ML15147A412
| ML15147A412 | |
| Person / Time | |
|---|---|
| Site: | Pilgrim |
| Issue date: | 05/27/2015 |
| From: | Ho Nieh Division Reactor Projects I |
| To: | Dent J Entergy Nuclear Operations |
| DiPaolo E | |
| References | |
| EA-15-081 IR 2015007 | |
| Download: ML15147A412 (68) | |
See also: IR 05000293/2015007
Text
UNITED STATES
NUCLEAR REGULATORY COMMISSION
REGION I
2100 RENAISSANCE BLVD., SUITE 100
KING OF PRUSSIA, PA 19406-2713
May 27, 2015
Mr. John Dent
Site Vice President
Entergy Nuclear Operations, Inc.
Pilgrim Nuclear Power Station
600 Rocky Hill Road
Plymouth, MA 02360-5508
SUBJECT: PILGRIM NUCLEAR POWER STATION - NRC SPECIAL INSPECTION REPORT
05000293/2015007; AND PRELIMINARY WHITE FINDING
Dear Mr. Dent:
On January 29, 2015, the U.S. Nuclear Regulatory Commission (NRC) completed its initial
assessment of the circumstances surrounding the January 27, 2015 partial loss of offsite power
and reactor trip event at your Pilgrim Nuclear Power Station (PNPS) during a severe winter
storm. Based on this initial assessment, the NRC sent a Special Inspection Team (SIT) to your
site on February 2, 2015. The SIT Charter (Attachment 1 of the enclosed report) provides the
basis and additional details concerning the scope of the inspection. The enclosed report
documents the inspection teams activities and observations conducted in accordance with the
SIT Charter. On March 20, 2015, the SIT discussed the results of the inspection with you and
other members of your staff.
The inspection examined activities conducted under your license as they relate to safety and
compliance with Commission rules and regulations and with conditions of your license. The
team reviewed selected procedures and records and interviewed personnel. In particular, the
SIT reviewed event evaluations (including technical analyses), causal investigations, relevant
performance history, and extent-of-condition reviews to assess the significance and potential
consequences of several plant equipment, operator performance, and procedural issues that
complicated the loss of offsite power and reactor trip event that occurred during the severe
winter weather event.
The enclosed inspection report discusses a finding that has preliminarily been determined to be
a White finding with low to moderate safety significance that may require additional inspections,
regulatory actions, and oversight. As described in Section 2.5 of the enclosed report, Entergy
Nuclear Operations, Inc. (Entergy) staff failed to identify, evaluate, and correct the condition of
the A safety/relief valve (SRV) failing to open upon manual actuation during a plant cooldown
on February 9, 2013. While the SRVs tested satisfactorily at high pressures at an offsite test
facility, this failure to take actions to preclude repetition resulted in the C SRV failing to open at
reduced pressure during the plant cooldown in response to the partial loss of offsite power event
on January 27, 2015. The self-revealing finding was within Entergys ability to foresee and
J. Dent
2
correct because indications were available to determine that the A SRV valve did not open
upon manual actuation. As a result, the A SRV was inoperable for greater than its Technical
Specification allowed outage time. Entergy staff entered the issue into their corrective action
program (CAP) and conducted a cause evaluation. The finding did not present a current safety
concern because both the A and C SRVs were replaced during the outage following the
January 27, 2015, loss of offsite power and reactor trip event. This finding was assessed based
on the best available information, using the NRCs Significance Determination Process (SDP).
The basis for the NRCs preliminary determination is described in the enclosed report.
The NRC will inform you, in writing, when the final significance has been determined. In
accordance with NRC Inspection Manual Chapter 0609, Significance Determination Process,
we intend to complete and issue our final safety significance determination within 90 days from
the date of this letter. The NRCs significance determination process is designed to encourage
an open dialog between your staff and the NRC; however, the dialogue should not affect the
timeliness of our final determination.
We believe that we have sufficient information to make a final significance determination.
However, before we make a final decision, we are providing you an opportunity to provide your
perspective on the facts and assumptions that the NRC used to arrive at the finding and assess
its significance. Accordingly, you may notify us of your decision within 10 days to: (1) request a
regulatory conference to meet with the NRC and provide your views in person; (2) submit your
position on the finding in writing; or, (3) accept the finding as characterized in the enclosed
inspection report.
If you choose to request a regulatory conference, the meeting should be held in the NRC
Region I office within 30 days of the date of this letter, and will be open for public observation.
The NRC will issue a public meeting notice and a press release to announce the date and time
of the conference. We encourage you to submit supporting documentation at least one week
prior to the conference in an effort to make the conference more efficient and effective. If you
choose to provide a written response, it should be sent to the NRC within 30 days of the date of
this letter. You should clearly mark the response as a Response to Preliminary White Finding
in Inspection Report No. 05000293/2015007; EA-15-081, and send it to the U.S. Nuclear
Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a
copy to the Regional Administrator, Region I, and a copy to the NRC Senior Resident Inspector
at the PNPS.
You may also elect to accept the finding as characterized in this letter and the inspection report,
in which case the NRC will proceed with its regulatory decision. However, if you choose not to
request a regulatory conference or to submit a written response, you will not be allowed to
appeal the NRCs final significance determination.
Please contact Ray McKinley at (610) 337-5150 within 10 days from the issue date of this letter
to notify the NRC of your intentions. If we have not heard from you within 10 days, we will
continue with our significance determination and enforcement decision. Because the NRC
has not made a final determination in this matter, a Notice of Violation is not being issued for
this inspection finding at this time. In addition, please be advised that the number and
characterization of the apparent violation may change based on further NRC review. The
final resolution of this matter will be conveyed in separate correspondence.
J. Dent
3
In addition, this report documents one Severity Level IV non-cited violation (NCV) and six
findings of very low safety significance (Green). Five of the Green findings were determined to
involve violations of NRC requirements. However, because of the very low safety significance
and because they are entered into the CAP, the NRC is treating these violations as NCVs,
consistent with Section 2.3.2.a of the NRC Enforcement Policy. If you contest any NCV in this
report, you should provide a response within 30 days of the date of this inspection report, with
the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control
Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region I; the
Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington,
DC 20555-0001; and the NRC Resident Inspector at PNPS. In addition, if you disagree with the
cross-cutting aspect assigned to any finding, or a finding not associated with a regulatory
requirement in this report, you should provide a response within 30 days of the date of this
inspection report, with the basis for your disagreement, to the Regional Administrator, Region I,
and the NRC Resident Inspector at PNPS.
In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390 of the NRC's
"Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be
available electronically for public inspection in the NRC Public Document Room or from the
Publicly Available Records component of the NRCs Agencywide Documents Access and
Management System (ADAMS). ADAMS is accessible from the NRC Website at
http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
We appreciate your cooperation. Please contact Eugene DiPaolo of the Division of Reactor
Projects staff at (610) 337-6959 if you have any questions regarding this letter or the enclosed
report.
Sincerely,
/RA/
Ho K. Nieh, Director
Division of Reactor Projects
Docket No.
50-293
License No.
Enclosure:
Inspection Report 05000293/2015007
w/Attachments 1, 2, 3, 4, and 5
cc w/encl:
Distribution via ListServ
SUNSI Review
Non-Sensitive
Sensitive
Publicly Available
Non-Publicly Available
OFFICE
RI/DRP
RI/DRP
RI/DRP
RI/OE
RI/DRP
NAME
EDiPaolo/EMD
RMcKinley/RRM
DSchroeder/DLS
MMcLauglin/MMM
HNieh/HKN
DATE
5/8/15
5/9/15
5/8/15
5/11/15
5/26/15
1
Enclosure
U. S. NUCLEAR REGULATORY COMMISSION
REGION I
Docket No.
50-293
License No.
Report No.
Licensee:
Entergy Nuclear Operations, Inc. (Entergy)
Facility:
Pilgrim Nuclear Power Station
Location:
600 Rocky Hill Road
Plymouth, MA 02360
Dates:
February 2, 2015 through March 20, 2015
Inspectors:
E. DiPaolo, Senior Project Engineer, Division of Reactor Projects,
Team Leader
C. Cahill, Senior Reactor Analyst, Division of Reactor Safety (DRS)
S. Pindale, Senior Reactor Inspector, DRS
J. Lilliendahl, Senior Emergency Response Coordinator, DRS
T. Dunn, Operations Engineering, DRS
E. Burket, Emergency Preparedness Inspector, DRS
Approved by:
Daniel L. Schroeder, Branch Chief
Division of Reactor Projects
Team Manager
Ho K. Nieh, Director
Division of Reactor Projects
2
Enclosure
TABLE OF CONTENTS
SUMMARY OF FINDINGS ........................................................................................................... 3
REPORT DETAILS ..................................................................................................................... 10
1.
Chronology of Events and Event Response Challenges ................................................. 10
2.
Equipment Response to the Event ................................................................................... 12
3.
Event Diagnosis and Crew Performance ......................................................................... 23
4.
Effectiveness of Licensees Response ............................................................................. 30
5.
Implementation of the Emergency Plan ........................................................................... 32
6.
Control of Switchyard Activities, Maintenance Effectiveness, and Assessment of
Operating Experience ...................................................................................................... 36
7.
Risk Significance of the Event .......................................................................................... 39
8.
Exit Meetings .................................................................................................................... 42
ATTACHMENT 1 - SPECIAL INSPECTION TEAM CHARTER .............................................. A1-1
ATTACHMENT 2 - DETAILED SEQUENCE OF EVENTS ..................................................... A2-1
ATTACHMENT 3 - PILGRIM OFFSITE POWER SYSTEM .................................................... A3-1
ATTACHMENT 4 - QUANTITATIVE AND QUALITATIVE EVALUATIONS ............................ A4-1
ATTACHMENT 5 - SUPPLEMENTAL INFORMATION .......................................................... A5-1
KEY POINTS OF CONTACT............................................................................................... A5-1
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED .................................................. A5-1
LIST OF DOCUMENTS REVIEWED ................................................................................... A5-2
LIST OF ACRONYMS ......................................................................................................... A5-5
3
Enclosure
SUMMARY OF FINDINGS
IR 05000293/2015007; 02/02/2015 - 03/20/2015; Pilgrim Nuclear Power Station (PNPS);
Special Inspection to review the January 27, 2015 partial loss of offsite power (LOOP) and
reactor scram event; Inspection Procedure 93812, Special Inspection.
A six-person U.S. Nuclear Regulatory Commission (NRC) team, comprised of regional
inspectors and a regional senior reactor analyst, conducted this Special Inspection. The team
identified one finding and apparent violation (AV) that has been preliminarily determined to be of
low to moderate safety significance (White), one Severity Level (SL) IV non-cited violation
(NCV), and six findings of very low safety significance (Green), five of which were also NCVs.
The significance of most findings is indicated by their color (i.e., greater than Green, Green,
White, Yellow, Red) and determined using Inspection Manual Chapter (IMC) 0609, Significance
Determination Process (SDP), dated June 2, 2011. Cross-cutting aspects are determined
using IMC 0310, Aspects Within the Cross-Cutting Areas, dated December 4, 2014. All
violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement
Policy, dated February 4, 2015. The NRCs program for overseeing the safe operation of
commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process,"
Revision 5, dated February 2014.
Cornerstone: Initiating Events
Green. A self-revealing Green finding was identified for Entergys failure to verify that the
diesel-driven air compressor (K-117) was available for service prior to the January 27, 2015
winter storm. Specifically, although K-117 was tested prior to the winter storm, the test
methodology did not reveal that the capacity of the starting battery was inadequate.
The failure to verify that the diesel-driven air compressor (K-117) was available for service
prior to the January 27, 2015 winter storm is a performance deficiency that was within
Entergys ability to foresee and correct. This resulted in a loss of instrument air during the
plant trip which complicated the event response. Entergy entered the issue into the
corrective action program (CAP) as condition report (CR)-PNP-2015-00559 and initiated
actions to supply instrument air with a temporary air compressor. Entergy also revised the
operability test for K-117 air compressor to remove the alternating current (AC) power
source prior to starting the air compressor.
This self-revealing issue was more than minor because it is associated with the procedure
quality and design control attributes of the Initiating Events cornerstone and adversely
impacted the cornerstone objective to limit the likelihood of events that upset plant stability
and challenge critical safety functions during shutdown as well as power operations.
Specifically, failure of K-117 resulted in loss of instrument air, which adversely impacted the
plant response during the January 27, 2015 winter storm. Additionally, this issue is also
associated with the procedure quality and design control attributes of the Mitigating Systems
cornerstone and affected the cornerstone objective to ensure the availability, reliability, and
capability of systems that respond to initiating event to prevent undesirable consequences.
The inspectors screened the issue under the Initiating Events cornerstone using Attachment
4 and Exhibit 1 of Appendix A to IMC 0609, Significance Determination Process, because
that cornerstone was determined to be more impacted by the finding than the Mitigating
Systems cornerstone. The inspectors concluded that a detailed risk evaluation would be
required because the finding involved the complete loss of a support system (instrument air)
that contributes to the likelihood of an initiating event and affects mitigation equipment. A
4
Enclosure
senior reactor analyst performed a detailed risk evaluation of this issue. The NRC model for
PNPS was adjusted to account for a loss of the instrument air compressor on a LOOP. The
change in core damage frequency was very low. A review of the dominant accident
sequences indicated the contribution from a large early release and from external risk
contributors to be very small. Therefore, the issue was determined to be of very low risk
significance (Green).
The finding had a cross-cutting aspect in the area of Human Performance, Design Margins,
because Entergy failed to ensure that the K-117 battery was designed with adequate
margin. This finding is reflective of current performance because the inadequate design
margin of the battery should have been discovered through proper testing [H.6]. (Section
6.1)
Cornerstone: Mitigating Systems
Green. The team identified a Green NCV of Title 10 of the Code of Federal Regulations (10
CFR) 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, when Entergy
staff performed an inadequate past operability determination that assessed performance of
the C safety/relief valve (SRV), which did not open as expected when called upon to
function. Specifically, following the January 27, 2015 reactor scram, operators placed an
open demand for the C SRV twice during post-scram recovery operations, but the valve did
not respond as expected and did not perform its pressure reduction function on both
occasions. Entergys subsequent past operability assessment for the valves operation
incorrectly concluded that the valve was fully capable of performing its required functions
during its installed service. In response to the teams past operability concerns, Entergy
subsequently re-evaluated the past operability of C SRV and concluded that it was
inoperable and placed the issue into the corrective action program (CAP) as CR-PNP-2015-
02051.
The team determined the failure to adequately assess past operability of the C SRV was a
performance deficiency that was reasonably within Entergys ability to foresee and correct.
This NRC-identified performance deficiency is more than minor because it is associated with
the equipment performance attribute of the Mitigating Systems cornerstone and affects the
cornerstone objective of ensuring the availability, reliability, and capability of systems that
respond to initiating events to prevent core damage. The team evaluated the finding using
IMC 0609, Appendix 0609.04, Initial Characterization of Findings, which directed the use of
IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power.
Using Exhibit 2, Mitigating Systems Screening Questions, of IMC 0609, Appendix A, the
team determined this finding was not a design or qualification deficiency and was not a
potential or actual loss of system or safety function, and was therefore of very low safety
significance (Green).
The finding had a cross-cutting aspect in Human Performance, Conservative Bias, because
Entergy did not use decision making practices that emphasized prudent choices over those
that are simply allowable. Specifically, Entergy did not appropriately evaluate unexpected
and unsatisfactory performance of the C SRV in consideration of the entire pressure range
that the SRV, including its automatic depressurization system (ADS) function, was required
to be operable [H.14]. (Section 2.4)
5
Enclosure
Apparent Violation. A self-revealing preliminary White finding and AV of 10 CFR 50,
Appendix B, Criterion XVI, Corrective Action, and Technical Specification (TS) 3.5.E,
Automatic Depressurization System, was identified for the failure to identify, evaluate, and
correct a significant condition adverse to quality associated with the A SRV. Specifically,
Entergy failed to identify, evaluate, and correct the A SRVs failure to open upon manual
actuation during a plant cooldown on February 9, 2013. In addition, the failure to take
actions to preclude repetition resulted in the C SRV failing to open due to a similar cause
following the January 27, 2015, LOOP event. Entergy entered this issue in to the CAP as
CR-PNP-2015-01983, CR-PNP-2015-00561, and CR-PNP-2015-01520. Immediate
corrective actions included replacing the A and C SRVs and completing a detailed
operability analysis of the installed SRVs which concluded that a reasonable assurance of
operability existed.
Entergys failure to identify, evaluate, and correct the condition of the A SRVs failure to
open upon manual actuation during a plant cooldown on February 9, 2013, was a
performance deficiency. In addition, the failure to take actions to preclude repetition
resulted in the C SRV failing to open due to a similar cause following the January 27, 2015
LOOP event. The self-revealing finding was within Entergys ability to foresee and correct
because indications were available to determine that the A SRV valve did not open upon
manual actuation. This was discovered as a result of an extent of condition review of the C
SRV failing to open upon manual actuation following the January 27, 2015 LOOP event.
This performance deficiency is more than minor because it could reasonably be viewed as a
precursor to a significant event if two of the four SRVs failed to open when demanded to
depressurize the reactor, following the failure of high pressure injection systems or torus
cooling, to allow low pressure injection systems to maintain reactor coolant system inventory
following certain initiating events. In addition, it is associated with the Mitigating Systems
cornerstone attribute of equipment performance and affected the cornerstone objective of
ensuring the availability, reliability, and capability of systems that respond to initiating events
to prevent undesirable consequences.
The inspectors screened this issue for safety significance in accordance with IMC 0609,
Appendix A, Exhibit 2, Mitigating Systems Screening Questions, issued June 19, 2012.
The screening determined that a detailed risk evaluation was required because it was
assumed that for a year period, two of the four SRVs were in a degraded state such that
they potentially would not have functioned to open at some pressure lower than rated
pressure and would not fulfill their safety function for greater than the TS allowed outage
time. Specifically, the assumptions of failures to open were based on: a failed actual
opening demand at 200 psig reactor pressure on January 27, 2015, for the C SRV;
examination of the valve internals at the testing vendor (National Technical Systems); and a
previous failed actual opening demand at 114 psig reactor pressure on February 9, 2013, for
the A SRV.
The staff determined that there wasnt an existing SDP risk tool that is suitable to assess the
significance of this finding with high confidence, mainly because of the uncertainties
associated with: the degradation mechanism and its rate; the range of reactor pressure at
which the degraded valves could be assumed to fully function; any potential benefit from an
SRV lifting at rated pressure, such that the degradation would be less likely to occur and,
therefore, prevent a subsequent failure at low pressure in the near-term; the time based
nature of plant transient response relative to when high pressure injection sources fail and
the associated impact of reduced decay heat on the SRV depressurization success criteria;
and the ability to credit other high pressure sources of water.
6
Enclosure
Based on the considerations above, the risk evaluation was performed using IMC 0609,
Appendix M, Significance Determination Process Using Qualitative Criteria, issued
April 12, 2012. The NRC made a preliminary determination that the finding was of low to
moderate safety significance (White) based on quantitative and qualitative evaluations.
The detailed risk evaluation is contained in Attachment 4 to this report.
This finding does not present a current safety concern because the A and C SRVs were
replaced during the outage following the January 27, 2015 LOOP and reactor trip event.
Also, Entergy performed a detailed operability analysis of the installed SRVs which
concluded that a reasonable assurance of operability existed.
This finding had a cross-cutting aspect in Problem Identification and Resolution, Evaluation,
because Entergy did not thoroughly evaluate issues to ensure that resolutions address
causes and extent of conditions commensurate with their safety significance. Specifically,
Entergy staff did not thoroughly evaluate the operation of the A SRV during the February 9,
2015 plant cooldown and should have reasonably identified that the A SRV did not open
upon three manual actuation demands [P.2]. (Section 2.5)
Green. A self-revealing Green NCV of TS 5.4.1, Procedures, was identified because
Entergy failed to include appropriate operator actions to both recognize the effects of and
recover systems and components important to safety within Procedure 5.3.8, Loss of
Instrument Air, abnormal operating procedure. Entergy entered this issue into the CAP as
PNP-CR-2015 0888 and issued a revision to Procedure 5.3.8 to provide additional guidance
to operators during a loss of instrument air.
