ML12047A218
| ML12047A218 | |
| Person / Time | |
|---|---|
| Site: | Hatch  |
| Issue date: | 03/09/2012 |
| From: | Brian Holian, Andersen J, Biggins J NRC/CRGR, Division of Engineering, NRC/OGC |
| To: | Borchardt R NRC/EDO |
| Cupidon L, CRGR, 301-251-7684 | |
| Shared Package | |
| ML120650755 | List: |
| References | |
| G20110883, OEDO-2011-0800 | |
| Download: ML12047A218 (9) | |
Text
March 9, 2012 MEMORANDUM TO:
R. W. Borchardt Executive Director for Operations FROM:
Brian E. Holian, Backfit Appeal Panel Chairman /RA/
Committee to Review Generic Requirements James P. Biggins, Deputy Assistant General Counsel /B. Holian for/
Reactors and Materials Rulemaking Office of the General Counsel James W. Andersen, Chief /B. Holian for/
Electrical Engineering Branch Division of Engineering Office of Nuclear Reactor Regulation
SUBJECT:
BACKFIT APPEAL PANEL RESPONSE ASSOCIATED WITH COMPONENT DESIGN BASES INSPECTION AT EDWIN I. HATCH NUCLEAR PLANT This memorandum responds to your December 21, 2011, correspondence, Charter for Backfit Appeal Review Panel Associated with Component Design Bases Inspection at Edwin I. Hatch Nuclear Plant (HNP).
In accordance with this charter, the Backfit Appeal Panel reviewed the October 28, 2011, package, Edwin I. Hatch Nuclear Plant Appeal to the Executive Director of Operations: Backfit and Applicability of Compliance Backfit Exception (Agencywide Documents Access and Management System (ADAMS) Accession No. ML11335A179). The panel also reviewed various supporting documents (e.g., U.S. Nuclear Regulatory Commission (NRC) regulations; NRC guidance documents; safety evaluation reports (SERs); final safety analysis reports (FSARs); Institute of Electrical and Electronics Engineers (IEEE) standards; the 1991 enforcement action; the 1995 safety evaluation; the May 25, 2011, inspection report; the licensees June 17, 2011, appeal to Region II; and the September 29, 2011, staff response). In addition to its review of the relevant documentation, the panel worked with various subject-matter experts to gain technical and legal perspectives on the relevant issues. The panel also held fact-finding discussions with Region II and the Southern Nuclear Operating Company (SNC).
Contact:
Les Cupidon, Technical Assistant Committee to Review Generic Requirements
R.
The subject charter instructed the panel to review the October 28, 2011, appeal and supporting information and to answer five questions. The panels responses to the five questions are presented in the following section, and support its findings on the necessity of a backfit at HNP and the appropriateness of the staffs application of the compliance backfit exception. Note that the panel did not review this situation to determine the appropriateness of any other backfit exceptions. The panel extracted and responded to an additional question (Question 6) from the body of the charter because the question was pertinent to the issue at hand.
BACKFIT APPEAL REVIEW PANELS RESPONSES TO CHARTER QUESTIONS Question 1: Was approval of the current HNP degraded voltage configuration in 1995 based on a mistake? If so, what was the mistake and what are the implications for HNP?
Response: Yesapproving the degraded voltage protection configuration at HNP in 1995 was a mistake.
General Design Criterion (GDC) 17, Electric Power Systems, of Appendix A, General Design Criteria for Nuclear Power Plants, to Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities, describes the fundamental requirements for electric power systems. According to GDC 17, electric power from the transmission network to the onsite distribution system must be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear unit or the loss of power from the transmission network. GDC 17 requirements also state that the safety function for each system shall be to provide sufficient capacity and capability to ensure that fuel design limits are not exceeded in the event of anticipated operational occurrences and that the core is cooled in the event of postulated accidents. Such accidents may include those associated with degraded grid voltage conditions that challenge the operating low-voltage limits of safety-related equipment.
