Engineering Changes 330624 and 366624 failed to evaluate the change in the actual drop out voltages for replacement relays and introduced new relays into the system, preventing the fan from operating during an under voltage condition and rendering the Division 1 EDG inoperable from May 18, 2016 to March 11, 2017.
Description.
On March 7, 2017, an equipment operator heard a clicking noise coming from Unit Substation 1A while performing rounds. The operator notified the control room operators and documented the issue in AR 03982792. Upon investigation, the licensee determined the noise was coming from relay 427X2-41A (commonly called the X2 relay). Relay 427X2-41A is an Agastat time delay relay that provides a signal to reset the load shed and resequencing circuit for the Division 1 EDG room vent fan.
Further troubleshooting determined that the relay was cycling every ten seconds. With the relay cycling, the room vent fan could not start automatically nor be started locally.
On March 9, 2017, the licensee declared the Division 1 EDG inoperable since the vent fan was required to support EDG operation.
Additional troubleshooting determined that the X2 relay was cycling because of a relay coordination issue between the X2 relay and circuit seal in relay 427X3-41A (commonly called the X3 relay). The licensee determined that the audible clicking noise likely began on February 24, 2017, when a grid disturbance resulted in a power loss to the emergency reserve auxiliary transformer that was supplying power to the Division 1 safety bus and Unit Substation 1A. However, the clicking noise was not immediately recognized. Under a normal loss of voltage or under-voltage condition, the X2 and the X3 relays should have de-energized, allowing the circuit to reset and start the room vent fan. In this specific case, the coordination issue prevented both relays from dropping out as required. This resulted in the circuit being unable to reset and allow the fan to start.
The inspectors reviewed the design change history associated with the replacement of safety-related relays and found that the license issued engineering change (EC) 330624 in 2002. The scope of this EC was to evaluate and authorize alternative replacement motor control center (MCC) control units and associated components for safety-related 480V alternating current and 125V direct current MCCs located in mild environments.
This EC also evaluated the use of General Electric (GE) CR120BD relays for suitability in the plant, but it did not evaluate the use of the GE relays in specific plant locations or components.
In January 2008, the licensee implemented a design change to replace X3 relays in the plant (which at the time were Gould J13 relays) with GE CR120BD relays due to obsolescence of the Gould J13 relays. Engineering Change 366624 was issued to allow replacing the Gould J13 relays with GE CR120BD control relays in Unit Substations 1A and 1B. In addition to the X3 relay replacement described above, the licensee also replaced the X2 relay in December 2011 and on May 16, 2016. However, variations in the drop out voltages of both relays and the associated impact that these variations could have on the proper operation of both relays was not evaluated nor understood until after the clicking noise was heard in March 2017. Specifically, the inspectors found that EC 366624 failed to evaluate the use of GE CR120BD relays for suitability in the load shed and resequencing circuit for the Division 1 EDG room vent fan but instead used an item equivalency evaluation which simply stated that the authorization and qualification of the relay was completed under EC 330624.
The inspectors questioned the licensee to determine how EC 330624 evaluated the GE CR210BD relay for suitability of application in the Division 1 EDG room vent fan circuit since the EC only provided the following general statements with regards to the relays:
- These replacement units will retain the functionality of the electrical circuit and all associated electrical characteristics to maintain the existing licensing and design basis;
- The replacement GE CR120BD 125V relays are equivalent to the Gould J13 125V relays. The electrical characteristics of the existing and replacement relays are shown in attached Table 5 [of the EC] [emphasis added].
The inspectors reviewed Table 5 of EC 330624 and found that it simply listed the characteristics of the Gould J13 and the GE CR120BD relays and provided no evaluation or justification for any characteristics that were not exactly the same such as the relay drop out voltages. Therefore, the inspectors determined that EC 330624 only looked at replacing individual relays and did not the evaluate whether the GE CR120BD relays operating characteristics, including drop out voltage, would operate/coordinate properly when placed in a circuit that contained an additional relay such as the X2 Agastat relay.
The licensee performed a root cause evaluation for this issue and concluded that the Division 1 EDG room vent fan failed to operate properly due to personnel not understanding the design basis of the Division 1 EDG room vent fan circuit specific to relay coordination and not understanding the impact the relay coordination had on the operation of the fan during the EC process. The report further stated that having a full understanding of the technical and licensing bases for safety related structures, systems, and components and fully evaluating any changes to these bases was fundamental to design control. In this case, avoidance of a relay coordination condition is fundamental to electrical design. Both EC 330624 and EC 366624 assumed that only a relay independent actuation function evaluation was required rather than an evaluation of the combination of relays for this timing circuit. As a result, replacement of the Gould J13 relay with a GE 120BD relay in January 2008 created a relay coordination condition where the Division 1 EDG room vent fan circuits sequence of operation was adversely affected due to variations in the relays electrical characteristics. However, this adverse interaction did not become apparent until after the under-voltage condition occurred on February 24, 2017. To correct the immediate relay coordination issue, the X3 relay was replaced with a Gould J13 relay, the load shed and resequencing circuit was tested satisfactorily, and the licensee declared the Division 1 EDG operable on March 11, 2017.