The inspectors determined that the level of detail in Procedure 5.3.8, Loss of Instrument
Air, Revision 39, was inadequate to provide appropriate operator guidance to identify and
mitigate key events of January 27, 2015. This self-revealing performance deficiency was
reasonably within the ability of Entergy personnel to foresee and the issue should have been
prevented. The finding was more than minor because it was associated with the procedure
quality attribute of the Mitigating System cornerstone and adversely affected the cornerstone
objective of ensuring the availability, reliability, and capability of systems that respond to
initiating events to prevent undesired consequences. The lack of adequate instructions in
the procedure adversely affected several operator actions and plant equipment on
January 27, 2015, during the LOOP and loss of instrument air.
The team evaluated the finding using IMC 0609, Appendix A, Exhibit 2, Mitigating Systems
Screening Questions. The team determined this finding was of very low safety significance
(Green) because it was not a design or qualification deficiency, did not result in a loss of
function of a TS required system, and did not represent an actual loss of function of one or
more non-TS trains of equipment designated as a high safety-significant system.
This finding had a cross-cutting aspect in the area of Human Performance, Resources,
because Entergy leaders did not ensure that personnel, equipment, procedures, and other
resources were available and adequate to support nuclear safety [H.1]. (Section 3.2)
Green. A self-revealing Green NCV of TS 5.4.1, Procedures, was identified because the
operating crew failed to implement a procedure step to open the reactor core isolation
cooling (RCIC) system cooling water supply valve during a manual startup of the system.
As a result, the RCIC system was operated for over 2 1/2 hours with no cooling water being
supplied to the lubricating oil cooler or to the barometric condenser. Entergy entered the
7
Enclosure
issue into the CAP as CR-PNP-2015-0566, CR-PNP-2015-0570, and CR-PNP-2015-0952
and conducted a human performance review of the Control Room operators involved with
the issue.
The inspectors determined that the failure to implement Procedure 5.3.35.1, Attachment 29,
RCIC Injection - Manual Alignment Checklist, and the Vacuum Tank Pressure Hi Alarm,
C904L-F3, alarm response procedure was a performance deficiency and was reasonably
within the ability of Entergy personnel to foresee and prevent. This self-revealing finding
was more than minor because it was associated with the human performance attribute of
the Mitigating System cornerstone and adversely affected the cornerstone objective of
ensuring the availability, reliability, and capability of systems that respond to initiating events
to prevent undesired consequences. Specifically, on January 27, 2015, reactor operators
failed to open MO-1301-62, cooling water supply valve, during a manual restart of the RCIC
system in accordance with procedure 5.3.35.1, RCIC Injection - Manual Alignment
Checklist. Additionally, the operating crew failed to identify the valve was out of position
even after the Vacuum Tank Pressure Hi Alarm, C904L-F3, was received two minutes after
the system was re-started and the alarm response procedure identified Improper Valve
Lineup as a probable cause.
The team evaluated the finding using IMC 0609, Appendix A, Exhibit 2, Mitigating Systems
Screening Questions. The team determined this finding was not a design or qualification
deficiency and was not a potential or actual loss of system or safety function, and is
therefore of very low safety significance (Green). During the period when the RCIC system
was operated in this condition, no temperature limits were exceeded. The inspectors noted
that in the event of a RCIC system automatic start, the cooling water supply valve would
have opened automatically.
This finding had a cross-cutting aspect in the area of Human Performance, Procedure
Adherence, because Entergy licensed personnel did not implement procedure 5.3.35.1,
RCIC Injection - Manual Alignment Checklist, to open MO-1301-62. Additionally, Entergy
licensed personnel did not implement the Vacuum Tank Pressure Hi Alarm, C904L-F3,
response procedure to check for an improper valve line-up [H.8]. (Section 3.3)
Green. The inspectors identified a Green NCV of 10 CFR 50, Appendix B, Criterion XVI,
Corrective Action, because PNPS staff failed to identify and correct conditions adverse to
quality associated with the partial voiding of the A core spray (CS) discharge header on
January 27, 2015, following the loss of the keepfill system due to a LOOP. PNPS entered
the issue into the CAP as CR-PNP-2015-01406 and planned procedural changes that would
provide guidance to operate the affected pumps in order to prevent pump discharge piping
from voiding if keepfill pressure is lost.
The failure to identify, evaluate, and correct the A CS discharge header partial voiding
following loss of keepfill on January 27, 2015, is a performance deficiency that was within
Entergys ability to foresee and correct. Because the issue was not entered into the CAP,
the condition was neither evaluated nor was corrective action taken or planned. This NRC-
identified issue is more than minor because it is associated with the Mitigating Systems
cornerstone attribute of equipment performance and affected the cornerstone objective of
ensuring the availability, reliability, and capability of systems that respond to initiating events
to prevent undesirable consequences. The inspectors evaluated the finding using IMC
0609, Appendix A, The Significance Determination Process for Findings At-Power, to IMC
0609, Significance Determination Process. This finding was determined to be of very low
8
Enclosure
safety significance (Green) because it was not a deficiency affecting the design or
qualification of a mitigating system and did not represent an actual loss of at least a single
train system or two separate safety systems for greater than the TS allowed outage time.
The finding had a cross-cutting aspect in Problem Identification and Resolution,
Identification, because PNPS personnel did not implement a CAP with a low threshold for
identifying issues. Individuals did not identify the issue completely, accurately, and in a
timely manner in accordance with the program [P.1]. (Section 4.2)
Cornerstone: Emergency Preparedness
Green. The inspectors identified a Green NCV of 10 CFR 50.54(q)(2) for failing to follow
and maintain an emergency plan that meets the requirements of planning standards 10 CFR
50.47(b) and Appendix E. Specifically, on January 27, 2015, following a loss of instrument
air, the indications in the Control Room for Sea Water Bay level were lost, and Entergy did
not implement compensatory measures, as directed by an Emergency Plan Implementing
Procedure, to determine whether a Sea Water Bay level emergency action level (EAL)
threshold had been exceeded. Entergy entered this issue into the CAP as CR-PNP-2015-
00948 and initiated corrective actions to identify alternative means for assessing this EAL in
the event of a loss of Sea Water Bay level instruments.
The inspectors determined that Entergys failure to implement compensatory measures for
out-of-service EAL instrumentation was a performance deficiency that was within Entergys
ability to foresee and correct and should have been prevented. Specifically, Entergy did not
implement the compensatory measure listed in Attachment 9.2 of EP-IP-100.1, Emergency
Action Levels, Revision 10. The inspectors determined that following a loss of instrument
air, the indications for Sea Water Bay level EAL were lost, rendering those EALs ineffective
such that Entergy was not able to determine whether a Sea Water Bay level EAL threshold
had been exceeded and to declare an emergency based on the Sea Water Bay level. This
NRC-identified performance deficiency was more than minor because it was associated with
the emergency response organization performance (program elements not meeting 50.47(b)
planning standards) attribute of the Emergency Preparedness cornerstone and affected the
cornerstone objective of ensuring that the licensee is capable of implementing adequate
measures to protect the health and safety of the public in the event of a radiological
emergency. Specifically, the out-of-service Sea Water Bay level instrumentation could have
led to an emergency not being declared in a timely manner.
The inspectors evaluated the finding using IMC 0609, Attachment 4, Initial Characterization
of Findings, issued June 19, 2012. The attachment instructs the inspectors to utilize IMC
0609, Appendix B, Emergency Preparedness Significance Determination Process, issued
September 23, 2014, when the finding is in the licensees Emergency Preparedness
cornerstone. The inspectors determined the finding was associated with risk significant
planning standard 10 CFR 50.47(b)(4), Emergency Classification System, and
corresponded to the following Green Finding example in Table 5.4-1: an EAL has been
rendered ineffective such that any Alert or Unusual Event would not be declared, or
declared in a degraded manner for a particular off-normal event. Therefore, using Figure
5.4-1, Significance Determination for Ineffective EALs and Overclassification, and the
example in Table 5.4-1, the inspectors determined the finding was of very low safety
significance (Green).
9
Enclosure
The finding had a cross-cutting aspect in the area of Human Performance, Documentation,
because Entergy did not maintain complete and accurate documentation. Specifically,
compensatory measures associated with out-of-service EAL instrumentation are not
governed by comprehensive and high-quality programs, processes, and procedures [H.7].
(Section 5.1)
Severity Level IV. An NRC-identified SL IV NCV of 10 CFR Part 50.72(b)(3)(xiii) was
identified when Entergy failed to make a required event notification within eight hours for a
major loss of assessment capability. Specifically, an unplanned loss occurred of all EAL
instrumentation associated with Sea Water Bay level that resulted in an inability to evaluate
all EALs for an abnormal water level condition. Entergy entered the issue into the CAP as
CR-PNP-2015-00949. Compliance was restored on February 5, 2015, when Entergy
reported the major loss of assessment capability under Event Notification50790.
The inspectors determined that Entergys failure to submit an event notification in
accordance with 10 CFR 50.72 within the required time was a performance deficiency that
was reasonably within Entergys ability to foresee and correct, and should have been
prevented. Since the failure to submit a required event report impacts the regulatory
process, the violation was evaluated using Section 2.2.4 of the NRCs Enforcement Policy,
dated July 9, 2013, instead of the SDP. Using the example listed in Section 6.9.d.9, A
licensee fails to make a report required by 10 CFR 50.72 or 10 CFR 50.73, the issue was
evaluated and determined to be a SL IV violation. The inspectors reviewed the condition for
reactor oversight process significance. Because this NRC-identified violation involves the
traditional enforcement process and does not have an underlying technical violation that
would be considered more-than-minor, the inspectors did not assign a cross-cutting aspect
to this violation in accordance with IMC 0612. (Section 5.2)
10
Enclosure
REPORT DETAILS
1.
Chronology of Events and Event Response Challenges
The team conducted a detailed review of the events leading up to, during, and following
the January 27, 2015 LOOP and resulting reactor scram at Entergys PNPS. The team
gathered information from operator narrative logs, the plant process computer, sequence
of events printouts, alarm printouts, and interviews with plant operators and engineering
staff to develop a detailed timeline of the event (Attachment 2). A diagram of the PNPS
switchyard is provided in Attachment 3. The following summary highlights the significant
events and challenges encountered by the PNPS staff:
Date/Time
Event
1/24
PNPS commenced storm preparations.
1/26
High winds and snow impact the site.
1/27 01:33
Control Room receives numerous grid disturbance alarms on 345 kilovolt
(kV) Line 355, operators reported flashing in the switchyard. Control
Room operators commenced power reduction per Procedure 2.1.42,
Operation during Severe Weather, and placed the safety-related Buses
A5 and A6 on the emergency diesel generators (EDGs) A and B,
respectively.
01:33-02:32
Line 355 power interrupted three times.
02:35
Line 355 is lost.
04:02
Reactor trip from 52 percent power due to generator load reject upon loss
of 345 kV Line 342. Per Emergency Operating Procedure (EOP)-1,
Reactor Pressure Vessel Control, operators closed the main steam
isolation valves and placed the RCIC system in level control and the high
pressure coolant injection (HPCI) system in pressure control mode.
04:12
Operators commenced a plant cooldown. Diesel-driven air compressor
K-117 attempted to start and failed to run on low instrument air header
pressure (sustained loss of instrument air).
09:48
Operators secured the HPCI system at approximately 120 psig reactor
vessel pressure, commencing reactor pressure control using SRVs and
the RCIC system. Operators commence periodic operation of the B CS
pump for level control.
09:53
HPCI system declared inoperable following receipt of Gland Seal
Condenser Blower Overload Alarm. Condensate discovered backing-up
through the blower due to the shutdown condensate flow path being
isolated to the Radioactive Waste Building (caused by loss of instrument
air).
10:56
Following challenges in controlling reactor pressure (pressure increased
from approximately 120 psig to 350 psig) and level, operators manually
start the RCIC system in the pressure control mode and begin to open
SRVs for longer periods of time to reestablish cooldown.
16:26
B residual heat removal (RHR) system placed in shutdown cooling.
16:46
EOP-1 exited.
16:57
Reactor temperature <212°F.
1/28 10:47
Instrument air system fully restored using a temporary diesel-driven air
compressor.
11
Enclosure
1/30 18:45
Offsite power restored via Lines 355 and 342 following de-icing and
inspection of the switchyard with the assistance of the grid operator,
1/31 01:30
Safety-related Buses A5 and A6 were restored to their normal offsite
power sources.
PNPS staff began making site preparations on January 24, 2015, in accordance with
plant procedures, for the impact of a forecasted winter storm in the Plymouth,
Massachusetts area. At 01:33 on January 27, during blizzard conditions, Control Room
operators observed numerous grid disturbance alarms associated with one of the two
offsite 345kV distribution lines, Line 355. In addition, operators in the field reported
electrical flash-overs in the switchyard. In accordance with Procedure No. 2.1.42,
Operation during Severe Weather, Revision 21, operators began lowering reactor
power based on the anticipated LOOP. One of the procedures objectives was to lower
reactor power below 130MWe, within the turbine bypass valve capability, to minimize a
potential reactor power transient. Operators transferred safety-related Buses A5 and A6
to their respective EDG sources and placed Reactor Protection System Bus A on its
alternate power supply, per procedure, to improve reliability based on the electrical grid
conditions. Additionally, offsite power remained available to Buses A5 and A6 via the
shutdown transformer (SDT) powered from the stations 23Kv line. At 02:35, Line 355
tripped and the line could not be returned to service.
Challenges
At 04:02, operators observed a generator load reject and automatic reactor scram when
the remaining offsite 345kV distribution line, Line 342, de-energized. Prior to that time,
no grid disturbance alarms originated on Line 342. Grid disturbances originating on Line
355 caused grid disturbance alarms on Line 342. Operators entered EOP-1, Reactor
Pressure Vessel (RPV) Control, due to reactor vessel level <12 inches caused by the
transient. Per EOP-1, Control Room operators closed the main steam isolation valves,
placed the RCIC system in service for RPV level control, and the HPCI system in service
in the RPV pressure control mode. At 04:12, operators commenced a plant cooldown.
All systems responded properly to the LOOP event with the exception of diesel-driven air
compressor K-117, which failed to automatically start and run on low instrument air
pressure. The failure of the K-117 air compressor to start resulted in a sustained loss of
instrument air. Control Room operators ability to cope with and recover from the loss of
instrument air was complicated by the absence of adequate procedural guidance. Refer
to Sections 3, 5, and 6 for detailed team observations and findings associated with the
loss of instrument air.
By 09:48, operators had reduced reactor pressure to approximately 120 psig. Because
of a higher than desired cooldown rate using the HPCI system and due to approaching
the HPCI system low pressure isolation setpoint, operators secured the HPCI system
and transitioned reactor pressure control to manually cycling SRVs and by using the
RCIC system in pressure control mode. RPV level control was achieved by periodically
injecting with the B CS pump.
Shortly after the HPCI system was secured, Control Room operators received the Gland
Seal Condenser Blower Overload Alarm. The cause was promptly determined to be
condensate and cooling water backing up into the blower after the normal discharge flow
path was automatically isolated and the standby flow path to the Radioactive Waste
12
Enclosure
Building was unavailable due to the loss of instrument air. The HPCI system was
declared inoperable per procedural requirements due to the gland seal condenser being
inoperable, however, the HPCI system was still considered available if required to
operate.
The team noted that prior to commencing pressure control by cycling SRVs, operators
raised reactor vessel level to the higher end of the EOP-1 prescribed level band.
Because RPV level was high in the allowable level band, operators opened the SRVs for
only brief periods of time to prevent the consequential RPV level swell from causing a
RCIC system high level isolation at +45 inches. In spite of these precautions, the RCIC
system did isolate at 10:16 on high level. The RCIC system was later restarted in
pressure control mode at 10:56. Complicating operators ability to appropriately control
RPV level was the inability to lower RPV level using the reactor water cleanup (RWCU)
system letdown valve that had failed close on the loss of instrument air. While being
challenged with RPV pressure and level control, reactor pressure increased from 120
psig (09:48) to approximately 330 psig (11:30). At that time, operators prioritized
maintaining an SRV open for longer periods of time to reduce pressure. Following this
change in priorities, the Control Room staff was successful in stabilizing RPV level and
pressure. In addition, a temporary air supply was aligned to the RWCU system letdown
isolation valve and normal RPV level control was restored. The team determined that
the SRVs were manually cycled 105 times (52 for the B SRV and 53 for the D SRV)
while attempting to stabilize pressure and control RPV level with the CS pump.
The team determined that the Control Room operators had planned to operate the B,
C, and D SRVs sequentially to reduce RPV pressure. The A SRV was not used due
to previously identified pilot valve leakage. During the first attempt to open the C SRV
from the Control Room, the expected system response was not observed. With the C
SRV open signal applied approximately 52 seconds, the tailpipe temperature increased
slightly, but the acoustic response was much lower than expected and no reactor
pressure reduction was observed. A second attempt was made to open the C SRV
leaving the open signal applied for 83 seconds, with similar results. Due to the apparent
failure of the C SRV to open on demand at this lower RPV pressure and temperature,
operators continued the RPV depressurization and cooldown using only the B and D
SRVs.
2.
Equipment Response to the Event
a. Inspection Scope
The team reviewed and assessed the initial equipment conditions and equipment
response including consistency with the plants design and regulatory requirements, and
identification of any potential design deficiencies. The team reviewed the adequacy of
associated operability assessments, technical evaluations, corrective and preventive
maintenance, and post-maintenance testing. The team also evaluated the safety
significance of equipment issues identified during the event as well as the impact on the
plants license, TS, regulatory requirements, and aging management programs. The
team reviewed the event timeline, the post trip Scram Report, operator narrative logs,
PNPS CAP CRs, modification packages, drawings, and component maintenance
histories. The team also attended an Operational Safety Review Committee meeting
associated with the operability of the plant SRVs.
13
Enclosure
b.
Findings and Observations
2.1
General Performance
Response to the LOOP and reactor scram event on January 27, 2015, was complicated
by several equipment performance issues. The loss of instrument air because the K-117
diesel-driven air compressor failed to start during the event, along with an inadequate
loss of instrument air abnormal operating procedure, complicated operator recovery
actions. Findings associated with these issues are documented in Sections 3, 5, and 6
of this report. In addition, the HPCI system was declared inoperable, but remained
available, following being secured due to the loss of the gland seal condenser because
of the loss of instrument air and the lack of appropriate procedural guidance.
More significantly, the C SRV did not open upon manual actuation to reduce reactor
pressure. Following disassembly, the valves manufacturer, Curtiss-Wright Flow Control
Company, Target Rock Division, issued 10 CFR Part 21 Interim Report (EN 50900) on
March 17, 2015, due to the potential to induce a defect during the testing of the relief
valve model (three stage Target Rock Model 0867F). On May 1, 2015, Curtiss-Wright
Flow Control Company provided an update to the interim report which stated that the
root cause was not yet determined. As a result of the failure of the C SRV to actuate
during the event, Entergy performed a detailed review of plant parameters associated
with past operations of Model 0867F. During the extent of condition review, Entergy
identified that the A SRV failed to open upon three manual actuations during a LOOP
event that occurred on February 9, 2013. A self-revealing preliminary White finding was
identified and is documented in Section 2.5.
2.2
HPCI System
Shortly after the reactor scram, the HPCI system was operated in the pressure control
mode (i.e., the system was operating in recirculation mode and the HPCI turbine was
removing steam/reducing reactor pressure). Operators shut down the HPCI system
several hours later, at 09:48, when reactor pressure was approaching 100 psig. A few
minutes later, the Gland Seal Condenser Hotwell High Level and Gland Seal Condenser
Blower Overload Alarms were received in the Control Room. Around 10:10, an operator
that was dispatched to the HPCI room reported an acrid smell in the HPCI room, the
gland seal condenser blower motor was hot to the touch, and that he observed water
streaming from the blower housing shaft seal area. There was no significant water
accumulation on the HPCI room floor at that time. Operators declared the HPCI system
inoperable (as of 09:48) in accordance with Procedure 2.2.21.5, HPCI Injection and
Pressure Control, and Procedure 2.2.21, HPCI System. Specifically, the procedure
stated that in the event the HPCI gland seal condenser becomes inoperable, excessive
shaft and valve stem leakage could result in the HPCI area coolers to reach and exceed
their heat load limits, and accordingly, the HPCI system shall be declared inoperable.
An operator again entered the HPCI room several hours later (around 13:00) and
reported approximately one inch of water on the HPCI room floor. The Control Room
Narrative Log indicated that EOP-4, Secondary Containment Control, was entered at
13:07 due to water in the HPCI compartment (greater than one inch). At 13:10, the
Operations Shift Manager determined that no emergency existed as there was no active
leak in the HPCI room and the suspected source of water was from the reactor building
sumps overflowing due to the loss of power. EOP-4 was exited at 13:34.