Regulations in 10 CFR 50.55a(h)(2) require nuclear power plants with construction permits issued after January 1, 1971, but before May 13, 1999, to have protection systems that must meet the requirements stated in either IEEE Standard 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations, or IEEE Standard 603-1991, Criteria for Safety Systems for Nuclear Power Generating Stations, and the correction sheet dated January 30, 1995. For nuclear power plants with construction permits issued before January 1, 1971, protection systems either must be consistent with their licensing basis or meet the requirements of IEEE Standard 603-1991 and the correction sheet dated January 30,1995. IEEE Standard 279-1971 applies to both HNP units and includes a general functional requirement that the protection systems must automatically initiate appropriate protective actions whenever a condition the system monitors reaches a preset level. In addition to automatic initiation of actions to protect safety systems, the standard requires the system to include the means to manually initiate protective actions.
R.
The degraded voltage protection configuration for the two HNP units approved in the 1995 SER does not meet regulatory requirements. The degraded voltage relays are set below the minimum required voltage at the component level for the automatic protection of the safety-related equipment. The licensees automatic protection system, by itself, does not protect all necessary Class 1E equipment. In 1995, the NRC staff approved a license amendment that allowed manual actions as an essential part of the plants protection system for dealing with a degraded voltage condition. The panel has concluded that the NRC erred in accepting this approach because the licensee did not meet the regulatory requirements of GDC 17 and 10 CFR 50.55a(h)(2) and the NRC granted no exemption for those requirements, as discussed more fully below. The panel agrees with the staffs September 29, 2011, letter stating that the 1995 approval does not constitute a de facto exemption. The criteria for granting an exemption from the requirements in 10 CFR Part 50 are described in 10 CFR 50.12, Specific Exemptions. The 1995 license amendment request did not ask for an exemption from the requirements of 10 CFR 50.55a(h)(2), and the SER did not analyze whether the amendment request met the exemption requirements.
Question 2: Does the current HNP degraded voltage configuration comply with the applicable regulations?
Response: No. GDC 17 of Appendix A, to 10 CFR Part 50, and 10 CFR Part 50.55a(h)(2),
which incorporates IEEE Standard 279-1971, define the regulatory requirements (the licensing basis for HNP, as confirmed by the licensee). Specifically, the intent of the regulations are for HNPs degraded voltage relay scheme to be designed as a protection system, in accordance with IEEE Standard 279-1971, which will automatically separate either of the offsite circuits (circuits required by GDC 17 as the preferred power supplies for the plants Class 1E systems) from supplying the Class 1E buses when it detects a grid-degraded voltage condition and to begin using the GDC 17 onsite power supplies (emergency diesel generators (EDG)) to supply the Class 1E systems. To accomplish this, the system uses degraded voltage relays set with appropriate voltage and time-delay settings to ensure that the power supply meets the voltage requirements of the Class 1E systems.
Contrary to these requirements, the voltage settings of the relays at HNP do not protect all Class 1E systems. The NRC staff identified this issue during its electrical distribution system functional inspection (EDSFI) in the early 1990s. As a result of the EDSFI, the licensee requested a change to its license to add an alarm (at a higher voltage setting) and manual actions; together, these measures were intended to protect the Class 1E systems that the automatic relay voltage settings for degraded voltage did not protect. The licensee made no changes to the technical specifications values for the degraded voltage relays. Allowing manual operator actions to replace automatic relay actions with proper voltage settings is contrary to the requirements of IEEE Standard 279-1971. Per the IEEE standard, such a protective function is the sensing of one or more variables for a station condition (offsite power supply voltage), signal processing, and the automatic initiation and completion of the protective action (removal of the degraded voltage offsite circuit and connection of the EDG to the Class 1E systems). Section 2, Protective Function, and Section 4.1, General Functional Requirement, of the standard clearly define this function. Standard Section 4.17, Manual Initiation also requires protection systems to have the additional capability to be initiated
R.
manually. This does not mean that manually initiated protective actions for safety systems are allowable as a substitute for automatically initiated protective actions.