Analysis.
Title 10 of the CFR, Part 50, Appendix B, Criterion III, Design Control, requires, in part, that measures be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components. The inspectors determined that the licensees failure to verify the suitability of the replacement relays for the Division 1 EDG room vent fan was contrary to the requirements of 10 CFR 50, Appendix B, Criterion III, and a performance deficiency. Specifically, the licensee failed to evaluate the change in the actual drop out voltages for replacement relays associated with the Division 1 EDG room vent fan, and, as a result, failed to recognize that installation of a GE CR120BD relay in conjunction with the Agastat time delay relay was not a suitable modification of the Division 1 EDG room vent fan circuitry. The performance deficiency was determined to be more than minor in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Screening, dated September 7, 2012, because it was associated with the design control attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of the systems that respond to initiating events to prevent undesirable consequences. Specifically, the installation of unsuitable relays in the Division 1 EDG room vent fan circuit resulted in the inoperability and unavailability of the Division 1 EDG due to the inability of the room vent fan to start during under-voltage or loss of voltage conditions.
During this inspection, the licensee provided the inspectors with a copy of Evaluation 619834, Evaluate Survivability of Equipment in the Division 1 Diesel Generator Room Due to Failure of EDG Ventilation Fan 1VD01CA. The purpose of this evaluation was to demonstrate that the Division 1 EDG would operate successfully for the mission time provided in the licensees probabilistic risk assessment (PRA) without the fan operating.
The inspectors reviewed Evaluation 619834 and concluded that the licensee had not provided a reasonable basis to show the EDG would have been able to perform its function for the PRA mission time. Specifically, panel internal temperature would have reached approximately 240°F, a point where some of the key components would have been susceptible to failure. Based upon this conclusion, the inspectors continued with the significance determination.
The inspectors determined the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 4, Initial Characterization of Findings, dated October 7, 2016 and Appendix A, The Significance Determination Process for Findings at Power, Exhibit 2, Mitigating Systems Screening Questions, dated June 19, 2012. The finding represented an actual loss of system safety function of the Division 1 EDG for greater than its Technical Specification 3.8.1, Condition B.4, allowed outage time of 14 days. Therefore, a detailed risk evaluation was performed in accordance with IMC 0609, Appendix A.
A Region III Senior Reactor Analyst (SRA) performed a detailed risk evaluation using the Standard Plant Analysis Risk (SPAR) model, Version 8.50, for Clinton Power Station.
The following changes were made to the base model prior to performing the detailed risk evaluation.
- Room cooling was assumed to be required for diesel generator success. This assumption is based on the current Clinton PRA model of record. Basic events for fans and dampers that are needed for room cooling of Division 1, 2, and 3 diesel generators were added to the SPAR model, along with the appropriate failure probabilities, including common cause failure probabilities. A common cause component group for Division 1, 2, and 3 ventilation fans was defined.
- The potential to recover room cooling by opening doors to the diesel generator rooms was added to the base model. NRC staff reviewed the licensees technical analysis which included room heat-up calculations and component testing and concluded that if operators opened doors to the room within 30 minutes after diesel generator start and ventilation fan failure there was adequate justification to conclude the diesel generator mission would be met.
- The human error probability for the failure to recover room cooling was estimated using the SPAR Human Reliability Analysis Method (SPAR-H). The SRA determined that the performance shaping factor that would be a performance driver was high stress. The human error probability estimate for the failure to recover room cooling was 2.2E-2. This estimate is consistent with the detailed risk evaluation for a similar finding on the EDG fan supply damper documented in NRC Integrated Inspection Report 05000461/2012004.
- To account for the fact that a diesel generator would not fail immediately upon room cooling failure, the offsite power non-recovery probabilities that are in the baseline model were modified if the failure of the diesel generator occurred because of the loss of room cooling. Two additional hours were assumed to be available for offsite power recovery. For example, the value of the basic event for 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> offsite power non-recovery became a 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> offsite power non-recovery.
- For loss of offsite power sequences in which Division 1 and 2 emergency power fails but the high pressure core spray system is operating, offsite power recovery is assumed to be required within 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> or containment venting is required.
The degraded plant condition was modeled as follows:
- The basic event representing the Division 1 diesel generator room cooling fan failure to start was set to True to model the fan failure as a result of the performance deficiency.
- The exposure time for the degraded condition was approximately 10 months.