14
Enclosure
Condensation in the HPCI system from sources such as valve stem and turbine seal
leakage is routed to the HPCI gland seal condenser, which condenses the steam and
uses a condensate pump to return water to the HPCI pump suction (while HPCI is in
service) or to the radioactive waste system (when HPCI is shutdown). Any non-
condensable gases that accumulate in the gland seal condenser are routed via the gland
seal condenser exhauster (blower) to the reactor building ventilation or standby gas
treatment system. In the piping downstream of the condensate pump, there are two
series air-operated valves (AO-2301-64 and -65) that open when the HPCI system is
shut down to route the condensate to the radioactive waste system for processing.
However, during this event, the instrument air system was lost, and as a result, these
two valves failed in the closed position. This configuration resulted in continuing to fill
the HPCI suction piping and the gland seal condenser to the point that water began
leaking from the gland seal blower.
There is a curb that surrounds the gland seal condenser area in the HPCI room.
Therefore, the water that was leaking/spraying from the blower was largely isolated to
this curbed area. However, also at some time after the HPCI system was shut down, the
reactor building sumps, which are located inside the HPCI room (near the entrance)
overflowed into the HPCI room. The four associated sump pumps were not available
due to the loss of power. The majority of the water that comprised the one inch of water
on the HPCI floor was suspected to be from the reactor building floor drain sump.
2.3
SRV Performance
PNPS has four SRVs, manufactured by Target Rock, located on the steam lines inside
the primary containment. They are three-stage dual function valves that operate in a
safety mode or a relief mode. The SRVs comprise the ADS, which is designed to
depressurize the reactor, in the event the HPCI system cannot maintain reactor water
level during certain postulated accidents so that the low pressure emergency core
cooling system (ECCS) can inject water. The SRVs provide: 1) over-pressure relief
operation (self-actuated to limit the pressure rise and prevent spring safety valve
opening); 2) over-pressure safety operation (augment the spring safety valves by
opening in order to prevent RPV over-pressurization); and 3) depressurization operation.
The SRVs are designed with controls to open and close the valves at any steam
pressure above 104 psig, and capable of holding the valves open until the steam
pressure decreases to about 50 psig.
During the January 27, 2015 transient, the operators planned to operate the B, C, and
D SRVs sequentially to reduce reactor pressure in accordance with emergency
procedures. The A SRV was not planned to be used due to previously identified pilot
valve leakage, but was considered by Entergy to be available for use if needed. After
successfully cycling the B SRV, operators applied an open demand to the C SRV for
52 seconds at a reduced plant pressure of approximately 220 psig; however, the
expected system response did not accompany the open demand. Specifically, although
the tailpipe temperature increased (indicative of steam exhausting to the torus), the
acoustic monitor response was less than normal, and reactor pressure continued to
increase. For the next 15 minutes, operators continued to depressurize using other
SRVs, and then attempted to cycle the C SRV again. This time, the open demand
remained for 83 seconds; tailpipe temperature increased and the associated acoustic
monitor indicated a normal response (that the SRV was open), but reactor pressure did
not respond as expected. Due to the abnormal response from the C SRV at reduced
15
Enclosure
plant pressure, operators continued to operate both the B and D SRVs over about a
three hour period, cycling them 52 and 53 times, respectively. The SRVs were cycled
frequently and for short duration (5 - 10 seconds) due to concerns with the associated
reactor vessel water level swell when each SRV opens. The consequence of a high
reactor water level is that the RCIC system would isolate, and in fact, the system did
isolate during the cooldown. The D SRV was subsequently opened and remained open
for about three hours to achieve an effective pressure reduction.
Subsequent to the resulting plant shutdown, Entergy conducted limited as-found
testing of the C SRV while still installed, and removed both the A and C SRVs from
service. The installed as-found test of the C SRV was conducted on January 31, 2015,
and was observed by the NRC resident inspector. This test verified solenoid operation
and movement of the air actuator plunger locally. This was done when the RPV was
depressurized, so there was no operation of the valve internals (no pressure source to
move the main valve). Both the solenoid and associated air operator moved as
designed, with timely solenoid actuation and smooth actuator travel in both directions.
This successful test confirmed only that the solenoid and air operator were free to move
and responded to an actuation signal.
The C SRV was subsequently sent to an offsite testing facility for as-found setpoint
verification, low pressure testing, and an inspection of valve internal components. While
the C SRV satisfactorily stroked during both the setpoint test and additional low
pressure (100 psig) actuation test at the testing facility, the inspection revealed notable
damage to some internal valve main stage parts. Specifically, the main valve piston had
indications of some scoring and the lower piston ring (two rings in total) was seized
within the piston ring. The most noteworthy damage was wear (grooves) in the main
operating cylinder liner where the operating piston rings rest while the valve is in its
closed position. The cylinder liner wear resulted in resistance to valve operation in the
open direction through contact with the operating piston rings. Upon the disassembly,
the technicians noted that the piston was not tightly secured and the locking tab was
slightly rotated out of its grooved position. In its normal/assembled condition, the main
valve stem is threaded into the main piston, torqued, and is secured with a washer and
stem nut with locking tab on the opposite side of the piston (See SRV figure below).
16
Enclosure
The assembly of the valve is such that the main stem is torqued to the piston (100 ft-lbs)
and the stem nut is torqued to the threaded end of the main stem (50 ft-lbs). However,
there has been prior operating experience, including an instance at PNPS in 2013,
where the stem nut was found loose. Based on prior operating experience, there have
been separate issues that may have contributed to torque relaxation or looseness at the
stem/piston or stem nut interface. These included 1) inadequate stem shoulder contact
at the main stem/piston interface, 2) inefficient test gag device that potentially allowed
substantial internal valve impact during full pressure setpoint testing, and 3) a stem nut
torque value that was less than optimal. It was not apparent that a single item alone was
the cause for the identified issues. Further, based on historical operating and internal
inspection data, internal wear problems were not assured even when the old style test
gag device and lower stem nut torque existed (i.e., human performance/installation and
specific in-service vibration levels may also have had negative impacts). The testing
facility currently uses a re-designed test gag device to prevent a large impact force
during the full pressure bench testing, and the vendor recommended an increased stem
nut torque value (100 ft-lbs) in December 2013.
Entergy also sent the A SRV for as-found testing and internals inspection. As stated
earlier, the valve was not selected for cycling during the transient, although it was
considered to be available (the valve was not selected because it previously had a
known pilot valve leak). Both the as-found full pressure lift, including setpoint
Diagram of Target Rock SRV from
NRC Information Notice 2003-01, Failure
of Boiling Water Reactor Target Rock Main
Steam Safety/Relief Valve, dated
January 15, 2003
17
Enclosure
verification, and the 100 psig SRV lift were completed satisfactorily at the testing facility.
However, disassembly and inspection of the valves internal parts yielded similar results
(e.g., operating cylinder liner wear) to that of the C SRV. As a result of the as-found
inspection results of the A and C SRVs, Curtiss-Wright Flow Control Company, Target
Rock Division, issued Interim 10 CFR Part 21 Interim Report (EN 50900) on March 17,
2015, due to the potential to induce a defect during the testing of the relief valve model
(three stage Target Rock Model 0867F).
During the shutdown following the January 27, 2015, reactor scram, Entergy replaced
both the A and C SRVs with refurbished and certified replacement SRVs. Both were
tested with the new test gag design. The A SRV was refurbished prior to the stem nut
torque value change so it was torqued to 50 ft-lbs, and the stem nut for the C SRV,
refurbished later, was torqued in accordance with revised instructions and was torqued
to 100 ft-lbs. With respect to the B and D SRVs, which operated satisfactorily during
the transient, they had both previously been tested prior to their May 2013 installation
and both had a 50 ft-lb torque applied to the stem nut.
2.4
Past Operability Evaluation of C SRV
Introduction. The team identified a Green NCV of 10 CFR 50, Appendix B, Criterion V,
Instructions, Procedures, and Drawings, when Entergy staff performed an inadequate
past operability determination that assessed performance of the C SRV which did not
open as expected when called upon to function. Specifically, following the January 27,
2015, reactor scram, operators placed an open demand for the C SRV twice during
post-scram recovery operations, but the valve did not respond as expected and did not
perform its pressure reduction function on both occasions. Entergys subsequent past
operability assessment for the valves operation incorrectly concluded that the valve was
fully capable of performing its required functions during its installed service.
Description. Following the SRV issues and in particular, the January 27, 2015
unexpected in-service response of the C SRV, Entergy conducted operability
evaluations, both for the prior condition of the C SRV (past operability) and for all four
currently installed SRVs. Entergy examined and assessed SRV data for the B and D
SRVs following the transient and multiple SRV cycles, and concluded that there were no
abnormalities evident from the data. Entergy also reviewed prior test data, including the
as-left full pressure lift test for the B and D SRVs when they were installed in May
2013; both tests were satisfactory. Based on the information reviewed, Entergy judged
both the B and D SRVs to be operable. With respect to the newly installed
replacement A and C SRVs, Entergy confirmed that both SRVs were full pressure lift
setpoint verified using the re-designed test gag device, which minimized the potential for
loss of stem nut preload due to impact forces. In addition, both A and C SRVs were
satisfactorily tested on February 7, 2015, during plant startup activities.
Entergys past operability evaluation (CR-PNP-2015-00561), dated February 5, 2015, for
the C SRV that was removed following the January 27, 2015 reactor scram concluded
that during the first manual operation of the SRV, there was only a partial opening stroke
on the main stage disc; and a full opening (but slower than the open stroke seen on the
B and D SRVs) on the second manual operation. The evaluation also noted that the
subsequent bench tests, conducted at the testing facility, demonstrated acceptable SRV
operation both during the as-found set pressure test (over-pressure lift) and the special
test using the air actuator (at 100 psig). Entergys past operability evaluation concluded
18
Enclosure
that the C SRV was fully capable of performing its required functions during its installed
service, and the ADS was fully operational during the time that the C SRV was
installed, as evidenced by its successful lift during its initial startup test and as-found lift
test after its removal (SRV main seat opening forces are significantly higher at full
reactor pressure). They further concluded that the observed operation at low reactor
pressure (during post-scram operations) would not have prevented its successful
operation to continue with the depressurization of the reactor had the continued use of
C SRV been required.
The team reviewed Entergys operability assessment, which was completed to support
reactor startup following the LOOP event, and found that Entergy demonstrated that
there was reasonable assurance of continued SRV operability for the four installed
SRVs. In particular, the history of similar SRV challenges appears to have been the
result of a combination of several factors. Based on a review of the valve assembly
data, stem shoulder contact, laboratory testing technique/device (test gag), and main
stem to stem nut torque, the team concluded that there was reasonable assurance that
the installed SRVs could perform their intended functions.
However, the team did not agree with Entergys past operability assessment associated
with the C SRV. Although data shows that the valve did in fact open at least partially
and slowly, it did not achieve the design function result intended to reduce reactor
pressure. Updated Final Safety Analysis Report Section 4.4.5 stated that for
depressurization operation, each relief valve is provided with a power actuated device
capable of opening the valve at any steam pressure above 100 psig, and capable of
holding the valve open until the steam pressure decreases to about 50 psig. As this is a
design function of the valve and it was not able to perform this function, the team
considered this valve to be inoperable for this function. Further, TS 3.5.E, Automatic
Depressurization System (ADS), required that the system shall be operable when
reactor pressure is greater than 104 psig. As stated earlier, Control Room operators
discontinued further use of this valve after two attempts because it failed to achieve the
desired pressure reduction result. The team acknowledged that the valve likely would
have performed its over-pressure and ADS function at normal operating pressure due to
the significantly higher opening forces in that condition, but would not (and did not)
perform acceptably at lower reactor pressure. Considering the above, the team
concluded that the past operability assessment for the C SRV was inadequate.
Procedure EN-OP-104, Operability Determination Process, Revision 7, provides a
process to assess operability and functionality when degraded or nonconforming
conditions affecting structures, systems, and components (SSCs) are identified. The
procedure (Definitions - Specified Safety Function) stated that, in addition to providing
the specified safety function, a system is expected to perform as designed, tested, and
maintained. When system capability is degraded to a point where it cannot perform with
reasonable expectation of reliability, the system should be judged inoperable. If the
component or system cannot perform at the level required by TSs, then it should be
considered inoperable. Section 5.11.[12](c) of the procedure stated that when an SSCs
capability or reliability is degraded to the point where there is no longer a reasonable
expectation that it can perform its specified safety function, the SSC should be judged
inoperable. The team concluded that there was not a reasonable expectation of
operability, in particular during low pressure operations, and that Entergy incorrectly
concluded that the C SRV was fully capable of performing its required functions
because Procedure EN-OP-104 was not followed. Also, Procedure EN-LI-102,
19
Enclosure
Corrective Action Program, Revision 24, defined significant conditions adverse to
quality as failures, malfunctions, deficiencies, deviations, defective material and
equipment, and nonconformances that adversely affect the safety-related functions of
SSCs deemed significant based on actual or potential consequences to nuclear safety;
and these conditions require the cause of the condition to be determined and corrective
action taken to preclude repetition. In addition, Section 5.5.[2] of the procedure stated
that CRs assigned a Significance Category A (which would be the category for a
significant condition adverse to quality) require a root cause evaluation and corrective
action to preclude repetition. Only an equipment apparent cause analysis was assigned
to evaluate the degraded C SRV performance; and therefore, specific root causes
would not necessarily be identified, and appropriate associated corrective actions to
preclude repetition may not be developed and implemented.
In response to the teams past operability concerns, Entergy subsequently re-evaluated
the past operability of C SRV and concluded that it was inoperable; they initiated CR-
PNP-2015-02051 to document and address this issue.
There has been prior operating experience in the area of similar SRV issues, including
problems at both PNPS and other nuclear utilities. Both the valve vendor and testing
facility have also issued generic communications that included recommendations and
corrective actions. The team found that the parties involved have been appropriately
incorporating these actions (i.e., main stem shoulder engagement, improved test gag
design, stem nut torque values). However, continued generic assessment is warranted
based upon this most recent operational problem. Entergys evaluation (CR-PNP-2015-
00908, Corrective Action 4) is expected to evaluate any additional generic issues
associated with this issue. In addition, Entergy removed all four SRVs during the April
2015 refueling outage to conduct the required full pressure setpoint verification/bench
test as well as conducting a valve disassembly and inspection to confirm the as-found
condition of these valves.
Analysis. The team determined the failure to adequately assess past operability of the
C SRV was a performance deficiency that was reasonably within Entergys ability to
foresee and correct. This NRC-identified performance deficiency is more than minor
because it is associated with the equipment performance attribute of the Mitigating
Systems cornerstone and affects the cornerstone objective of ensuring the availability,
reliability, and capability of systems that respond to initiating events to prevent core
damage. The team evaluated the finding using IMC 0609, Appendix 0609.04, Initial
Characterization of Findings, which directed the use of IMC 0609, Appendix A, The
Significance Determination Process (SDP) for Findings At-Power. Using Exhibit 2,
Mitigating Systems Screening Questions, of IMC 0609, Appendix A, the team
determined this finding was not a design or qualification deficiency and was not a
potential or actual loss of system or safety function, and is therefore of very low safety
significance (Green).
The finding had a cross-cutting aspect in Human Performance, Conservative Bias,
because Entergy did not use decision making practices that emphasized prudent
choices over those that are simply allowable. Specifically, Entergy did not appropriately
evaluate unexpected and unsatisfactory performance of the C SRV in consideration of
the entire pressure range that the SRV, including its ADS function, was required to be
operable [H.14].
20
Enclosure
Enforcement. 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and
Drawings, states, in part, that activities affecting quality shall be prescribed by
documented instructions, procedures, or drawings and shall be accomplished in
accordance with these instructions, procedures, or drawings. Procedure EN-OP-104,
Operability Determination Process, Revision 7, states, in part, that when an SSCs
capability or reliability is degraded to the point where there is no longer a reasonable
expectation that it can perform its specified safety function, the SSC should be
judged inoperable. Contrary to this, on February 5, 2015, Entergy performed a past
operability determination of the C SRV (following the January 27, 2015 reactor scram),
and concluded that the valve was operable during its installed service despite its failure
to perform its pressure reduction function when manually actuated twice by operators.
Because this finding is of very low safety significance and has been entered into
Entergys CAP as CR-PNP-2015-02051, this violation is being treated as an NCV,
consistent with Section 2.3.2.a of the NRC Enforcement Policy. (NCV
05000293/2015007-01, Inadequate Past Operability Assessment of C Safety Relief
Valve)
2.5
Self-Revealing Preliminary White Finding and AV of Criterion 16 and TS 3.5.E
Introduction. A self-revealing preliminary White finding and AV of 10 CFR 50, Appendix
B, Criterion XVI, Corrective Action, and TS 3.5.E, Automatic Depressurization
System, was identified for the failure to identify, evaluate, and correct a significant
condition adverse to quality associated with the A SRV. Specifically, Entergy failed to
identify, evaluate, and correct the A SRVs failure to open upon manual actuation during
a plant cooldown on February 9, 2013. In addition, the failure to take actions to preclude
repetition resulted in the C SRV failing to open due to a similar cause following the
January 27, 2015, LOOP event.
Description. During Entergys investigation of the January 27, 2015 partial LOOP event,
Entergy staff reviewed plant parameter data associated with historical SRV actuations.
During the review, Entergy staff determined that the A SRV similarly did not open
during manual actuations on February 9, 2013, during a plant cooldown following a
LOOP event. This determination was based on Entergys review of the response of
reactor pressure, level, local suppression pool temperature, and SRV tailpipe
temperature.
Entergy identified that, during the February 9, 2013, event, operators attempted to utilize
the A SRV to reduce reactor pressure on three occasions (at 114 psig, 101 psig, and at
98 psig). The operators observed that the A SRV did not yield the appropriate tailpipe
acoustic monitor response, although tailpipe temperature did show an increase.
Following the third opening without observing the appropriate acoustic monitor response,
operators only utilized the C and D SRVs for plant cooldown [note that the operators
considered that the B SRV was less desirable to use due to previously-observed pilot
valve leakage]. Operators wrote CR-PNP-2013-00825 to document the condition and
recommended an action to evaluate performance of the A SRV. Although the CR
discussed the acoustic monitor and SRV tailpipe responses to the opening demand, no
other information of other plant parameters that are normally used to verify an SRV
opening (e.g., reactor level swell, reactor pressure) was documented. The only action
that resulted from CR-PNP-2013-00825 was the replacement of components associated
with the A SRVs acoustic monitor. CR-PNP-2013-00825 documented the conclusion
that no degraded or nonconforming condition existed because the tailpipe thermocouple
21
Enclosure
indicated that the SRV opened based on tailpipe temperature response. The inspectors
noted that although tailpipe temperature did increase following the open demand due to
SRV pilot valve operating, the temperature increase was lower than would be expected
for an open SRV main valve disc.
The inspectors reviewed CR-PNP-2013-00825 and plant parameter data. The team
concluded that information was available, both real-time and post-trip, such that Entergy
could have reasonably identified that the A SRV did not open upon manual actuation
demand on three occasions during the February 9, 2013 plant cooldown. Specifically:
Operators could have reasonably identified that the A SRV did not open based on
lack of reactor pressure response (pressure increased) and that no expected
indicated reactor vessel level swell was observed. Although the valve open demand
was applied for over 1.5 minutes during the first attempt to open the valve at a
reactor pressure of 114 psig, no reactor pressure decrease or reactor vessel level
swell, consistent with the valve opening, occurred. During two subsequent, shorter
opening attempts, similar indications were available.
Review of the work orders that documented the work performed on the A SRV
acoustic monitor following the February 9, 2013 LOOP event did not identify that a
problem existed which impaired the instruments ability to respond to a valve opening
event. No as-found functional testing was performed. Maintenance workers
identified an electrical ground on the system. However, the conditions effect on the
systems ability to respond to the A SRV tailpipe acoustic response was not further
reviewed.
Entergys post-trip event review performed a review of plant equipment performance
during the event. However, although CR-PNP-2013-00825 suggested an evaluation
of the A SRV performance during the February 9, 2013 LOOP event, the post-trip
event review did not identify performance issues with the A SRV. The inspectors
judged that information was available to the post-trip review team to determine that
the A SRV did not open during open demand actuation attempts.