Question 3: What is the relative risk of the current configuration at HNP?
Response: The panel agrees with the licensee and the previous staff assessment that the relative risk of the current configuration at HNP is low. The licensees evaluation concluded that the likelihood of a simultaneous degraded grid voltage event and a loss-of-coolant accident (LOCA) is extremely low. In its 1995 SER, the NRC staff cited HNPs risk evaluation, the added design feature (alarm on degraded voltage),
and manual actions in its acceptance of the license amendment request. Although the panel did not perform an indepth assessment, it did review a previous generic issue to further assess relative risk. Generic Safety Issue (GSI) 171, ESF (Engineered Safety Feature) Failure from a LOOP (Loss of Offsite Power) subsequent to a LOCA, addressed the risk of a LOCA and resulting trip of a nuclear unit precipitating a degraded voltage event. The GSI determined that the contribution of such an event to core damage frequency was far less than originally anticipated; therefore, the GSI was closed with no new requirements. The GSI scenario also included double-sequencing which led to failure of the ESF systems.
Even with this complication (as compared to HNP), the GSI was closed due to the low probability of this scenario. Although the comparison indicated that the relative risk was low, it is important to note that HNPs degraded voltage relay protection system configuration does not provide automatic protection of all Class 1E systems and components in the event of a degraded grid voltage event and should be addressed from a regulatory compliance perspective.
Question 4: Is the current HNP degraded voltage configuration [sufficient to provide reasonable assurance of] adequate [protection]?
Response: Probably, yes. During the EDSFI the staff conducted in 1991, it found that the existing set points and time-delay characteristics of the degraded grid undervoltage protection relays did not adequately prevent accident mitigating loads and control circuits from being operated with insufficient voltage in the unlikely event of an accident occurring concurrent with degraded grid conditions. To mitigate the staffs concerns, the licensee implemented administrative controls that included initiation of a 1-hour limiting condition of operation if the grid voltage fell below specified levels. If the voltage could not be restored within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, the licensee would initiate an orderly plant shutdown. Other actions included restoring any inoperable diesel generators, limiting maintenance or surveillance of important onsite electrical equipment, closely monitoring voltage levels on the six 4160v safety-related buses, and informing plant management. The licensee documented these actions in a procedure. The licensee trains its operators on the procedure through the normal operator-training program and during operator requalification training on abnormal operating procedures.
At the time of the EDSFI, the staff found these interim measures acceptable from an operability perspective and subsequently approved them as part of the February 1995 safety evaluation that supported the degraded grid voltage relay setpoints.
R.
The panel has reviewed the licensees administrative controls and discussed them with Region II management. Neither the panel nor Region II identified any significant concerns with the administrative controls from an operability perspective, and the panel, in its limited review, agrees that the controls have not been challenged (e.g., no degraded voltage alarm has occurred in the last 15 years). The regulations, however, must be met. The licensee must either correct the situation with changes to the plant or submit a request for approval of an exemption from the regulations.
Question 5: Explain whether the requirements of the compliance backfit exception of 10 CFR 50.109(a)(4)(i) are met.
Response: The requirements are met.
The NRC changed the licensing basis of HNP by granting it a license amendment in 1995 that allowed manual actions as part of the automatic initiation scheme of protective action for some of the safety systems. The panel agrees with the staffs backfit position that the subsequent imposition of the regulatory requirement in 10 CFR 50.55a(h)(2), which disallows such manual action in place of automatic initiation, constitutes a change in position on the regulatory requirements applied to HNP. To meet the compliance exception to the backfit analysis requirement under 10 CFR 50.109(a)(4)(i), the NRC staff must show [t]hat a modification is necessary to bring a facility into compliance with a license or the rules or orders of the Commission, or into conformance with written commitments by the licensee.