The exposure period started when the relay was replaced on May 18, 2016 and ended when the relay was again replaced and the diesel generator fan was returned to service on March 11, 2017.
Using the assumptions as stated above, the internal events change in core damage frequency (CDF) estimate was approximately 2.5E-6/yr, which represents a finding of low to moderate safety significance (White). The dominant core damage sequence was a loss of offsite power event, failure of the Division 1, 2, and 3 diesel generators, and the failure to recover power before battery depletion.
For the external event risk contribution, the SRA evaluated seismic and fire risk. The SPAR model was used to estimate the contribution from seismic events. The fire risk contribution was evaluated in a manner similar to a previous SDP evaluation for a service water pump failure that was documented in NRC Integrated Inspection Report 05000461/2015001. That evaluation used fire-induced loss of offsite power frequencies that were documented in a response to a request for additional information (RAI) for a license amendment request to extend EDG allowed outage times dated March 22, 2001.
The SRA concluded that any risk contribution from external events would not change the preliminary conclusion on risk significance generated using the internal event risk contribution.
Inspection Manual Chapter (IMC) 0609, Appendix H, Containment Integrity Significance Determination Process, was used to estimate the change in large early release frequency (LERF) risk contribution. Clinton has a Mark III containment building. The LERF factor for station blackout events with core damage at high pressure is 0.2. This factor was applied to the delta CDF estimate of 2.5E-6/yr. to obtain a delta LERF estimate of 4.9E-7/yr. This risk estimate also supports a White finding. The SRA did not pursue refinement of this value and concluded that the overall significance of the finding should be based on the delta CDF estimate.
The inspectors determined that this finding affected the cross-cutting area of human performance in the aspect of challenge the unknown, where individuals stop when faced with uncertain conditions. Risks are evaluated and managed before proceeding.
Specifically, a questioning attitude was not used to understand the consequence of the differences in relay features resulting with installing a relay that was incompatible with the current design. [H.11]
Enforcement.
Title 10 of the CFR, Part 50, Appendix B, Criterion III, Design Control, requires, in part, that measures be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components.
Technical Specification (TS) 3.8.1, AC Sources-Operating, Condition B.4, states, in part, that an inoperable diesel generator be restored to an operable status within 14 days.
From January 2008, until March 11, 2017, the licensee failed to review for suitability of application parts essential to the safety-related function of the Division 1 EDG room vent fan. Specifically Engineering Changes 330624 and 366624 failed to consider the effect of the changes in the actual relay drop out voltages on the operation of the Division 1 EDG room vent fan circuitry prior to replacing the X2 and X3 relays on May 18, 2016 and January 2008, respectively.
The failure to properly evaluate the effects of the drop out voltages for both relays prevented the room vent fan from operating during an under voltage condition, resulting in the Division 1 EDG being inoperable from May 18, 2016 to March 11, 2017, a period greater than the allowed by the limiting condition for operation outage time provided in TS 3.8.1.
The licensee documented this issue in AR 03982792. Corrective actions implemented included replacing one of the relays with the previous design and performing post maintenance testing to ensure the operability of the room vent fan. Additionally, the licensee planned a future modification to the circuit to allow installation of a GE CR120BD relay while maintaining the operation of the vent fan and the Division 1 EDG.
(AV 05000461/2017009-01: Failure to Evaluate Replacement Relay Dropout Voltage)
4OA6 Management Meeting
.1 Exit Meeting Summary
On August 3, 2017, the inspectors presented the inspection results to Mr. B. Kapellas and other members of the licensee staff. The licensee acknowledged the issues presented. The inspectors confirmed that none of the potential report input discussed was considered proprietary.
ATTACHMENT:
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee
- T. Stoner, Site Vice President
- B. Kapellas, Plant Manager
- D. Avery, Regulatory Assurance
- R. Bair, Work Management Director
- J. Cunningham, Maintenance Director
- T. Dean, Training Director
- C. Dunn, Operations Director
- K. Engelhardt, Outage Manager
- M. Friedmann, Emergency Preparedness Manager
- M. Heger, Senior Manager Plant Engineering
- T. Krawyck, Engineering Director
- W. Marsh, Organizational Effectiveness Manager
- S. Minya, Operations Training Manager
- F. Paslaski, Radiation Protection Manager
- K. Pointer, Regulatory Assurance
- D. Shelton, Regulatory Assurance Manager
- S. Strickland, Shift Operations Superintendent
- J. Ward, Chemistry Manager
- J. Wilson, Senior Manager Plant Engineering
U.S. Nuclear Regulatory Commission
- K. Stoedter, Chief, Reactor Projects Branch 1
- W. Schaup, Clinton Senior Resident Inspector
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
- 05000461/2017009-01 AV Failure to Evaluate Replacement Relay Dropout Voltage (Section 1R15)