Analysis. Entergys failure to identify, evaluate, and correct the condition of the A
SRVs failure to open upon manual actuation during a plant cooldown on February 9,
2013, was a performance deficiency. In addition, the failure to take actions to preclude
repetition resulted in the C SRV failing to open due to a similar cause following the
January 27, 2015 LOOP event. The self-revealing finding was within Entergys ability to
foresee and correct because indications were available to determine that the A SRV
valve did not open upon manual actuation. This was discovered as a result of an extent
of condition review of the C SRV failing to open upon manual actuation following the
January 27, 2015 LOOP event. This performance deficiency is more than minor
because it could reasonably be viewed as a precursor to a significant event if two of the
four SRVs failed to open when demanded to depressurize the reactor, following the
failure of high pressure injection systems or torus cooling, to allow low pressure injection
systems to maintain reactor coolant system inventory following certain initiating events.
In addition, it is associated with the Mitigating Systems cornerstone attribute of
equipment performance and affected the cornerstone objective of ensuring the
availability, reliability, and capability of systems that respond to initiating events to
prevent undesirable consequences.
The inspectors screened this issue for safety significance in accordance with IMC 0609,
Appendix A, Exhibit 2, Mitigating Systems Screening Questions, issued June 19, 2012.
22
Enclosure
The screening determined that a detailed risk evaluation was required because it was
assumed that for a one year period, two of the four SRVs were in a degraded state such
that they potentially would not have functioned to open at an undetermined pressure
lower than rated pressure and would not fulfill their safety function for greater than the
TS allowed outage time. Specifically, the assumptions of failures to open were based on
a failed actual opening demand at 200 psig reactor pressure on January 27, 2015, for
the C SRV; examination of the valve internals at the testing vendor (National Technical
Systems); and a previous failed actual opening demand at 114 psig reactor pressure on
February 9, 2013, for the A SRV.
The staff determined that there wasnt an existing SDP risk tool that is suitable to assess
the significance of this finding with high confidence, mainly because of the uncertainties
associated with: the degradation mechanism and its rate; the range of reactor pressure
at which the degraded valves could be assumed to fully function; any potential benefit
from an SRV lifting at rated pressure, such that the degradation would be less likely to
occur and, therefore, prevent a subsequent failure at low pressure in the near-term; the
time based nature of plant transient response relative to when high pressure injection
sources fail and the associated impact of reduced decay heat on the SRV
depressurization success criteria; and the ability to credit other high pressure sources of
water.
Based on the considerations above, the risk evaluation was performed using IMC 0609,
Appendix M, Significance Determination Process Using Qualitative Criteria, issued
April 12, 2012. A planning Significance Determination Process Enforcement Review
Panel (SERP) was conducted on April 7, 2015, which concurred with using Appendix M
in this case. The use of Appendix M is appropriate because it is intended to be used
when the probabilistic risk assessment methods and tools, including the existing SDP
appendices, cannot adequately address the findings complexity or provide a reasonable
estimate of the significance due to modeling and other uncertainties within the
established SDP timeliness goal of 90 days or less.
The NRC made a preliminary determination that the finding was of low to moderate
safety significance (White) based on quantitative and qualitative evaluations. The
detailed risk evaluation is contained in Attachment 4 to this report.
This finding had a cross-cutting aspect in Problem Identification and Resolution,
Evaluation, because Entergy did not thoroughly evaluate issues to ensure that
resolutions address causes and extent of conditions commensurate with their safety
significance. Specifically, Entergy staff did not thoroughly evaluate the operation of the
A SRV during the February 9, 2013 plant cooldown and should have reasonably
identified that the A SRV did not open upon three manual actuation demands [P.2].
Enforcement. 10 CFR 50, Appendix B, Criterion XVI, Corrective Action, requires, in
part, that measures shall be established to assure that conditions adverse to quality,
such as failures, malfunctions, and deficiencies, are promptly identified and corrected.
In the case of significant conditions adverse to quality, the measures shall assure that
the cause of the condition is determined and corrective action taken to preclude
repetition. TS 3.5.E, Automatic Depressurization System, requires the ADS to be
operable whenever there is irradiated fuel in the reactor vessel and the reactor pressure
is greater than 104 psig and prior to a startup from a Cold Condition. From and after the
date that one valve in the ADS is made or found to be inoperable for any reason,
23
Enclosure
continued reactor operation is permissible only during the succeeding 14 days.
Otherwise, an orderly shutdown of the reactor shall be initiated and the reactor shall be
in the Cold Shutdown condition within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
Contrary to the above, on February 9, 2013, measures established by Entergy did not
assure that a significant condition adverse to quality was promptly identified, or that the
cause of the condition was determined and corrective actions taken to preclude
repetition. Specifically, indications were available that the A SRV did not open upon
manual actuation during the February 9, 2013 LOOP event. Although this constituted a
significant condition adverse to quality, Entergy failed to identify and correct the
condition, or to take actions to preclude repetition, resulting in a similar occurrence when
the C SRV did not open upon manual actuation during a subsequent LOOP event on
January 27, 2015. As a consequence of this failure, PNPS also violated TS 3.5.E
because the A SRV was rendered inoperable from February 9, 2013, until the valve
was removed from service following the January 27, 2015 LOOP event (greater than the
14 day allowed outage time). Entergy entered this issue in to the CAP as CR-PNP-
2015-01983, CR-PNP-2015-00561, and CR-PNP-2015-01520. This finding does not
present a current safety concern because the A and C SRVs were replaced during the
outage following the January 27, 2015 LOOP and reactor trip event. Also, Entergy
performed a detailed operability analysis of the installed SRVs which concluded that a
reasonable assurance of operability existed. (AV 05000293/2015007-02, Failure to
Identify, Evaluate, and Correct A SRV Failure to Open Upon Manual Actuation)
3.
Event Diagnosis and Crew Performance
a. Inspection Scope
The team reviewed and assessed operator performance during plant preparations for
the storms approach to the PNPS area, during the LOOP and reactor scram event, and
during plant stabilization and plant cooldown to Cold Shutdown. The team reviewed the
event timeline, plant procedures, operating narrative logs, communications (internal and
external), the post trip Scram Report, and PNPS CAP CRs. The team interviewed
Control Room operators who were on shift during the storms approach and during the
LOOP event and the relief operators who performed the plant cooldown to Cold
Shutdown. The team utilized the plant Control Room simulator to verify that the plant
response was consistent with the design and that operator actions during the event were
consistent with plant procedures and operator training.
b. Findings and Observations
3.1
General Performance
The team performed a detailed review of operator performance during the event.
Operator performance was challenged by the LOOP and loss of instrument air. The loss
of instrument air resulted in the HPCI system gland seal condenser overflowing and loss
of RWCU letdown flow, which complicated RPV level control. This resulted in excessive
cycling of the B and D SRVs for pressure control after HPCI was secured. Individual
issues and notable observations are discussed in 3.2 through 3.5 below.
24
Enclosure
3.2
Loss of Instrument Air
Introduction. A self-revealing Green NCV of TS 5.4.1, Procedures, was identified
because Entergy failed to include appropriate operator actions to both recognize the
effects of, and recover systems and components important to safety within abnormal
operating procedure 5.3.8, Loss of Instrument Air.
Description. During review of the LOOP and reactor scram event on January 27, 2015,
the team identified that Procedure 5.3.8, Loss of Instrument Air, was inadequate to
provide operator guidance to both identify key adverse effects on the plant and operator
actions to conduct recovery actions to stabilize the plant. During interviews with the
team, on-shift licensed operators stated that the effects of the loss of instrument air were
not immediately recognized or well understood because of the lack of procedural
guidance. The inspectors also noted that a sustained loss of instrument air simulator
scenario had never been performed. The inspectors determined that if the scenario had
been performed, at least some of the inadequate guidance provided by Procedure 5.3.8
would have been identified. Examples of plant systems affected by the loss of
instrument air and not identified in Procedure 5.3.8 as being affected included; HPCI,
RWCU, Control Room Condensate Storage Tank (CST) level indicator LI-3503A, and
Control Room Sea Water Bay level indicators.
The lack of an adequate loss of instrument air abnormal operating procedure adversely
affected the following operator actions and plant equipment on January 27, 2015, during
the loss of instrument air following the LOOP and reactor scram:
The HPCI system was declared inoperable upon discovery of the effects of the gland
seal condenser hotwell pump air operated drain valves to radioactive waste, the
normal shutdown flow path, failing closed due to the loss of instrument air. When the
HPCI system was shut down by Control Room operators, the normal operating flow
path from the turbine gland seal hotwell pump discharge to the HPCI pump suction
became unavailable by design. This caused water to overfill the gland seal
condenser hotwell which caused the Gland Seal Condenser Blower Overload Alarm
to be received. Operators were unaware of the impact that loss of instrument air
would have on the securing of the HPCI system.
RWCU letdown valve CV-1239 failed closed eliminating RWCU letdown which led to
the excessive cycling of SRVs for short durations to keep reactor water level in band
(less than +45 inches) so that RCIC would not isolate when level swelled. RWCU
letdown was recovered approximately ten hours after loss of instrument air following
the implementation of an emergent modification to supply CV-1239 with nitrogen
from portable cylinders.
Sea Water Bay level indicators (LI-3831A and LI-3831B) became inoperable which
eliminated the ability to monitor EAL entry conditions for abnormal Sea Water Bay
level with the lack of an established backup monitoring method. Operators were
unaware of the impact that loss of instrument air would have on intake level EAL
declarations.
The loss of CST level instrumentation (LI-3503A and LI-3503B) directly affected the
operating crews decision to not operate the CS system with preferred suction on the
CST for reactor pressure vessel inventory control. Procedure 5.3.8 did not provide
this procedural guidance.
25
Enclosure
Two separate temporary instrument air compressors were required to be installed
with a temporary modification in order to restore instrument air pressure. With the
use of the first temporary air compressor, the attempt to restore air pressure 13
hours into the event resulted in only achieving an instrument air pressure of 80 psig.
A second temporary air compressor was needed to obtain and stabilize air pressure
at 100 psig approximately 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> after the initial loss of instrument air. The loss of
instrument air procedure did not identify any temporary air compressor
contingencies.
Analysis. The inspectors determined that the level of detail in Procedure 5.3.8, Loss of
Instrument Air, Revision 39, was inadequate to provide appropriate operator guidance
to identify and mitigate key events of January 27, 2015. This self-revealing performance
deficiency was reasonably within Entergys ability to foresee and the issue should have
been prevented. The finding was more than minor because it was associated with the
procedure quality attribute of the Mitigating System cornerstone and adversely affected
the cornerstone objective of ensuring the availability, reliability, and capability of systems
that respond to initiating events to prevent undesired consequences. The lack of
adequate instructions in the procedure adversely affected several operator actions and
plant equipment on January, 27, 2015, during the LOOP and loss of instrument air.
The team evaluated the finding using IMC 0609, Appendix A, Exhibit 2, Mitigating
Systems Screening Questions. The team determined this finding was of very low safety
significance (Green) because it was not a design or qualification deficiency, did not
result in a loss of function of a TS required system, and did not represent an actual loss
of function of one or more non-TS trains of equipment designated as a high safety-
significant system.
This finding had a cross-cutting aspect in the area of Human Performance, Resources,
because Entergy leaders did not ensure that personnel, equipment, procedures, and
other resources were available and adequate to support nuclear safety [H.1].
Enforcement. TS 5.4.1, Procedures, requires that written procedures shall be
established, implemented, and maintained covering the activities recommended in
Regulatory Guide (RG) 1.33, Revision 2, Appendix A, February 1978. RG 1.33,
Appendix A lists loss of instrument air under Procedures for Combating Emergencies
and other significant Events.
Contrary to TS 5.4.1, Entergy failed to establish and maintain a procedure to address the
loss of instrument air with appropriate direction for combating the event. Specifically,
Procedure 5.3.8, Loss of Instrument Air, Revision 39, failed to provide mitigating
operator actions for multiple systems which directly impaired licensed operator actions
and affected the ability to stabilize and cool down the plant during the LOOP and loss of
instrument air events on January 27, 2015. Licensed operator actions were impaired, in
part, due to the procedure not identifying the effects on important plant
systems/components or lack of identification of component restoration or compensatory
actions associated with important plant systems and components. Examples of systems
adversely affected by the loss of instrument air and not identified as being affected in the
abnormal procedure included: the HPCI system, the RWCU system, and Sea Water Bay
level indicators. Entergy entered this issue into the CAP as PNP-CR-2015-0888 and
issued a revision to Procedure 5.3.8 to provide additional guidance to operators during a
26
Enclosure
loss of instrument air. However, because the finding was of very low safety significance
(Green) and has been entered into the CAP, this violation is being treated as an NCV,
consistent with section 2.3.2.a of the NRC's Enforcement Policy. (NCV
05000293/2015007-03, Inadequate Loss of Instrument Air Abnormal Operating
Procedure)
3.3
RCIC Manual Restart
Introduction. A self-revealing Green NCV of TS 5.4.1, Procedures, was identified
because the operating crew failed to implement a procedure step to open the RCIC
system cooling water supply valve during a manual startup of the RCIC system. As a
result, the RCIC system was operated for over 2 1/2 hours with no cooling water being
supplied to the lubricating oil cooler or to the barometric condenser.
Description. While the operating crew was conducting a reactor cooldown on
January 27, 2015, with SRVs, reactor level control was being augmented with the use of
RCIC. At 10:16, the RCIC system tripped on high reactor vessel level when an SRV
was opened to control reactor pressure. The RCIC system trip was caused by reactor
vessel level swell rising above the 45 inch trip signal.
When the RCIC system was restarted at 10:56 in accordance with Procedure 5.3.35.1,
Attachment 29, RCIC Injection - Manual Alignment Checklist, the reactor operator
failed to open MO-1301-62, cooling water supply valve, in accordance with procedure
step 2. Step 2 stated: Open/Verify Open MO-1301-62, Cooling Water Supply Valve.
The failure to open MO-1301-62 was an operator human performance error.
Water from the discharge of the RCIC pump supplies the cooling medium for the RCIC
system turbine lubricating oil cooler and the gland seal condenser via valve MO-1301-
62. The pumps suction is normally lined up to the CST. At 10:58, the Control Room
received the Vacuum Tank Pressure Hi Alarm, C904L-F3. The alarm response
procedure identified improper valve lineup under possible causes for the alarm. A
dispatched equipment operator reported at 11:15 that the level in the RCIC vacuum tank
was normal at 1/2 full with no apparent leaks.
Between 12:22 and 12:49, multiple A bus 125 volts direct current (VDC) ground alarms,
C3RC-C7, were received and cleared. At 12:57, the Control Room received the Vacuum
Tank Level High Alarm. This alarm provided another opportunity to investigate the valve
lineup because the alarm response procedure stated to investigate the cause of the
alarm as an operator corrective action. An engineering walk down of the system at
13:10 identified that the barometric condenser vacuum tank sight glass was empty, the
vacuum tank was pressurized to 1.5 psig, and the vacuum tank temperature was 220°F.
Without adequate vacuum in the barometric condenser vacuum tank, the site attributed
that a pump motor (gland seal vacuum pump and/or gland seal condensate pump)
experienced some moisture from out of its pump seal due to the vacuum tank being
pressurized. Both the gland seal vacuum pump and the gland seal condensate pump
motors are powered from A 125 VDC power panel D-7.
Additionally, the pressurized vacuum tank had the potential to cause excessive gland
seal condensate pump leakage. Procedure 2.22.22, Reactor Core Isolation Cooling,
step 5.2, requires RCIC shall be declared inoperative whenever its barometric
condenser condensate pump is inoperative.
27
Enclosure
MO-1301-62 was identified as being in the wrong position as the RCIC system was
being secured at 13:32. The control switch for MO-1301-62 remained in the Auto
position. The control switch should have been positioned to the Open position when
RCIC was manually restarted. The team determined that there was no cooling water
supplied to the RCIC lubricating oil cooler or the barometric condenser from the start of
the RCIC system at 10:56 until it was secured at 13:32.
Analysis. The inspectors determined that the failure to implement Procedure 5.3.35.1,
Attachment 29, RCIC Injection - Manual Alignment Checklist, and the Vacuum Tank
Pressure Hi, C904L-F3, alarm response procedure was a performance deficiency and
was reasonably within the ability of Entergy personnel to foresee and prevent. This self-
revealing finding was more than minor because it was associated with the human
performance attribute of the Mitigating System cornerstone and adversely affected the
cornerstone objective of ensuring the availability, reliability, and capability of systems
that respond to initiating events to prevent undesired consequences. Specifically, on
January 27, 2015, reactor operators failed to open MO-1301-62, cooling water supply
valve, during a manual restart of the RCIC system in accordance with Procedure
5.3.35.1, Attachment 29, RCIC Injection - Manual Alignment Checklist. Additionally,
the operating crew failed to identify the valve was out of position even after the Vacuum
Tank Pressure Hi Alarm, C904L-F3, was received two minutes after the system was re-
started and the alarm response procedure identified Improper Valve Lineup as a
probable cause.
The team evaluated the finding using IMC 0609, Appendix A, Exhibit 2, Mitigating
Systems Screening Questions. The team determined this finding was not a design or
qualification deficiency and was not a potential or actual loss of system or safety
function, and is therefore of very low safety significance (Green). During the period
when the RCIC system was operated in this condition, no temperature limits were
exceeded. The inspectors noted that in the event of a RCIC system automatic start, the
cooling water supply valve would have opened automatically.
This finding had a cross-cutting aspect in the area of Human Performance, Procedure
Adherence, because licensed personnel did not implement procedure 5.3.35.1,
Attachment 29, RCIC Injection - Manual Alignment Checklist, to open MO-1301-62.
Additionally, PNPS licensed personnel did not implement the Vacuum Tank Pressure Hi
Alarm, C904L-F3, response procedure to check for an improper valve line-up [H.8].
Enforcement. TS 5.4.1, Procedures, requires that written procedures shall be
established, implemented, and maintained covering the activities recommended in RG
1.33, Revision 2, Appendix A, February 1978. RG 1.33, Appendix A, requires
procedures for operation, abnormal, off-normal, or alarm conditions for the RCIC system.
Step 2 of Procedure 5.3.35.1, Attachment 29, RCIC Injection - Manual Alignment
Checklist, requires that MO-1301-62, cooling water supply valve, be placed in the open
position when manually starting the RCIC system.
Contrary to the above, on January 27, 2015, licensed operators failed to properly
implement Procedure 5.3.35.1, Attachment 29, RCIC Injection - Manual Alignment
Checklist, and open MO-1301-62, cooling water supply valve, during a RCIC system
manual startup following a RCIC system trip. The RCIC system was operated for over 2
1/2 hours with MO-1301-62 closed. Additionally, contrary to Alarm Response Procedure
C904L, Revision 18, operators failed to evaluate the system lineup for an improper valve
28
Enclosure
lineup. Entergy entered the issue into the CAP as CR-PNP-2015-0566, CR-PNP-2015-
0570, and CR-PNP-2015-0952 and conducted a human performance review of the
Control Room operators involved with the issue. Because the finding was of very low
safety significance (Green) and has been entered into the CAP, this violation is being
treated as an NCV, consistent with section 2.3.2.a of the NRC's Enforcement Policy.
(NCV 05000293/2015007-04, Failure to Follow RCIC System Manual Restart
Procedure)
3.4
RPV Control during Reactor Cooldown
The team identified a licensed operator training weakness involving the execution of
EOPs during the response to the January 27, 2015 LOOP and reactor scram event.
Specifically, the Control Room operations crew did not effectively implement EOP-1,
RPV Control. While the RCIC system was in level control, the operating crew
maintained a reactor water level band of +40 inches to +20 inches during their cool down
approach to a reactor pressure of 120 psig and the securing of the HPCI system. The
self-imposed narrow reactor water level band resulted in the crew manually starting and
operating the B CS pump when level was lowering to +20 inches. These operator
actions resulted in reactor water level being high in their EOP reactor water level band.
With the planned shutdown of HPCI system and the subsequent use of SRV to control
reactor pressure, reactor water level should have been maintained low in the acceptable
normal band of +45 inches to +12 inches to accommodate reactor water level swells
when the crew opened SRVs.