In this instance, the current licensing basis for HNP does not meet the requirement of the regulations in 10 CFR 50.55a(h)(2), which incorporates, by reference, IEEE Standard 279-1971. In its 1985 Statements of Consideration, the Commission explained that the compliance exception is intended to address situations in which the licensee has failed to meet known and established standards of the Commission because of omission or mistake of fact. The staff previously explained that this backfit meets the compliance exception because it addresses a failure to meet the regulatory requirement of 10 CFR 50.55a(h)(2) because of a mistake. The NRC staff correctly determined that the new position imposed on HNP was a backfit that meets the compliance exception.
In 1982, the NRC approved setpoints in the HNP technical specifications on the basis of calculations, which showed at the time that adequate voltage protection would automatically be provided to Class 1E equipment. However, during its 1991 EDSFI, the staff determined, on the basis of new calculations and a review of HNPs methodology, that the setpoints specified in the HNP technical specifications would not automatically protect Class 1E equipment from degraded voltage conditions. After the EDSFI, the licensee sought and received a license amendment that approved the use of manual action as a supplement to automatic actuation to protect some Class 1E equipment. As part of the 2009 component design-basis inspection (CDBI) it conducted at HNP, the staff stated in its May 25, 2011, inspection report that its approval of the 1995 license amendment was an error, and that the degraded voltage protection system configuration for the two HNP units was inadequate to meet the regulatory requirements because they do not automatically protect the Class 1E equipment during a degraded voltage condition. Although the NRC staff may have thoroughly reviewed the amendment application in 1995, they did not correctly identify the regulatory requirements
R.
necessary to evaluate the request. Both the licensee and the staff should have realized that an exemption to the regulations was necessary to grant such a relief.
In the 1995 amendment request, both the licensee and the NRC staff referred to the regulatory action as a deviation. However, neither the licensee nor the NRC staff required the amendment request to be analyzed for compliance with IEEE Standard 279-1971, as incorporated into the regulations by 10 CFR 50.55a(h)(2).
Both the staff and the licensee further failed to recognize that if the licensee sought relief from the regulatory requirement in 10 CFR 50.55a(h)(2), that relief could only be granted as an exemption under 10 CFR 50.12. The staffs 1995 SER clearly focused on the question of whether the NRC can approve a deviation from the staff position as stated in a June 2, 1977, Generic Letter specifying its position on onsite emergency power systems. In its review, the staff concludes that the requested deviation from the Generic Letters is acceptable because of the added design features and the compensatory measures at HNP as discussed in the above Safety Evaluation. The staff also determined that both an offsite and onsite power system is available, each with the capability of providing power for the required safety components in accordance with GDC 17 of 10 CFR Part 50, Appendix A. In its approval, therefore, the staff made two mistakes: (1) the staff failed to identify that it must find compliance with 10 CFR 50.55a(h)(2) and (2) an exemption must be granted from the requirements of IEEE Standard 279-1971, as incorporated by reference in 10 CFR 50.55a(h)(2), to allow credit for the added design features and compensatory measures.
Because the staffs 1995 SER focused on the approval of a deviation from a staff position, it did not address compliance with 10 CFR 50.55a(h)(2), despite its broad generalization of compliance with the more general requirement of GDC 17. There is no indication that the staff even considered the necessity of automatic actuation of protection systems to be anything more than a staff position rather than a requirement. Further, because the staff allowed credit for added design features and compensatory measures, the staff does not appear to have been focused on the requirements of 10 CFR 50.55a(h)(2) and its connection with IEEE Standard 279-1971. Standard 279-1971 requires the automatic initiation of protective actions to protect all safety systems, and in its language, it does not allow credit for added design features and compensatory measures. Therefore, in granting approval of the 1995 license amendment, the staff made a mistake by not evaluating compliance with an applicable regulatory requirement, and allowed a deviation from a staff position instead of determining whether or not to grant an exemption from the regulatory requirement in order to consider other means to provide assurance of adequate protection.
In its appeal (October 28, 2011, letter, Enclosure 1, page 3) the licensee argues that at the time of the 1995 SER, the staff was fully aware and cognizant of the issue at hand and of the resolution that it was approving. The documentation underlying the NRCs approval of the 1995 license amendment establishes that the deviation from the 1977 staff guidance was approved only after the particular facts and circumstances related to degraded grid on the Southern electric system and the HNP degraded voltage protection scheme were reviewed. The approval was
R.
risk-informed and appropriately considered the relative alternatives.
Even considering the licensees argument as true, if the staff fully considered the facts and circumstances in its decision to approve a deviation from a staff position, the fact remains that it did not correctly identify the regulatory requirements or review and approve an exemption.
Another argument in the licensees appeal is that the compliance exception does not apply because, the NRC in 1995 expressly addressed the compliance of the HNP system under the same regulations and came to a different conclusion than the NRC staff does today (October 28, 2011, letter, Enclosure 1, page 11). As described above, the staff in 1995 apparently did not consider the same applicable regulations that the staff is considering today. Furthermore, the NRC has not indicated that it has reinterpreted the requirements of 10 CFR 50.55a(h)(2) and IEEE Standard 279-1971, specifically with regard to the automatic initiation of protective systems for the full range of conditions, since the rule was adopted in 1971. The 1977 generic letter, the EDSFI, and the CDBI did not change the interpretation of the requirement to have automatic initiation for the full range of conditions. The 1995 SER approval specifically stated that it approved a deviation from the 1977 generic letter rather than a determination of compliance with the positions stated in it. As described in the 1995 SER, the deviation from the position in the letter was the credit for added design features and compensatory measures at HNP. The deviation, therefore, cannot be considered a finding that the proposed measures complied with the staff positions stated in the 1977 generic letter, nor can it be considered a reinterpretation of the regulatory requirement.
Accordingly, the compliance exception to the backfit rule applies to HNP. Due to a mistake by the staff in identifying what was merely guidance or staff position versus what was a requirement, and consideration of design features and compensatory measures not allowed by the regulation without an exemption, there has been a change in position as to whether the HNP degraded voltage protection scheme meets the applicable regulatory requirements. In fact, the HNP degraded voltage scheme does not meet the regulatory requirements, and therefore, a modification is necessary to bring HNP into compliance with the rules of the Commission.
Question 6: Does the 1991 enforcement action have implications for the issuance of a backfit?
Response: No. The HNP Backfit Panel discussed the 1991 enforcement action, in light of the subsequent backfit and general guidance in the enforcement policy, with the Office of Enforcement. The Enforcement Policy discusses reopening closed enforcement actions and states that under special circumstances (e.g., when the NRC receives significant new information showing that an enforcement sanction was incorrectly applied), the agency may consider, on a case-by-case basis, reopening a closed enforcement action to increase or decrease the severity of a sanction or to correct the record. The staff has not reopened the previous action, but did determine that a backfit is appropriate. The panel agrees with this position.
R.
RECOMMENDATION:
In an effort to rectify the ongoing lack of compliance at HNP, the panel recommends that the agency respond with a letter to SNC (HNP) to reassert the agencys position, citing the relevant regulations. The attached Enclosure 1 is a letter to the licensee for the EDOs consideration.
Because the Nuclear Energy Institute (NEI) also provided comments in support of SNCs appeal, the panel offers a recommended agency response to NEI in Enclosure 2.
Enclosures:
As stated
ML120650755 OFFICE RES Tech Edit NRR OGC CRGR NAME L. Cupidon QTE (By email) J. Andersen J. Biggins B. Holian DATE 03/09/12 03/07/12 03/09/12 03/09/12 03/09/12