As a result of not maintaining reactor water level low in the allowable band of +45 inches
to +12 inches, the RCIC system tripped on reactor high water level due to the reactor
level swell upon use of an SRV. Reactor pressure was at 225 psig and rising at the time
of the RCIC trip. In order to limit reactor vessel level increases due to swell, the
operating crew limited the time an SRV was opened. Although EOPs direct alternate
pressure control systems that were available to the crew, the crew elected to just use
SRVs. This crew decision to focus on maintaining reactor vessel level in band resulted
in a reactor pressure rising from 120 psig to 350 psig over an hour and a half, and
opening the B and D SRVs a total of 105 times during the cooldown.
The number of repetitive opening and closing of SRVs was undesirable for the following
reasons:
It exerted significant dynamic loads upon the RPV, the SRV tail pipes, supporting
structures, and the primary containment.
Swell and shrink associated with SRV actuations caused RPV water fluctuations that
complicate level control actions.
The potential for a stuck open SRV was increased.
EOP-1, RPV Pressure leg step P-6 requires when the main condenser is not available
to: Depressurize RPV and maintain cool down rate using Alternate Pressure Control
Systems. Table D, Alternate Pressure Control Systems, provided adequate direction
to stabilize reactor pressure and maintain an appropriate cool down rate.
EOP-1 RPV Level leg states: Restore and maintain RPV water level to +45 inches to
+12 inches using Injection Systems. The EOP users guide addresses this level band
when dealing with SRV actuations, stating that it may be necessary to expand the
29
Enclosure
control band (lower than +12 inches) to maintain level below the high level trip set point
(+45 inches).
The inspectors determined that there are several knowledge and training issues that
occurred or became evident during the event. However, these issues did not result in a
failure to comply with the EOP. Operating crew knowledge and training weaknesses
included:
1) EOP reactor water level control strategies on an impending use of SRVs.
2) HPCI system response following a complete loss of instrument air event.
3) Understanding that water level swell above +45 inches is temporary and allowed
during efforts to restore and maintain +45 to +12 inch level band.
CR-PNP-2015-00706 and CR-PNP-2015-00720 were written to address and improve
operator knowledge in these areas.
3.5
Failure to Accurately Model the Simulator for HPCI and RCIC System during a Loss of
Instrument Air
Three minor violations of 10 CFR 55.46(c)(1), "Plant Referenced Simulators," were
identified because the PNPS simulator did not accurately model the actual plant
response, as follows:
1) When the HPCI system was manually secured during the event, the operation of the
condensate pump with no discharge flow path led to the overfilling of the gland seal
exhaust condenser and the receipt of alarms for condenser high level and gland seal
blower overload. For the same event run on the simulator, the gland seal exhaust
condenser tank level never rose or actuated a high level alarm. The high level or
blower overload alarm could not be received because the simulator modeling locks
this function at the condenser level at the time of HPCI shutdown. The simulator did
not model a dynamic gland seal condenser level response unless the HPCI turbine is
in operation.
2) When the RCIC system was operated for 2 1/2 hours with the cooling water supply
valve closed during the event, the Vacuum Tank Level Hi and the Vacuum Tank
Pressure Hi alarms were received. For the same event run on the simulator, no
RCIC system alarms were received.
3) In the actual plant, the HPCI turbine exhaust drain pot drain valve (CV-2301-32) and
HPCI exhaust line drain pot drain valves (CV-9068A and CV-9068B) are operated
directly as solenoid valves. However, these valves are incorrectly modeled on the
simulator as air operated valves that fail closed on loss of air while in the plant they
would not fail closed on loss of air because they are positioned using a direct current
operated solenoid control valve.
Incorrect simulator modeling of the PNPS plant could have resulted in negative operator
training, potentially affecting the ability of operators to take appropriate actions during an
actual event. These performance deficiencies were evaluated against IMC 0612,
Appendix B, Issue Screening. The performance deficiencies were not viewed as a
precursor to a significant event, not related to a performance indicator, and did not
adversely affect a cornerstone objective. If left uncorrected, the performance
30
Enclosure
deficiencies did not have the potential to lead to a more significant safety concern. This
performance deficiency has been determined to be a minor violation requiring corrective
actions.
Entergy has taken actions to restore compliance for the three simulator modeling minor
violations by initiating the following corrective action reports: CR-PNP-2015-0563, CR-
PNP-2015-0566, CR-PNP-2015-0706, CR-PNP-2015-0912, and CR-PNP-2015-1075.
4.
Effectiveness of Licensees Response
a. Inspection Scope
The team reviewed and assessed the effectiveness of Entergys overall response to this
event. This included a review of both internal and external communications, directions
of actions from the Control Room and Outage Control Center, and a review of short term
actions taken to address equipment issues. The team interviewed plant personnel
involved in the management and review of the event. The team also reviewed operator
narrative logs, the post trip Scram Report, and PNPS CAP CRs.
b. Findings and Observations
4.1
General Performance
Leading up to the storm, the site was periodically in contact with the grid operator,
NSTAR, ISO-NE, and other plants on the grid. During the approach of the storm,
Control Room operators were in contact with NSTAR at least hourly and, at times,
continuously. Control Room operators were monitoring the storms status by monitoring
the National Weather Service website.
The Emergency Operating Facility was manned to minimum staffing during the storm.
Periodic communications with Massachusetts Emergency Management Agency were
performed to discuss general conditions as a result of the storm.
Following the event, Entergy worked with NSTAR in assessing the PNPS switchyard for
damage and in the recovery effort to assure switchyard reliability prior to re-energization.
The inspectors concluded that Entergys general response to the winter storm was in
accordance with established procedures and incorporated lessons learned from prior
events.
4.2
A CS Discharge Header Pressure Low Alarm
Introduction. The inspectors identified a Green NCV of 10 CFR 50, Appendix B,
Criterion XVI, because PNPS staff failed to identify and correct conditions adverse to
quality associated with the partial voiding of the A CS discharge header on January 27,
2015, following the loss of the keepfill system due to a LOOP.
Description. In order to assure that ECCS discharge headers are filled, vented, and
contain no voiding, a positive pressure is placed on the piping using the keepfill portion
of the Condensate Transfer system. This is performed to assure compliance with TS
Limiting Condition for Operation (LCO) 3.5.H, Core and Containment Cooling Systems,
31
Enclosure
which requires that ECCS discharge piping be maintained full of water. At PNPS, the
condensate transfer pumps supply keepfill to the ECCS discharge headers. The CS
discharge piping is normally maintained at approximately 120 psig. With the LOOP, the
condensate transfer pumps were lost. Shortly thereafter at 04:03, the Control Room
started receiving intermittent CS A Discharge Header Pressure Low Alarms
(annunciates at 33.2 psig). The Alarm Response Procedure, ARP-C903L-E7, directs
operators to investigate and correct the cause of the low pressure and to ensure that TS
LCO 3.5.H is satisfied.
During the review of Operations Department Night Order, dated February 6, 2015, which
documented an assessment of operator response during the LOOP, the SIT identified a
condition adverse to quality that had not been documented in the PNPS CAP. The night
order described that the operating crew had not utilized the A CS pump for level control
because the train had a Discharge Header Pressure Low Alarm and the crew had
concern for potential pipe voiding. Pipe voiding could have caused discharge piping
water hammer if the pump was operated. The inspectors noted that no operator
narrative log entry, LCO log entry, or CR documented the condition. In addition, the
issue was not identified in the post trip Scram Report or by Entergys Corporate Event
Response Team that was dispatched to PNPS to independently review the event. The
SIT questioned why the issue had not been entered into the CAP and whether any
ECCS discharge pipe voiding occurred following the LOOP. Entergy entered the issue
into the CAP as CR-PNP-2015-01406.
The evaluation determined that the A CS system was at least partially voided when the
A CS Discharge Header Pressure Low Alarms locked in at 08:26. Similarly, the B CS
system was also at least partially voided when that systems Discharge Header
Pressure Low Alarm locked in later on January 27 at 23:13. However, B CS was not
required to be operable at the time because the unit was in Cold Shutdown. The RHR
system discharge headers were not affected because the RHR pumps were started
shortly after the LOOP event for suppression pool cooling.
Analysis. The failure to identify, evaluate, and correct the A CS discharge header
partial voiding following loss of keepfill on January 27, 2015, is a performance deficiency
that was within Entergys ability to foresee and correct. This NRC-identified issue is
more than minor because it is associated with the Mitigating Systems cornerstone
attribute of equipment performance and affected the cornerstone objective of ensuring
the availability, reliability, and capability of systems that respond to initiating events to
prevent undesirable consequences. The inspectors evaluated the finding using IMC
0609, Appendix A, The Significance Determination Process for Findings At-Power, to
IMC 0609, Significance Determination Process. This finding was determined to be of
very low safety significance (Green) because it was not a deficiency affecting the design
or qualification of a mitigating system and did not represent an actual loss of at least a
single train system or two separate safety systems for greater than the TS allowed
outage time.
The finding had a cross-cutting aspect in Problem Identification and Resolution,
Identification, because PNPS personnel did not implement a CAP with a low threshold
for identifying issues. Individuals did not identify the issue completely, accurately, and in
a timely manner in accordance with the program [P.1].
32
Enclosure
Enforcement. 10 CFR 50, Appendix B, Criterion XVI, Corrective Action, requires, in
part, that measures shall be established to assure that conditions adverse to quality,
such as failures, malfunctions, and deficiencies, are promptly identified and corrected.
Contrary to Criterion XVI, PNPS failed to identify and correct conditions adverse to
quality associated with the partial voiding of the A and B CS discharge headers on
January 27, 2015, following the loss of the keepfill system due to a LOOP. PNPS
entered the issue into the CAP as CR-PNP-2015-01406 and planned procedural
changes that would provide guidance to operate the affected pumps in order to prevent
pump discharge piping from voiding if keepfill pressure is lost. Because this violation is
of very low safety significance and has been entered into Entergys CAP as CR-PNP-
2015-01406, this finding is being treated as an NCV consistent with Section 2.3.2.a of
the NRC Enforcement Policy. (NCV 05000293/2015007-05, Failure to Identify
Condition Adverse to Quality Associated with CS Discharge Header Voiding)
5.
Implementation of the Emergency Plan
a. Inspection Scope
The team reviewed and assessed the adequacy of Entergys implementation of the
PNPS Emergency Plan and EAL classifications. The team interviewed plant personnel
involved in the implementation and maintenance of the Emergency Plan and EALs. The
team reviewed applicable CRs generated as a result of the partial LOOP event to
determine whether the Emergency Plan and equipment required to implement it were
impacted. In addition to reviewing the Emergency Plan and EALs, the team reviewed
the EAL basis document and the procedure which addresses compensatory measures
required for Emergency Plan equipment which is out-of-service.
b. Findings and Observations
The inspectors reviewed Entergys EAL scheme and basis, specifically the LOOP EAL,
to determine whether a threshold had been exceeded. The EAL associated with an
Unusual Event at Pilgrim is SU1.1 and states, loss of all offsite AC power (Table S-3) to
emergency buses A5 and A6 for greater than 15 minutes. Table S-3 lists the following
offsite AC power sources: Startup Transformer, SDT, Unit Auxiliary Transformer, and
Backscuttle via Main Transformer (only if already established). Two 345kV lines (line
342 and line 355) are the preferred power supplies to the offsite sources listed in Table
S-3 with a 23kV line that supplies secondary power. The inspectors determined that
because the 23kV line was available to supply power to the SDT, that offsite power was
still available, and therefore, the entry criteria for the LOOP EAL was not met. The
inspectors determined that Entergy implemented the EALs appropriate at PNPS;
however, the inspectors identified two findings associated with the maintenance and
implementation of the Emergency Plan and 10 CFR 50.72 reporting requirements.
5.1
Failure to Implement Compensatory Measures for Out-of-Service EAL Instrumentation
Introduction. The inspectors identified a Green NCV of 10 CFR 50.54(q)(2) for failing to
follow and maintain an emergency plan that meets the requirements of planning
standards 10 CFR 50.47(b) and Appendix E. Specifically, on January 27, 2015,
following a loss of instrument air, the indications in the Control Room for Sea Water Bay
level were lost, and Entergy did not implement compensatory measures, as directed by
33
Enclosure
an Emergency Plan Implementing Procedure, to determine whether a Sea Water Bay
level EAL threshold had been exceeded.
Description. The EAL declaration conditions for low or high Sea Water Bay level are
indicated in the Control Room by instrumentations (LI-3831 A/B) which display water
level in reference to mean sea level (MSL). Operators use these instruments to
determine whether an EAL threshold has been exceeded associated with an abnormal
Sea Water Bay level. The EAL thresholds for an Unusual Event (HU1.5) are Sea Water
Bay water level greater than +13 feet 6 inches MSL or bay water level less than -13 feet
9 inches MSL. The Alert (HA1.6) classification level thresholds are greater than +16 feet
0 inches MSL and -16 feet 0 inches MSL.
Entergy utilized Emergency Plan Implementing Procedures to provide guidance to
operators and emergency response organization members for following and maintaining
the planning standard functions in the approved Emergency Plan. Specifically, Entergy
developed Emergency Plan Implementing Procedure EP-IP-100.1, Emergency Action
Levels, to provide guidance to operators for classifying abnormal plant events and
compensating actions for out-of-service EAL equipment.
On January 27, 2015, PNPS experienced a loss of instrument air which subsequently
led to the loss of indication on LI-3831 A/B in the Control Room. This loss rendered the
associated EALs ineffective since no alternative means existed with which to evaluate
whether EAL thresholds associated with Sea Water Bay level were exceeded. In
response to questions raised by the inspectors, Entergy explained that, although no
compensatory measures had been taken for this event, the compensatory measure for a
loss of instruments LI-3831 A/B indication was to perform a visual inspection of the bay
level as addressed in EP-IP-100.1, Emergency Action Levels. However, the inspectors
determined this was not a viable compensatory measure. Specifically, the
compensatory measure was not addressed in a procedure such that it would provide
guidance to operators the manner in which to perform the visual inspection. Additionally,
Entergy confirmed that Control Room personnel and emergency response organization
personnel had not been trained upon or made aware of the compensatory measure.
The inspectors reviewed tidal data during the event and determined that actual Sea
Water Bay level did not challenge the EAL threshold.
Analysis. The inspectors determined that Entergys failure to implement compensatory
measures for out-of-service EAL instrumentation was a performance deficiency that was
within Entergys ability to foresee and correct and should have been prevented.
Specifically, Entergy did not implement the compensatory measure listed in Attachment
9.2 of EP-IP-100.1, Emergency Action Levels, Revision 10. The inspectors determined
that following a loss of instrument air, the indications for Sea Water Bay level EAL were
lost, rendering those EALs ineffective such that Entergy was not able to determine
whether a Sea Water Bay level EAL threshold had been exceeded and to declare an
emergency based on the Sea Water Bay level. This NRC-identified performance
deficiency was more than minor because it was associated with the emergency
response organization performance (program elements not meeting 50.47(b) planning
standards) attribute of the Emergency Preparedness cornerstone and affected the
cornerstone objective of ensuring that the licensee is capable of implementing adequate
measures to protect the health and safety of the public in the event of a radiological
emergency. Specifically, the out-of-service Sea Water Bay level instrumentation could
have led to an emergency not being declared in a timely manner.
34
Enclosure
The inspectors evaluated the finding using IMC 0609, Attachment 4, Initial
Characterization of Findings, issued June 19, 2012. The attachment instructs the
inspectors to utilize IMC 0609, Appendix B, Emergency Preparedness Significance
Determination Process, issued September 23, 2014, when the finding is in the
licensees Emergency Preparedness cornerstone. The inspectors determined the
finding was associated with risk significant planning standard 10 CFR 50.47(b)(4),
Emergency Classification System, and corresponded to the following Green Finding
example in Table 5.4-1: an EAL has been rendered ineffective such that any Alert or
Unusual Event would not be declared, or declared in a degraded manner for a particular
off-normal event. Therefore, using Figure 5.4-1, Significance Determination for
Ineffective EALs and Overclassification, and the example in Table 5.4-1, the inspectors
determined the finding was of very low safety significance (Green).
The finding had a cross-cutting aspect in the area of Human Performance,
Documentation, because Entergy does not maintain complete and accurate
documentation. Specifically, compensatory measures associated with out-of-service
EAL instrumentation are not governed by comprehensive and high-quality programs,
processes, and procedures [H.7].
Enforcement. 10 CFR 50.54(q)(2) requires, in part, that a licensee shall follow and
maintain an emergency plan that meets the planning standards of 10 CFR 50.47(b) and
Appendix E. Emergency Plan Implementing Procedure EP-IP-100.1 directs a
compensatory measure of visual inspection for out-of-service Sea Water Bay EAL
instrumentation. Contrary to the above, on January 27, 2015, Entergy failed to
implement compensatory measures for out-of-service EAL instrumentation. Specifically,
during the partial LOOP event with a subsequent loss of instrument air, the indications
for the Sea Water Bay level (LI-3831A/B) were lost. The loss of these indications
degraded Entergys ability to determine whether an EAL threshold had been exceeded
for low or high Sea Water Bay level and to classify the emergency. Compliance was
restored later on January 27, 2015, when instrument air was returned to service and the
level instruments were functioning properly. Additionally, Entergy initiated corrective
actions to identify alternative means for assessing this EAL in the event of a loss of Sea
Water Bay level instruments. Because this violation is of very low safety significance
and has been entered into Entergys CAP as CR-PNP-2015-00948, this finding is being
treated as an NCV consistent with Section 2.3.2.a of the NRC Enforcement Policy.
(NCV 05000293/2015007-06, Failure to Implement Compensatory Measures for Out-
of-Service EAL Instrumentation)
5.2
Failure to Report a Major Loss of Emergency Assessment Capability
Introduction. An NRC-identified SL IV NCV of 10 CFR Part 50.72(b)(3)(xiii) was
identified when Entergy failed to make a required event notification within eight hours for
a major loss of assessment capability. Specifically, an unplanned loss occurred of all
EAL instrumentation associated with Sea Water Bay level occurred that resulted in an
inability to evaluate all EALs for an abnormal water level condition.
Description. On January 27, 2015, Entergy experienced a partial LOOP at PNPS that
resulted in a subsequent loss of instrument air. The loss of instrument air resulted in a
loss of water level indication in the Sea Water Bays. The affected instruments, LI-3831
A/B, are utilized in assessing conditions for entry into the EALs.
35
Enclosure
NUREG-1022, Event Report Guidelines 10 CFR 50.72(b)(3)(xiii), Revision 3,
Supplement 1, endorsed Nuclear Energy Institute (NEI) 13-01, Reportable Action
Levels for Loss of Emergency Preparedness Capabilities, dated July 2014. NEI 13-01
provides specific guidance for reporting under 10 CFR 50.72(b)(3)(xiii) and, as a result,
reduces the need for engineering judgment. Guidance found in NEI 13-01 provides for
an acceptable alternative to guidance found in Section 3.2.13 of NUREG-1022, Revision
3. NUREG-1022, Revision 3, Supplement 1, section 2.1 states that for scenarios in
which an initiating condition (IC) has multiple EALs that assess different conditions (i.e.,
an IC for natural hazards with EALs for high wind speed, seismic event, flooding),
instrumentation failures that result in an inability to evaluate all EALs for one of the
conditions would be considered a major loss of emergency assessment.
The inspectors determined that the January 27, 2015 loss of indication to Sea Water Bay
level instrumentation (LI-3831 A/B) was a major loss of emergency assessment because
of the inability to evaluate all EALs for an abnormal Sea Water Bay level and, therefore,
was reportable under 10 CFR Part 50.72(b)(3)(xiii). The inspectors questioned Entergy
on why they had not reported the event as a major loss of assessment capability.
Entergy believed this unplanned loss was not reportable because they had a
compensatory measure to perform a visual inspection. Entergy has committed to and
implemented NEI 13-01 for determining reportability. NEI 13-01 does not allow for
consideration of compensatory measures when evaluating reportabilty for unplanned
losses of EAL instrumentation. Entergy determined through a subsequent review that
the event was reportable under this criterion.
Analysis. The inspectors determined that Entergys failure to submit an event
notification in accordance with 10 CFR 50.72 within the required time was a performance
deficiency that was reasonably within Entergys ability to foresee and correct, and should
have been prevented. Since the failure to submit a required event report impacts the
regulatory process, the violation was evaluated using Section 2.2.4 of the NRCs
Enforcement Policy, dated July 9, 2013, instead of the SDP. Using the example listed in
Section 6.9.d.9, A licensee fails to make a report required by 10 CFR 50.72 or 10 CFR
50.73, the issue was evaluated and determined to be a SL IV violation. The inspectors
reviewed the condition for reactor oversight process significance. Because this NRC-
identified violation involves the traditional enforcement process and does not have an
underlying technical violation that would be considered more-than-minor, inspectors did
not assign a cross-cutting aspect to this violation in accordance with IMC 0612.
Enforcement. As stated in 10 CFR 50.72(b)(3)(xiii), "Eight Hour Reports," any event that
results in a major loss of emergency assessment capability requires the licensee to
notify the NRC as soon as practical and in all cases within eight-hours of the occurrence.
Contrary to this requirement, on January 27, 2015, Entergy did not notify the NRC within
eight hours of a major loss of emergency assessment capability. Specifically, a partial
LOOP at PNPS resulted in a subsequent loss of instrument air, causing a loss of water
level indication in the Sea Water Bays. The affected instruments are used to determine
if an EAL threshold is exceeded associated with sea water level. Compliance was
restored on February 5, 2015, when Entergy reported the major loss of assessment
capability in EN 50790. Because this SL IV violation was not repetitive or willful, and
was entered into Entergys CAP under CR-PNP-2015-00949, the issue is being treated
as a SL IV NCV, consistent with Section 2.3.2.a of the NRC Enforcement Policy. (NCV 05000293/2015007-07, Failure to Report a Major Loss of Emergency Assessment
Capability)
36
Enclosure
6.
Control of Switchyard Activities, Maintenance Effectiveness, and Assessment of
Operating Experience
a. Inspection Scope
The inspectors reviewed the operation and maintenance of the PNPS switchyard to
evaluate the impact of the switchyard on the event. The inspectors interviewed the
switchyard system engineer and reviewed corrective actions from the 2013 winter storm
to evaluate the adequacy of corrective actions for the switchyard. The inspectors
interviewed operators and managers to verify that Entergy was coordinating with the
transmission operator frequently during the January 27, 2015 winter storm. The
inspectors reviewed the documentation of the switchyard inspection which occurred after
the plant shutdown and prior to re-energizing the switchyard to verify that the inspection
was thorough and performed by an experienced switchyard inspector. The inspectors
also walked down the switchyard to verify that the current conditions were as
documented in the inspection results. The inspectors also performed a review of
relevant operating experience to assess Entergys effectiveness at identifying and
correcting issues.
The inspectors reviewed the design, maintenance, and testing of the diesel-driven air
compressor (K-117) to evaluate the failure of K-117 to start during the January 27, 2015
winter storm. The inspectors reviewed the design package for the initial installation of
K-117 to assess the adequacy of the design of the air compressor which was installed in
2004 to replace obsolete air compressors and to improve system reliability. The
inspectors interviewed the cognizant system engineer to evaluate the maintenance
history and historical corrective actions for K-117. The inspectors reviewed the K-117
vendor manual to verify that the air compressor is being operated and maintained in
accordance with the vendor recommendations. The inspectors interviewed the design
and system engineers about the troubleshooting and testing which occurred after the
K-117 failed to start. The inspectors reviewed the apparent cause evaluation that was
conducted for the January 27, 2015 event, as well as apparent cause evaluations for
previous events with K-117 to verify the cause of the January 27, 2015 event was not
previously identified. The inspectors walked down K-117 to evaluate the material
condition of the air compressor.
b. Findings and Observations
The inspectors noted that several procedural improvements were made which
incorporated operating experience from the 2013 winter storm including: continuous
monitoring of the switchyard during the storm, specific guidance to down power the unit
when flashovers were observed in the switchyard, powering the safety-related 4 kV
buses from the sites EDGs, placing one of the reactor protection buses on its alternate
power supply when the LOOP was anticipated, and thorough deicing of the insulators
prior to re-energizing the switchyard. Prior to the event, the switchyard was inspected by
Entergy and by the NRC resident inspectors to verify that no abnormal conditions
existed.
Following the winter storm, Entergy worked with the local grid operator, NSTAR, to
perform switchyard deicing and to perform thorough inspections of switchyard
components prior to restoring Lines 342 and 355 to service. Normal switchyard
alignment was restored on January 30 at 18:45, approximately 3 days and 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> after
37
Enclosure
it was lost. Safety-related Buses A5 and A6 were restored to their normal offsite power
sources on January 31 at 01:30. Prior to the partial LOOP and until normal offsite power
was restored, the sites safety-related EDGs supplied power to Buses A5 and A6.
Based on the performance of the electrical switchyard during the winter storm on
January 27, 2015, Entergy made additional procedural changes to their operating
strategy. The inspectors reviewed Procedure No. 2.1.42, Operation during Severe
Weather, Revision 22, which incorporated the learned operating experience. Entergy
refined the existing procedural guidance to require placing the unit in Hot Shutdown 12
hours prior to the prediction of blizzard weather conditions on site. The inspectors
concluded that the guidance was an appropriate interim action until either more specific
weather conditions could be established or modifications were implemented to the
improve switchyard performance during similar weather conditions.
6.1
Diesel-Driven Air Compressor (K-117) Failure to Start
Introduction. A self-revealing Green finding was identified for Entergys failure to
adequately test the diesel-driven air compressor (K-117) prior to the January 27, 2015
winter storm. Specifically, although K-117 was tested prior to the winter storm, the test
methodology did not reveal that the capacity of the starting battery was inadequate.
Description. PNPS normally supplies instrument air from two electric motor-driven air
compressors which are supplied by non-vital power. K-117 provides a backup source of
instrument air when the motor-driven air compressors are not available, such as during a
LOOP or during maintenance. To start without AC power, K-117 is equipped with a 24
VDC battery which starts the diesel engine and powers the air compressors
programmable logic controller (PLC).
Procedure 2.1.42, Operation during Severe Weather, provides guidance for preparing
PNPS for severe weather events. Procedure 2.1.42, Section 7.2, Site Preparations
Prior to the Severe Weather, states in part, Perform or verify performed (within the past
7 days) PNPS 8.C.35, Diesel Powered Air Compressor Operability Test, for operability
and availability in case of loss of motor-driven air compressors. Procedure 2.1.42,
Section 7.7 (High Winds) and Section 7.10 (Snowstorms) have similar requirements for
verifying the availability of K-117.
The operational surveillance for K-117, Procedure 8.C.35, starts and loads the air
compressor, but it performs the start with AC power connected and without regard for
the outside temperature. K-117 is located outside and its associated 24 VDC battery is
in an unheated compartment. A batterys capacity is reduced as its temperature is
lowered. Therefore, the operational surveillance demonstrates the ability for the diesel
engine to run and the compressor to discharge high pressure air, but the test does not
demonstrate the ability for K-117 to start at low temperatures and without AC power.
On January 22, 2015, K-117 was tested in accordance with Procedure 8.C.35 as
directed by Procedure 2.1.42 and functioned normally. The inspectors noted that the
outside air temperature was approximately 32 degrees on January 22 at the time of the
test, but was approximately 29 degrees on January 27 at the time of the LOOP. When
offsite power was lost on January 27, 2015, K-117 attempted to start. Because of the
lower outside temperature and AC power being unavailable, the K-117 battery did not
have sufficient capacity to start the air compressor and provide adequate power to the
38
Enclosure
PLC. As the diesel engine started, it drew current from the battery which lowered the
battery voltage below the minimum for the PLC to operate. When the PLC voltage
dropped below its minimum, it stopped sending a start signal to the diesel and generated
a fault signal which prevented further starting attempts. This resulted in a loss of
instrument air during the plant trip which complicated the event response.
Entergy entered this issue into their CAP as CR-PNP-2015-00559 and performed an
apparent cause evaluation. As part of Entergys apparent cause evaluation, the K-117
battery was replaced and the original battery was tested. The original battery was found
to be aged, as expected, but still adequate based on the vendor recommendation.
Entergy therefore determined that the design of the 24 VDC circuit was marginal to
supply both the starter and the PLC during a cold weather event. Entergy initiated
actions to supply instrument air with a temporary air compressor and planned a
modification to provide a separate power supply to the PLC.
Analysis. The failure to verify that the diesel-driven air compressor (K-117) was
available for service prior to the January 27, 2015 winter storm is a performance
deficiency that was within Entergys ability to foresee and correct. This resulted in a loss
of instrument air during the plant trip which complicated the event response. This
self-revealing issue was more than minor because it is associated with the procedure
quality and design control attributes of the Initiating Events cornerstone and adversely
impacted the cornerstone objective to limit the likelihood of events that upset plant
stability and challenge critical safety functions during shutdown as well as power
operations. Specifically, failure of K-117 resulted in loss of instrument air which
adversely impacted the plant response during the January 27, 2015 winter storm.
Additionally, this issue is also associated with the procedure quality and design control
attributes of the Mitigating Systems cornerstone and affected the cornerstone objective
to ensure the availability, reliability, and capability of systems that respond to initiating
event to prevent undesirable consequences.
The inspectors screened the issue under the Initiating Events cornerstone using
Attachment 4 and Exhibit 1 of Appendix A to IMC 0609, Significance Determination
Process, because that cornerstone was determined to be more impacted by the finding
than the Mitigating Systems cornerstone. The inspectors concluded that a detailed risk
evaluation would be required because the finding involved the complete loss of a
support system (instrument air) that contributes to the likelihood of an initiating event and
affects mitigation equipment. A senior reactor analyst performed a detailed risk
evaluation of this issue. The NRC model for PNPS was adjusted to account for a loss of
the instrument air compressor on a LOOP. The change in core damage frequency was
very low. A review of the dominant accident sequences indicated the contribution from a
large early release and from external risk contributors to be very small. Therefore, the
issue was determined to be of very low risk significance (Green).
The finding had a cross-cutting aspect in the area of Human Performance, Design
Margins, because Entergy failed to ensure that the K-117 battery was designed with
adequate margin. This finding is reflective of current performance because the
inadequate design margin of the battery should have been discovered through proper
testing. [H.6]
39
Enclosure
Enforcement. This finding does not involve enforcement action because the
performance deficiency was associated with the non-safety-related diesel-driven air
compressor and no violation of a regulatory requirement was identified. Entergy entered
the issue into the CAP as CR-PNP-2015-00559 and initiated actions to supply
instrument air with a temporary air compressor. Entergy also revised the operability test
for K-117 air compressor to remove the AC power source prior to starting the air
compressor. Because this finding does not involve a violation and is of very low safety
significance, it is identified as a finding (FIN 05000293/2015007-08, Inadequate Testing
of the Diesel-Driven Air Compressor)
7.
Risk Significance of the Event
a. Initial Assessment
The initial risk assessment for this event is documented in the enclosed SIT charter
(Attachment 1).
Final Assessment
In accordance with the SIT charter, a Region I senior reactor analyst used the
information developed by the team and the PNPS Standardized Plant Analysis Risk
(SPAR) Model Revision 8.24, created in May 2014, to perform an event analysis. Based
on the specifics of the event, a limited test model was developed by Idaho National
Laboratory. This included 24-hour credit for recovery of EDG power given fire water
injection. Version (c) incorporates 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> operator recovery, single high pressure
injection fault tree, containment vent in SBO-CHRIS-2 event tree logic. This event was
modeled as a switchyard-related LOOP initiating event.
Key Modeling Assumptions. The following modeling assumptions were determined to
be significant to the modeling of this event analysis:
This analysis models the January 27, 2015 reactor trip at PNPS as a switchyard-
related LOOP initiating event.
o The probability of switchyard-related LOOP (IE-LOOPSC) was set to 1.0; all
other initiating event probabilities were set to zero.
SDT Availability. The 23kV power source via the SDT was available throughout the
event. Given a postulated failure of a diesel generator, the SDT will automatically
align to power safety buses A5 and/or A6.
o To allow credit for the SDT availability, the house events HE-LOOP (House
Event - Loss of Offsite Power IE Has Occurred) and HE-LOOPSC (House Event
- Switchyard-Related Loss of Offsite Power IE Has Occurred) must be removed
from the ACP-23KV (Shutdown Transformer Offsite Power Supply) fault tree.
Offsite Power Recovery. The key offsite power recovery times for PNPS that are
modeled within the plant SPAR model are:
o 30 Minutes - LOOP and subsequent Station Blackout (SBO) combined with
failures/unavailabilities to RCIC, HPCI, and reactor depressurization.
40
Enclosure
o 1 Hour - LOOP and subsequent SBO with two or more stuck open SRVs (given
successful RCIC or HPCI operation).
o 3 Hours - LOOP and subsequent SBO with operators failing to recover offsite
power prior to the depletion of the switchyard batteries.
Offsite power was restored via Line 342 at 1635 on January 29 (approximately 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br />
after the LOOP initiated). Based on the event information (switchyard inspections and
insulator cleaning), it was determined that offsite power could not have been restored
prior to depletion of the switchyard batteries (3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />).
o Therefore, basic events OEP-XHE-XL-NR30MSC (Operators Fail to Recover
Offsite Power in 30 Minutes), OEP-XHE-XL-NR01HSC (Operators Fail to
Recover Offsite Power in 1 Hour), and OEP-XHE-XL-NR03HSC (Operators Fail
to Recover Offsite Power in 3 Hours) were set to TRUE.
Initiation of Firewater Injection. The current SPAR model has a generic screening
valve of 0.3 for the human error probability for basic event FWS-XHE-XM-ERRLT
(Operators Fail to Align Firewater Injection). As identified in the
PNPS Final Accident Sequence Precursor Analysis for Licensee Event Report 293-
13-009, the screening value was determined to be conservative; therefore, the
human failure event was reevaluated using SPAR-Hand and basic event FWS-XHE-
XM-ERRLT was set to 4E-2 from its screening value of 0.3. This was determined to
adequately represent the human error probability for this event.
Electrical Power Alignment to Buses A5 and A6. The plant had aligned the safety-
related buses, A5 and A6, to the EDGs and divorced from offsite power as part of
their storm preparations. The following modifications were made to account for this
planned configuration:
o ACP-CRB-CC-504 (4.16KV Startup Transformer Feeder Circuit BKR 152-504
Fails to Open Results in Loss of Power to Bus A5), ACP-CRB-CC-505 (4.16KV
Unit Auxiliary Transformer Feeder Circuit BKR 152-505 Fails To Open Results in
Loss of Power to Bus A5), ACP-CRB-CC-604 (4.16KV Startup Transformer
Feeder Circuit BKR 152-604 Fails to Open Results in Loss of Power to Bus A6),
and ACP-CRB-CC-605, (4.16KV Unit Auxiliary Transformer Feeder Circuit BKR
152-605 Fails to Open Results in Loss of Power to Bus A6) were set to FALSE.
o EPS-DGN-FS-DGA (EDG-A X107A Engine Fails to Start) and EPS-DGN-FS-
DGB (EDG-B X107B Engine Fails to Start) were set to FALSE.
SRV Operations. When pressure control could no longer be obtained satisfactorily
with RCIC or HPCI, SRVs were opened multiple times to control reactor pressure.
Operators attempted to open SRV C two times. During both attempts, operators did
not observe the expected reactor pressure and level response and declared the
valve inoperable. Operators continued with the depressurization cycling SRV B and
SRV D 52 and 53 times respectively. The following model modifications were made
to account for these conditions:
41
Enclosure
o ADS-SRV-CC-203-3A (SRV RV-203-3A Fail to Open) was set to TRUE
o B SRV was cycled 52 times and D SRV was cycled 53 times. To account for
the increased failure of these valves to open on demand and successfully
reclose, the failure probability was modified by the binominal expansion method
per the guidance in RASP Vol. 1, section 10.4. ADS-SRV-CC-203-3B (SRV RV-
203-3B Fails to Open) was set to 1.25E-1, ADS-SRV-CC-203-3D (SRV RV-203-
3D Fail to Open) was set to 1.27E-1, ADS-SRV-OO-203-3B (SRV RV-203-3B
Fails to Reclose) was set to 4.26E-2, ADS-SRV-OO-203-3D (SRV RV-203-3D
Fails to Reclose) was set to 4.34E-2 and PPR-SRV-OO-2VLVS (Two or More
SRVs Fail to Close) was set to 1.85E-3.
Depressurization Success Criteria. Successful depressurization usually assumes
that two of four SRVs operate successfully to ensure depressurization. The analyst
assumed that successful depressurization could be completed with a single SRV
because decay heat would be lower since the failures occur sometime after the
initiating event. As a result the following modifications were made:
o Basic Event ADS-SRV-CF-203-3ABCD (SRVs RV-203-3A, 3B, 3C & 3D Fail
from Common Cause) and depressurization logic gate DEP1 was changed from
3 of 4 to fail the function to 4 of 4 to fail the function. This translates to success
of the function with only one SRV.
Alternate High Pressure Injection. Given the lower reactor decay heat loading,
control rod drive (CRD) flow was determined to be adequate given a failure of high
pressure injection (HPCI and RCIC) and ability to depressurize to the low pressure
injection sources. The CRD fault tree was modified to show successful injection on
loss of instrument air. This was considered adequate since the CRD pumps would
deliver adequate flow when a reactor scram was inserted. The switch yard centered
LOOP event tree was modified to have this alternate injection top event after
depressurization was challenged.
No credit was assumed for successful operation of the A or C SRV on a reactor
repressurization.
Due to voiding in the CS system, Loop A, and the potential for failure due to water
hammer, LCS-MDP-FS-215A (CS Train P-215A Pump Fails to Start) was
conservatively set to TRUE. This had a minimal impact on the assessment.
Analysis Results.
The final point estimate conditional core damage probability (CCDP) for this event is
4.93x10-5. The dominant accident sequence is LOOP sequence (CCDP= 3.3x10-5)
which contributes approximately 14 percent of the total internal events CCDP. The
events logic and important component failures in LOOP sequence 14 are:
A non-recoverable switchyard-related LOOP occurs,
Reactor scram succeeds,
Emergency power succeeds,
SRVs reclose (if opened),
42
Enclosure
RCIC/HPCI initially succeed,
Suppression Pool Cooling fails,
Failure to depressurize due to the common cause failure of the SRVs,
CRD is successful,
Containment Spray fails,
Containment Venting succeeds, and
Long Term Injection fails.
8.
Exit Meetings
On March 20, 2015, the team presented their overall assessment and observations to
members of PNPS management led by Mr. John Dent, Site Vice President, and other
members of his staff. The inspectors confirmed that any proprietary information
reviewed during the inspection was returned to Entergy.
ATTACHMENT 1 - SPECIAL INSPECTION TEAM CHARTER
ATTACHMENT 2 - DETAILED SEQUENCE OF EVENTS
ATTACHMENT 3 - PILGRIM OFFSITE POWER SYSTEM
ATTACHMENT 4 - QUANTITATIVE AND QUALITATIVE EVALUATIONS
ATTACHMENT 5 - SUPPLEMENTAL INFORMATION
A1-1
Attachment 1
Special Inspection Team Charter
Pilgrim Nuclear Power Plant
Reactor Trip due to the loss of both 345kV offsite power lines
January 27, 2015
Background:
On January 27, 2015, during a winter storm, Pilgrim was reducing power from 80% due to a loss
of one 345 kilovolt (kV) offsite line. At 4:02 AM, the reactor received an automatic scram signal
from a main turbine load reject signal while at 52% power. The main turbine load reject signal
was due to the loss of the second 345kV offsite line. Both high pressure coolant injection
(HPCI) and reactor core isolation cooling pumps started as expected. The station had already
placed the safety buses on their respective emergency diesels due to the degrading switchyard
conditions so the emergency diesel generators (EDGs) were running and loaded at the time of
the automatic scram. The NRC dispatched inspectors to monitor licensee activities on-site and
in the Control Room throughout the duration of the event, and the Region I Incident Response
Center entered the monitoring mode at 12:43 PM due to multiple issues with equipment used to
bring the unit to cold shutdown and the potential for further challenges due to the ongoing winter
storm. The NRC exited the monitoring mode at 7:01 PM, because the plant had maintained
shutdown cooling for approximately two hours and was stable. The station did maintain access
to offsite power through the 23kV line. The station response was complicated by a number of
equipment issues such as:
1) Diesel-driven air compressor failed to start, resulting in a loss of station and instrument
air. Initiation of reactor coolant letdown was delayed based on the initial loss of
instrument air.
2) The A safety relief valve (SRV) had existing pilot valve leakage so plant operators did
not use it to assist in depressurization of the reactor. The C SRV was operated
manually from the Control Room and the indication showed the valve was open, but the
operators did not see the expected plant response. Plant operators reduced pressure
using the B and D SRVs.
3) HPCI became inoperable during the event after a gland seal motor thermal overload
opened. The failure caused the gland seal system to leak which caused approximately
1 of water to accumulate on the floor of the HPCI room because the sump pumps were
de- energized due to the loss of non-vital power.
4) The 23kV line remained operable and vital buses were powered by the EDGs, but there
were intermittent alarms associated with the 23kV line.
Pilgrim had a similar event during a severe winter storm in February 2013, which resulted in a
partial loss of offsite power. Therefore, this event tripped the deterministic criterion for repetitive
failures in the switchyard, which impacted safety-related systems.
Basis for the Formation of the Special Inspection Team:
The Inspection Manual Chapter (IMC) 0309 review concluded that one of the deterministic
criteria in Enclosure 1 of IMC 0309 was met due to the repetitive nature of the switchyard
failures and the multiple equipment challenges the licensee experienced. The calculated risk
was in the mid E-5 range.
A1-2
Attachment 1
To assess the risk significance of the plant transient, the Region I Senior Reactor Analyst (SRA)
used the Pilgrim standardized plant analysis risk (SPAR) model to conduct an event
assessment. Specific entries were made into the SPAR model based upon the trip with loss of
condenser heat sink, loss of the 345kV offsite power, failure of the diesel-driven air compressor,
and failure of the C SRV to open on demand.
Although HPCI was declared inoperable during the event, it was considered to be available for
injection. Additionally, at the time of failure, decay heat was sufficiently low such that control rod
drive (CRD) could provide adequate high pressure make-up. CRD is not normally credited in
the SPAR model as a high pressure injection source. Although the large early release
frequency (LERF) screening multiplier is 1.0, given the conservatism, the initial power at the
time of the event (52%), insights from State-of-the-Art Reactor Consequence Analyses and
credit for CRD, the SRA qualitatively assessed the LERF to not be greater than the Special
Inspection Team (SIT)/Augmented Inspection Team (AIT) overlap.
The resulting conditional core damage probability was 6.61E-5, which is in the AIT/SIT overlap
range.
Objectives of the Special Inspection:
The SIT will review Entergys organizational and operator response to the event, equipment and
design deficiencies, and the causes for the event and subsequent issues. The team will collect
data, as necessary, to refine the existing risk analysis. Additionally, the team leader will review
lessons learned identified during this special inspection and, if appropriate, prepare a feedback
form on recommendations for revising the Reactor Oversight Process baseline inspection
procedures.
To accomplish these objectives, the team will:
1) Develop a complete sequence of events, including follow-up actions taken by Entergy.
This review should consider any licensee-developed timelines, strip chart recordings,
computer points and trends, sequence of events printouts, or other data used by Entergy
to analyze and/or reconstruct the event.
2) Review and assess the equipment response to the event and evaluate whether it was
consistent with plant design and licensing basis. In addition, review and assess the
adequacy of associated operability assessments, technical or engineering evaluations,
corrective and preventive maintenance, and post-maintenance testing. Evaluate the
safety significance of any equipment issues identified as well as their impact on the
plants license, technical specifications, regulatory requirements, or aging management
programs.
3) Review and assess operator performance including procedures, operator narrative logs,
communications (internal and external), and appropriateness of NRC reporting during
the event. Consider use of the plant specific simulator to verify that the plant response
was consistent with the design, including any operator actions taken.
4) Review and assess the effectiveness of Entergys response to this event. This should
include internal and external communications, directions of actions from the outage
control center, and short term actions taken to address the identified equipment issues.
A1-3
Attachment 1
5) Assess Entergys implementation of their Emergency Plan and Emergency Action Level
(EAL) classifications and evaluate Entergys EAL scheme for potential generic issues.
6) Assess whether maintenance-related activities could have contributed to the event, or
impacted the response and recovery. In addition, evaluate Entergys control of
switchyard activities (including coordination with the transmission operator) that may
have affected offsite power reliability and its effect on plant safety.
7) Review relevant operating experience to assess Entergys effectiveness at identifying
and correcting any similar equipment issues.
8) Collect any data necessary to refine the existing risk analysis and document the final
independent risk analysis in the SIT report.
Guidance:
Inspection Procedure 93812, Special Inspection, provides additional guidance to be used by
the SIT. Team duties will be as described in Inspection Procedure 93812. The inspection
should emphasize fact-finding in its review of the circumstances surrounding the event. It is not
the responsibility of the team to examine the regulatory process. Safety concerns identified that
are not directly related to the event should be reported to the Region I office for appropriate
action.
The Team will conduct an entrance meeting and begin the inspection on Monday, February 2,
2015. While on site, the Team Leader will provide daily briefings to Region I management, who
will coordinate with the Office of Nuclear Reactor Regulation, to ensure that all other parties are
kept informed. A report documenting the results of the inspection will be issued within 45 days
following the final exit meeting for the inspection.
This Charter may be modified should the team develop significant new information that warrants
review.
A2-1
Attachment 2
DETAILED SEQUENCE OF EVENTS
The sequence of events was constructed by the team from review of the Control Room Narrative Log, corrective
action program condition reports, post transient review reports, process plant computer (PPC) data (alarm message
file and plant parameter graphs) and plant personnel interviews.
1/24/15 13:11
Site initiated Procedure 2.1.37, Storm Preparations.
1/27/15 01:33
(Time Approximate) Non-licensed operator observed an electrical flash over in switchyard from
the System Engineering conference room and reported it to the Control Room. Operator stated
that 3-4 flashovers were observed between 01:33 and 04:02.
1/27/15 01:33
Received numerous grid disturbance alarms. Line 355 experienced a phase A phase to ground
fault. ACB-102 and ACB-105 tripped open and ACB-102 reclosed automatically.
1/27/15 01:34
Operator lower core flow to 43 mlb/hr in accordance with Procedure 2.1.42, Operation During
Severe Weather. Reactor power lowered to 77%.
1/27/15 02:00
(Time Approximate ) ACB-105 manually reclosed (no auto closure by design).
1/27/15 02:06
(Time Approximate) Non-licensed Operator observed flash in switchyard from System
Engineering conference room and reported it to the Control Room.
1/27/15 02:06
Received numerous grid disturbance alarms including Line 342 and Line 355 undervoltage.
ACB-102 and ACB-105 tripped open. ACB-102 auto reclosed.
1/27/15 02:08
Placed Bus A6 on EDG B in accordance with Procedure 2.1.42.
1/27/15 02:12
Placed Bus A5 on EDG A in accordance with Procedure 2.1.42.
1/27/15 02:15
(Time Approximate) ACB-105 manually reclosed.
1/27/15 02:27
Placed Reactor Protection System Bus (RPS) 'A' on its backup power supply in accordance
with Procedure 2.1.42.
1/27/15 02:28
Received numerous grid disturbance alarms including Line 342 and Line 355 undervoltage.
ACB-102 and ACB-105 tripped open. ACB-102 automatically recloses.
1/27/15 02:31
(Time Approximate) ACB-105 manually reclosed.
1/27/15 02:32
Received numerous grid disturbance alarms including Line 342 and line 355 undervoltage.
ACB-102 and ACB-105 tripped open. ACB-102 automatically recloses.
1/27/15 02:35
Received numerous grid disturbance alarms including Line 342 and line 355 undervoltage.
ACB-102 tripped open (Switchyard disconnected from Line 355).
1/27/15 03:00
Wind speed approximately 54 mph (220' Tower).
1/27/15 03:24
Commenced insertion of control rods to reduce reactor power.
1/27/15 04:00
Wind Speed approximately 61 mph (220' Tower).
1/27/15 04:02
(Time Approximate) Non-licensed operator and Operations Manager observed flash in
switchyard from System Engineering conference room.
1/27/15 04:02
Line 342 faulted. Automatic reactor scram on load reject at 52% reactor thermal power.
A2-2
Attachment 2
1/27/15 04:03
Entered EOP-1, Reactor Pressure Vessel Control, for reactor vessel level < 12 inches.
Operators place the HPCI system in operation for pressure control and the RCIC system in
operation for reactor vessel level control. Main steam isolation valves are closed. Emergency
action levels were reviewed, however, no entry conditions were met.
1/27/15 04:08
All control rods verified inserted.
1/27/15 04:08 Operations entered Procedure 5.3.8, Loss of Instrument Air. Electric-driven air compressor
K-111 was out-of-service for motor replacement, electric-driven air compressor K-110 lost its
power source due to the loss the 345 kV power lines, and diesel-driven air compressor K-117
attempted to start but failed to run.
1/27/15 04:12
Operators commenced cooldown with the HPCI system for pressure control.
1/27/15 06:01
Entered EOP-3, Primary Containment Control, due to Torus Bulk temperature >80°F.
1/27/15 06:40
10 CFR50.72 non-emergency Notification was made due to actuation of the reactor protection
system (EN 50769).
1/27/15 08:30
Operator and engineering walk down of the switchyard revealed ice buildup throughout the
1/27/15 09:36
Operators commenced transitioning reactor water makeup for level control from the RCIC by
periodically operating CS pump 'B'. CS pump B was operated 8 times during the cooldown for
RPV level control. Several of these starts exceeded the vendor recommendations for
consecutive large motor starts. This condition was successfully evaluated (CR-PNP-2015-
00810).
1/27/15 09:48
With reactor pressure at approximately 120 psig, operators shutdown the HPCI system which
was operating in pressure control mode due a higher than desired cooldown rate and due to
approaching the HPCI system low pressure isolation setpoint for the system. Operators
commenced reactor pressure control by periodically manually opening safety/relief valves
(SRVs) from the Control Room. Operators commence operating the RCIC system in the
pressure control mode.
1/27/15 09:50
The HPCI Gland Seal Condenser Hotwell Hi Level Alarm received in the Control Room.
1/27/15 09:53
HPCI Gland Seal Condenser Blower Overload Alarm received in Control Room. This was
caused by condensate and cooling water backing up into the blower after the normal operating
flow path was secured and the normal shutdown flow path to radioactive waste through air
operated valves not opening due to the loss of instrument air. The HPCI system was declared
inoperable per procedural requirements due to the gland seal condenser being considered
inoperable. The HPCI system was still considered available if required to operate.
1/27/15 09:58
Operators commenced using SRV D for reactor pressure control. SRV D was manually
opened 53 times between 09:58 and 13:16.
1/27/15 10:15 Operators attempted to open SRV C for pressure control but plant parameters indicate that the
main valve failed to open. No reactor pressure decrease occurred.
1/27/15 10:15
Operators applied open demand to SRV C for 52 seconds. Although tailpipe temperature
increased, tailpipe acoustic response was not consistent with valve opening. No reactor
pressure decrease occurred.
A2-3
Attachment 2
1/27/15 10:16
RCIC system isolated due to reactor high level of +45" caused by level being high in the
operating band (12-45) and level swell due to opening SRV D.
1/27/15 10:16
Operators commenced using SRV B for reactor pressure control. SRV B was manually
opened 52 times between 10:16 and 13:24.
1/27/15 10:32
SRV C open demand applied for 83 seconds. Tailpipe and acoustic response responded to
the open signal, however, reactor pressure response was not consistent with the valve opening.
Reactor pressure increased from 262 psig to 266 psig. Operators declare SRV C inoperable.
1/27/15 10:56
RCIC system started in pressure control mode. Operator failed to open MO-1301-62 (cooling
water supply valve) as required by procedure.
1/27/15 12:57
RCIC Vacuum Tank High Level Alarm is received.
1/27/15 13:07
Entered EOP-4, Secondary Containment Control, due to water level in HPCI compartment
>1".
1/27/15 13:10
The Shift Manager has determined that no emergency exists as there is no active leak in the
HPCI system room. Suspect source of leakage is from reactor building sumps overflowing as
there is no power to the sump pumps and there are no active leaks.
1/27/15 13:24
EOP-4 was exited.
1/27/15 13:26
SRV-3D open demand was applied continuously until 17:04.
1/27/15 13:32
RCIC system secured. Reactor water level being maintained by periodically operating Core
Spray Pump B.
1/27/15 14:11
Reactor water cleanup letdown flow restored for RPV level control.
1/27/15 13:59
FLEX diesel air compressor installed to supply station compressed air. Instrument air pressure
increased, however, the capacity of the compressor was not sufficient to increase system
pressure to normal.
1/27/15 16:26 Shutdown cooling on RHR loop B is commenced.
1/27/15 16:56
Shift Manager completed 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> NRC Notification IAW 10CFR50.72(b)(3)(v)(D) for the HPCI
system being declared inoperable due to loss of the gland seal condenser. (EN#50771)
1/27/15 16:57
Moderator temperature < 212°F. PNPS entered Cold Shutdown.
1/27/15 19:46
EOP-1 is exited.
1/27/15 21:05 RCIC cooling water valve, MO-1301-62, found out of position. (CR-PNP-2015-570) (Note: Time
based upon condition report)
1/28/15 10:47
Temporary offsite air compressor is placed into service. Loss of Instrument Air Procedure is
exited.
1/29/15 16:07
Line 342 is energized by NSTAR.
1/29/15 16:35
Closed ACB-103 to energize SUT from Line 342 and exited LOOP condition.
1/29/15 17:05
Non-safety related 4160VAC Buses A1, A2, A3, and A4 are re-energized from the SUT.
A2-4
Attachment 2
1/29/15 19:00
Safety-related 4160VAC Bus A5 power is transferred from EDG A to the SUT.
1/29/15 19:44
EDG A is secured.
1/30/15 18:45
Line 355 is re-energized. Normal switchyard breaker alignment is established.
1/31/15 01:30
Safety-related 4160VAC Bus A6 power supply is transferred from EDG B to the SUT.
1/31/15 01:51
EDG B is secured.
A3-1
Attachment 3
A4-1
Attachment 4
QUANTITATIVE AND QUALITATIVE EVALUATIONS
The inspectors screened this issue for safety significance in accordance with Inspection Manual
Chapter (IMC) 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions. The
screening determined that a detailed risk evaluation was required because it was assumed that
for a one year period, two of the four safety relief valves (SRVs) were in a degraded state such
that they potentially would not have functioned to open at some pressure lower than rated
pressure and would not fulfill their safety function for greater than the Technical Specification
allowed outage time. Specifically, the assumptions of failures to open were based on: a failed
actual opening demand at 200 psig reactor pressure on January 27, 2015, for the C, serial
number (SN)9 SRV; examination of the valve internals at the testing vendor (National Technical
Systems (NTS)); and a previous failed actual opening demand at 114 psig reactor pressure on
February 9, 2013, for the A, SN4 SRV.
The staff determined that there isnt an existing significance determination process (SDP) risk
tool that is suitable to assess the significance of this finding with high confidence, mainly
because of the uncertainties associated with: the degradation mechanism and its rate; the
range of reactor pressure at which the degraded valves could be assumed to fully function; any
potential benefit from an SRV lifting at rated pressure, such that the degradation would be less
likely to occur and, therefore, prevent a subsequent failure at low pressure in the near-term; the
time based nature of plant transient response relative to when high pressure injection sources
fail and the associated impact of reduced decay heat on the SRV depressurization success
criteria; and the ability to credit other high pressure sources of water.
The following degraded conditions were identified with the valves and influence the assumptions
made in developing the risk assessment:
Fretting between the piston rings and the main body guide (cylinder):
This condition resulted in grooves being worn into the main body guide contributing to
binding of the main piston. Specifically, both the A (SN4) and C (SN9) SRVs exhibited
failure to open when demanded in lower pressure applications. In both cases, based on
resistance temperature detector indications, the second stage pilot opened but the main
piston failed to open. Significant internal wear on the main body guide was identified in both
valves. A (SN4) SRV was not selected to function during the winter 2015 snow event,
however based on subsequent reviews it was found not to have opened, at low reactor
pressure, when demanded on during the winter 2013 plant response.
Loose Main Piston and Retention Nut:
Loose pistons and retention nuts (hand tight), along with thread damage were observed
during the as-found inspection of the A (SN4) and C (SN9) SRVs at NTS.
New and overhauled valves, from Hope Creek and Hatch respectively, that had completed
acceptance testing were disassembled and inspected at NTS. Additionally, in February
2015, a spare, rebuilt SRV (SN6) from Pilgrim was being certification tested at NTS and
after the 6th test, the valves main stage spring-height had shortened enough to where it
could no longer re-seat the main disc. Upon disassembly, it was discovered that the main
stage stem nut had lost its thread preload (loose) and the staked portion of the lock tab
washer had partially disengaged from the piston slot. The piston had loosened on the stem.
As discussed in Information Notice 2003-01 Failure of a Boiling Water Reactor Target Rock
Main Steam Safety/Relief Valve, valves with loose pistons and piston retaining nuts have
A4-2
Attachment 4
challenged the operation of SRVs at rated pressures. With this condition, the number of
cycles and plant specific environmental condition influence the progression of the initial
degradation and, therefore, an increase in failure likelihood is expected (although it cannot
be predicted). Since multiple events can place numerous challenges on the SRVs early in
an event and at high pressure, valves with this deficiency can see higher failure to open and
failure to close rates.
Shortened/Relaxed Main Springs:
The A (SN4) and C (SN9) SRVs also exhibited shortened/relaxed main spring. GE SIL
196, Supplement 17, acknowledges that To date no SRV operational problems have been
associated with spring relaxation. However, it is hypothetically possible that spring
relaxation, if great enough, could cause the spring to fall out of position and cause
anomalous valve behavior. Other valves examined after acceptance overhaul testing also
exhibited unsatisfactory short springs.
The tables below capture a summary of history and performance of the Pilgrim SRVs:
Valves with Fretting Damage
These serial numbers were in-service during the following periods of time at the
following positions:
Serial
Number
Position
Installed
Mon/Yr
Removed
Mon/Yr
Removed
Reason for
Removal
3
RV-203-3B
05/2011
04/2013
23 months
1st Stage
Pilot Leakage
4
RV-203-3A
05/2011
02/2015
45 months
2nd Stage
Pilot Leakage
9
RV-203-3C
10/2013
02/2015
15 months
Main stage
issue
Notes: SN3, SN4, and SN9 exhibited most if not all of the following degraded
conditions: Main spring too short. Bulge in main disc/stem. Lock tab washer out of stake
recess. Piston not torqued. Stem nut not torqued. Main stem/piston stack-up dimension
out-of-spec. Guide fretting. Piston and ring fretting. Piston cocked on stem.
A4-3
Attachment 4
Valves with No Fretting Damage
Serial numbers SN2, SN5, and SN6 were unaffected by fretting from normal in-service
vibration based on disassembly and inspection of the main stage internals.
Serial
Number
Position
Installed
Mon-Yr
Removed
Mon-Yr
Length
In-Service
Reason for Removal
2
RV-203-3D
05/2011
04/2013
23 months
1st Stage Pilot Leakage
(Note 1)
5
RV-203-3C
05/2011
12/2011
7 months
2nd Stage Pilot Leakage
(Note 2)
6
RV-203-3C
12/2011
10/2013
22 months
2nd Stage Pilot Leakage
(Note 3)
1
SN2: Main spring short and replaced. Main disc/stem replaced due to bulge in
stem. Lock tab washer out of recess. Piston not torqued. Stem nut was still
torqued. Main stem/piston stack-up dimension out-of-spec. No guide fretting.
2
SN5: Main spring short and replaced. Main disc/stem bulged and tested so it
could be reused.
3
SN6: Main spring short and replaced. Piston not torqued. Stem nut not torqued.
Lock tab washer in recess. Main stem/piston stack-up dimension out-of-spec.
Main disc/stem, main piston, and guide reused.
Justification for Use of IMC 0609, Appendix M:
Based on the considerations above, the risk evaluation was performed using IMC 0609,
Appendix M, Significance Determination Process Using Qualitative Criteria, issued April 12,
2012. A planning Significance Determination Process Enforcement Review Panel (SERP) was
conducted on April 7, 2015, which concurred with using Appendix M in this case. The use of
Appendix M is appropriate because it is intended to be used when the probabilistic risk
assessment (PRA) methods and tools, including the existing SDP appendices, cannot
adequately address the findings complexity or provide a reasonable estimate of the significance
due to modeling and other uncertainties within the established SDP timeliness goal of 90 days
or less.
Detailed Risk Evaluation:
The detailed risk evaluation (DRE) was conducted by the Special Inspection Team (SIT)
inspectors and a Region I senior reactor analyst. Assistance with thermo-hydraulic analysis
reviews was provided by the Office of Nuclear Regulatory Research (RES). Information used in
this DRE included detailed observation and inspection of the SRVs at NTS Huntsville, Alabama,
review of design basis information, operating and emergency procedures, and additional
analysis conducted by Entergy.
The worst case bounding analysis would include the failure of the A and C SRV to open for all
events over a one year exposure period. The resulting increase in core damage frequency
(CDF) is heavily driven by the increase in the common cause failure (CCF) probability from its
baseline of 7E-5 to approximately 0.3. This resulted in an increase in CDF of mid E-4. This
appears to be overly conservative since both the A and C SRV passed as-found high
pressure American Society of Mechanical Engineers code required testing and a subsequent
A4-4
Attachment 4
lower pressure special test at 100 psig at NTS. This, and the fact that the A SRV successfully
functioned at high pressure in the plant after the failed low pressure attempt, partially supports
the theory that the valves would function at high pressure and subsequently operate again at
low pressure. However, it cannot be ruled out that other testing factors, such as the testing gag
which imparts a higher opening force, or the cooldown, shipment, and reheating of the valve,
may have resulted in a preconditioning of the valve influencing their success.
The range of degradation impacts the accident sequences and success criteria. Absent other
failure contributors, initial SRV success at high pressure or repressurization during the event
might aid in overcoming this condition. Since the Standardized Plant Analysis Risk (SPAR)
models are relatively static they cannot readily accommodate these time/scenario dependent
variations.
Based on the available information, evaluation tools, and judgment, the condition was bounded
by considering the failure of the A and C SRV for medium loss of coolant accident (MLOCA)
events and by increasing the SRV fail to open (FTO) and fail to close (FTC) by a factor of 10 to
account for the degradation of the valves in non MLOCA cases.
Due to the high number of identified loose pistons and nuts and spring shortening identified at
Pilgrim and through other facilities it was assumed for modeling all events, other than MLOCA,
that the SRV FTO and FTC was 10x higher.
MLOCA
The MLOCA event can be most closely modeled since modeling does not assume SRVs are
challenged at high pressure early in the event and the event is usually mitigated in a mid-
pressure range.
The following assumptions and changes were made to the model:
The CCF alpha factors were updated based on inputs from Idaho National
Laboratory. Basic events ZA-ADS-SRV-CC-04A01 - ZA-ADS-SRV-CC-04A04 were
modified as follows:
o 1=9.46
a=63.8
b=3.64
o 2=3.89E-2
a=2.62
b=64.8
o 3=1.09E-2
a=73.3
b=66.7
o 4=4.26E-3
a=28.7
b=67.1
The probability of failure of the A and C SRV to open was set to TRUE.
Given that the break size would provide for some degree of depressurization, a
success criterion of 1 of 4 SRVs was assumed. The application of 1/4 SRV criterion
is to all MLOCA sequences, meaning that it is being applied to high pressure coolant
injection (HPCI) fail to start situations for which the licensee Modular Accident
Analysis Program (MAAP) calculations did not provide a basis. For this case this
could be non-conservative.
No recovery credit was assigned.
No credit was assigned for successful operation of the valves if the plant
repressurized. The operators would have had no knowledge of this as a possible
remedy to free a stuck valve. Given that the emergency operating procedures
(EOPs) direct the operators to stabilize and reduce pressure, actions by the operator
could place the plant in an intermediate pressure below any assumed pressure
success point.
SRV lifts that occur at full pressure, as a means of conditioning the valve for later
successful operation at intermediate pressure (and what break size would be a
A4-5
Attachment 4
transition point where no such early lift would take place) was not considered. The
SPAR model does not assume a high pressure SRV challenge for MLOCA. It should
be noted that MAAP developers do not recommend using quantitative results during
the first 3 minutes of a transient because of limitations in the code models [EPRI TR-
1020236, pg. 8-2]. The MAAP results should be viewed qualitatively in this regard,
and corroborated by other sources (e.g., operating experience, simulator,
knowledge).
Results:
Base Case CDF = 1.19E-7
Conditional Case = 1.46E-6
CDF = 1.34E-6
The dominant sequence is a MLOCA with a CCF of the SRV and the failure of HPCI to run
given that it started.
Non-MLOCA:
The following assumptions and changes were made to the model:
The CCF alpha factors were updated based on inputs from Idaho National
Laboratory. Basic events ZA-ADS-SRV-CC-04A01 - ZA-ADS-SRV-CC-04A04 were
modified as follows:
o 1=9.46
a=6.38E1
b=3.64
o 2=3.89E-2
a=2.62
b=6.48E1
o 3=1.09E-2
a=7.33E-1
6.67E1
o 4=4.26E-3
a=2.87E-1
6.71E1
ADS-SRV-CC-203-3A through ADS-SRV-CC-203-3D was increased from 2.77E-3 to
2.77E-2, to account for the potential increase in FTO probabilities.
ADS-SRV-OO-203-3A through ADS-SRV-OO-203-3D was increased from 8.55E-4 to
8.55E-3 to account for the potential increase in FTC probabilities.
The base case SRV success criteria of 2 of 4 SRVs was not modified.
No recovery credit was assigned.
No credit was assigned for successful operation of the valves if the plant
repressurized. The operators would have had no knowledge of this as a possible
remedy to free a stuck valve. Given that the EOPs direct the operators to stabilize
and reduce pressure, actions by the operator could place the plant in an intermediate
pressure below any assumed pressure success point.
SRV lift that occur at full pressure, as a means of conditioning the valve for later
successful operation at intermediate pressure (and what break size would be a
transition point where no such early lift would take place) was not considered.
Results:
Base Case CDF = 2.08E-5
Conditional Case = 2.30E-5
CDF = 2.2E-6
The dominant sequence impacted by this change is a loss of salt service water, resulting in
a loss of suppression pool cooling, with a failure of late injection due to the failure of SRVs
to allow depressurization. All of the dominant sequences (LOSSW, LOCHS LOMFW,
TRANS, and LOSGV) have the potential to lift SRVs at the onset of the event. In these
A4-6
Attachment 4
events multiple lifts are expected to occur therefore with the observed degradations it is
appropriate to assume an increased failure probability.
External Events
The performance deficiency also would have implications for external events risk. Given the
nature of the condition, a detailed evaluation is not practical. SRVs are front line systems
credited in many external event scenarios. Therefore it would be reasonable to assume that
the contribution from external events would be equal to those from internal events.
The large early release frequency (LERF) assessment was informed by NUREG-1675,
Basis Document for Large Early Release Frequency (LERF) SDP. The failure of the SRVs
would be considered a Type A finding. Most of the dominant sequences involve a failure of
high pressure injection and a failure to depressurize. NUREG-1765, Table 2, assumes 1.0
for high-pressure sequences with a dry drywell, and 0.6 for high-pressure sequences with a
flooded drywell. The former value is bounding, but not necessarily conservative, in that liner
melt-through is expected to occur shortly after vessel failure if the drywell is dry. The latter
value is affected by the mode of reactor coolant system rupture, operator actions following
the onset of core damage, and phenomenological issues related to direct containment
heating and fuel-coolant interactions.
Recent evaluations (e.g., SOARCA Peach Bottom) have indicated that the likelihood of
severe accident-induced main steam line creep rupture or a stuck-open relief valve prior to
vessel breach is potentially higher than typically estimated in PRAs. This same case was
made in a 2003 report prepared for NRC/RES by Energy Research, Inc.1 These failure
modes would lead to a more benign containment response at the time of vessel breach, in
terms of direct containment heating and fuel-coolant interaction-induced containment failure.
Therefore, some credit below a LERF multiplier of 1.0 should be assigned.
Total Estimated Change in CDF
Given the above assumptions it is likely that the combined CDF could be in the mid E-6 range.
Licensees Risk Evaluation:
The licensees assessment was influenced by the following assumptions:
1. Pilgrims SRVs have consistently opened at high reactor pressure vessel (RPV) pressure.
2. Once an SRV cycles at high RPV pressure, it is conditioned to open at low RPV pressure.
3. There have been no FTCs to date for Pilgrims model of SRVs.
4. SRVs 3B and 3D exhibited full functionality as compared with SRVs 3A and 3C therefore,
they should not be considered as candidates for common cause failure.
Entergy staff conducted numerous MAAP thermo-hydraulic runs in an attempt to model the
condition. Their analysis focused mainly on the MLOCA. Their PRA analysis calculated a CDF
of low E-8 for the MLOCA case. The large difference between their results and the SPAR was
1 Esmaili et al., The Probability of High-Pressure Melt Ejection-Induced Direct Containment Heating
Failure in Boiling Water Reactors with Mark I Design, ERI/NRC-03-204, November 2003.
A4-7
Attachment 4
their application of CCF which was two orders of magnitude less. Requests were made for
comparison of the increased SRV FTO and FTC frequencies.
Although some insights were gained from the modeling, the outcomes are largely influenced by
the assumptions. Specifically, 500 psig was assumed to be the pressure above which the force
would be sufficient to open a stuck shut SRV. No consideration was given for the operator
response to stabilize and reduce pressure in accordance with the EOPs. Additionally, Entergys
MAAP run executed emergency depressurization at -125 inches, which represents the top of
active fuel (TAF); however, Entergys EOPs allow for this down to -150 inches, which is the
minimum for steam cooling. Although depressurization could occur higher, the failure to
evaluate at the lower level was non-conservative. Finally, failures of the valves due to the
performance deficiency did not consider the increased failure potentials at high pressure.
Given the above, concerns for cases other than MLOCA, the licensee considered the
following:
1. To account for the degraded opening characteristics observed at low pressure in SRV 3A
and 3C, the FTO frequency was increased by 10X to account for uncertainties with these
two valves.
2. Fault exposure was 1 year.
3. Assuming the above the CDF for internal events was 1.0E-7.
Most of the observed high pressure successes of the SRVs has been on the test stand. As
stated in the May 1, 2015 Curtis-Wright Interim 10 CFR Part 21 Report, Event Notification 50900, the test rig is believed to impart excessive impact loads which are much greater than
those under normal in-plant full flow conditions. This may not adequately model in plant
response.
Entergy is also crediting high pressure lifts to condition the valves at low pressure. As stated
above, much of the evidence to support this is obtained from test stand observations, in which
excessive impact loads are applied. This may not adequately model in plant response.
Entergys application of CCF is inconsistent with the RASP guidance. The valves should be
treated as a single CCF grouping since it has not been shown that they should be uncoupled. It
is important to note that the increased failure probability was only applied to the 3A and 3C SRV
although the performance history of these valves indicate that it is probable that they will exhibit
most if not all of the following:
Main spring too short
Bulge in main disc/stem
Lock tab washer out of stake recess
Piston not torqued
Hex jam nut not torqued
Main stem/piston stack-up dimension out-of-spec
Guide fretting
Piston and ring fretting
Piston cocked on stem
As stated above, Entergy does not believe that there is any impact on the valves ability to
reclose. This is not supported by the May 1, 2015 Curtis-Wright Interim 10 CFR Part 21 Report,
EN 50900. Specifically, Target Rock believes the most likely root cause is excessive impact
A4-8
Attachment 4
loads during limited flow testing that relieves the torque applied to the piston/stem interface (de-
torqueing) that may subsequently lead to creation of a significant clearance between the piston
and the main disc (de-shouldering). If the excessive impact load also damages the locking tab,
plant vibratory loads can allow the piston to rotate creating/increasing the clearance between it
and the stem. If the clearance becomes significant, the piston tilts in its guide bore which can
inhibit valve reclosing under certain conditions.
IMC 0609 APPENDIX M, TABLE 4.1
Qualitative Decision-Making Attributes for NRC Management Review
The NRC made a preliminary determination that the finding was of low to moderate safety
significance (White) based on the quantitative and qualitative evaluations. Additional
considerations are listed below:
Decision
Attribute
Applicable
to Decision?
Basis for Input to Decision - Provide qualitative and/or
quantitative information for management review and decision
making.
1. Finding can
be bounded
using qualitative
and/or
quantitative
information?
Yes
The SRAs performed a bounding quantitative assessment
using Pilgrim SPAR Model. The bounding risk, assuming
failure of the A and C SRVs to open for all events; is mid
E-4. Details are discussed in Section 2. Based on
uncertainty associated with the SRV performance, this
bounding risk was considered to be conservative. This
uncertainty can strongly influence the specific initiating
events, success criteria and CCF. Factors contributing to the
NRCs preliminary White finding are further described below
and in this Attachment.
2. Defense-in-
Depth affected?
Yes
SRVs and low pressure injection provide redundancy and
backup to the high pressure injection sources. They are
required to perform both an over-pressure protection function
and means to rapidly reduce pressure to allow for low
pressure sources to inject into the reactor vessel. Emergency
depressurizations are directed in the EOPs when the
suppression pool reaches its heat capacity limit, when there is
a reactor coolant leak into secondary containment, and when
level reaches the minimum steam cooling water level. The
as-found condition of the A and C SRV impacts these
functions.
3. Performance
Deficiency effect
on the Safety
Margin
maintained?
Yes
Reduced depressurization reliability increases the likelihood
that peak cladding temperature limits and core damage can
occur.
A4-9
Attachment 4
4. The extent
the performance
deficiency
affects other
equipment.
Yes
The failure of the licensee to identify and correct the condition
of the A SRV following the 2013 winter storm event resulted
in the failure to identify a likely common cause failure
mechanism prior to the demand failure of the C SRV during
the January 2015 plant transient.
5. Degree of
degradation of
failed or
unavailable
component(s)
Yes
Two valves are known to fail on demand at low pressure. In
addition, the loose piston and nut and relaxed spring have the
potential to impact valve operation over the entire range. This
could result in valves failing to open, close or stick in an
intermediate condition. Due to preliminary Part 21 reports, it
is likely that all four SRVs will exhibit loose piston and nut as a
result of the post maintenance testing at NTS. The degree of
further degradation due to plant specific conditions cannot be
determined.
6. Period of
time effect on
the performance
deficiency.
Yes
Greater than 1 year. Due to preliminary Part 21 reports, it is
likely that all four SRVs will exhibit loose piston and nut as a
result of the post maintenance testing. Therefore it is likely
that the valves were nonconforming with respect to piston and
nut torque upon installation. The fretting that was determined
to cause binding at low pressure is time dependent based on
the looseness of the piston and plant vibrations.
7. The
likelihood that
the licensees
recovery actions
would
successfully
mitigate the
performance
deficiency.
Yes
There are no recovery actions identified. No credit was
assigned for successful operation of the valves if the plant
repressurized. The operators would have had no knowledge
of this as a possible remedy to free a stuck valve. Given that
the EOPs direct the operators to stabilize and reduce
pressure, actions by the operator could place the plant in an
intermediate pressure below any assumed pressure success
point. Additionally, if the valve sticks due piston misalignment
there is no recovery.
8. Additional
qualitative
circumstances
associated with
the finding that
regional
management
should consider
in the evaluation
process
Yes
Entergy had the ability to readily identify the failure of the A
SRV. Additionally, Entergy was slow to identify that the C
SRV was inoperable when failing to open on demand in its
required band, doing so only after NRC identification.
Entergys claim that the C SRV was slow to open, or that it
partially opened was not consistent with the plant response
which clearly showed that the expected level and pressure
response was not obtained.
A5-1
Attachment 5
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee Personnel Contacted
J. Dent, Site Vice President
S. Verrochi, General Manager Plant Operations
D. Berkland, Senior Lead Engineer
R. Byrne, Licensing
D. Calabrese, Manager, Emergency Preparedness
W. Carroll, Senior Project Engineer
F. Clifford, Assistant Operations Manager, Support
J. Cotter, Superintendent, Operations Training
P. Doody, Senior Lead Engineer
P. Harizi, Design Engineer
S. Hudson, Senior Lead Engineer
J. Macdonald, Senior Manager, Operations
P. Miner, LicensingD. Noyes, Director, Regulatory & Performance Improvement
J. ODonnell, RCIC and HPCI System Engineer
J. Parmenter, Emergency Preparedness Analyst
C. Perkins, Manager, Regulatory Affairs
B. Rancourt, Senior Lead Engineer
M. Williams, Root Cause Evaluator
\\
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened 05000352/2015007-02
Failure to Identify, Evaluate, and Correct A SRV
Failure to Open Upon Manual Actuation (Section
2.5)
Opened/Closed 05000293/2015007-01
Inadequate Past Operability Assessment of C
Safety Relief Valve (Section 2.4)05000293/2015007-03
Inadequate Loss of Instrument Air Abnormal
Operating Procedure (Section 3.2)05000293/2015007-04
Failure to Follow RCIC System Manual Restart
Procedure (Section 3.3)05000293/2015007-05
Failure to Identify Condition Adverse to Quality
Associated with CS Discharge Header Voiding
(Section 4.2)
A5-2
Attachment 5 05000293/2015007-06
Failure to Implement Compensatory Measures for
Out-of-Service EAL Instrumentation (Section 5.1)05000293/2015007-07
NCV (SL-IV) Failure to Report a Major Loss of Emergency
Assessment Capability (Section 5.2)05000293/2015007-08
Inadequate Testing of the Diesel-Driven Air
Compressor (Section 6.1)
LIST OF DOCUMENTS REVIEWED
In addition to the documents identified in the body of this report, the inspectors reviewed the
following documents and records.
Procedures
2.1.42, Operation during Severe Weather, Revision 21 and Revision 22
2.2.21.5, HPCI Injection and Pressure Control, Revision 17
2.2.23, Automatic Depressurization System, Revision 36
3.M.4-17.4, Lubrication Sampling and Change Procedure, Revision 43
ARP-C903C, Alarm Response Procedure, Revision 17
ARP-C904L, Alarm Response Procedure, Revision 18
EN-LI-102, Corrective Action Program, Revision 24
EN-OP-104, Operability Determination Process, Revision 7
Master/LCC Procedure No. 2, Abnormal Conditions Alert, Revision 17.1
2.2.21, High Pressure Coolant Injection System, Revision 84
8.M.1-20, High Water Level Scram Discharge Tank Instrumentation Calibration/Functional Test
without Half-Scrams - Critical Maintenance, Revision 72
EN-FAP-EP-010, Severe Weather Response, Revision 1
5.3.8, Loss of Instrument Air, Revision 39
EP-AD-601, Emergency Action Level Technical Design Bases Document, Revision 4
0-RQ-06-02-06(07), Hurricane with Intake Structure Fouling, Revision 1
0-0-RQ-04-04-87, Coastal Storm JITT - Table Top, Revision 0
0-0-RQ-04-04-87, Coastal Storm JITT - Table Top, Revision 1
5.3.37 Loss of Spent Fuel Pool Cooling Event, Revision 2
0-RQ-06-02-134, Hurricane with Loss of Instrument Air System, Revision 0
0-RQ-06-02-122, Seismic Event- Loss of Instrument Air-LOCA, Revision 0
SDBD-23, High Pressure Coolant Injection (HPCI) System, Revision 1
EP-IP-100.1, Emergency Action Levels (EALs), Revision 10
EP-AD-601, Emergency Action Level Technical Bases Document, Revision 4
3.M.4-17.4, Lubricating, Sampling and Change Procedure, Revision 43
8.C.35, Diesel Powered Air Compressor Operability Test, Revision 29
A5-3
Attachment 5
2.4.16, Distribution Alignment Electrical System Malfunctions, Revision 43
2.4.A.23, Loss/Degradation of 23kV Line, Revision 22
2.2.36, Instrument Air Systems, Revision 79
Condition Reports
CR-PNP-2015-00949*
CR-PNP-2015-00948*
CR-PNP-2015-00906*
CR-PNP-2015-00870*
CR-PNP-2015-00892*
- designates CRs generated based on NRC identified issues
Work Orders
00403652-01
00403652-02
00403895-01
00403895-02
00350555-01
52372898-07
52372899-07
52368095-01
52370370-01
403590-11
Completed Tests
3.M.4-6, Removal, Installation, Test, Disassembly, Inspection, and Reassembly of Main Steam
Safety/Relief Valves - Critical Maintenance, performed 5/23/13
8.5.6.4, ADS Operability for Alternate Shutdown Panel, performed 5/11/13
8.5.6.2, Special Test for ADS System, Manual Opening of Relief Valves, performed 5/29/13
Data/Parameter Graph for Installed SRV Test (SRV 3B), performed 5/29/13
Data/Parameter Graph for Installed SRV Test (SRV 3D), performed 5/29/13
Data/Parameter Graph for Installed SRV Test (SRV 3C), performed 10/21/13
Miscellaneous
Pilgrim Station Scram Report Number 15-01 for reactor scram occurring on January 27, 2015
Pilgrim Nuclear Power Station Probabilistic Safety Assessment System Notebook, High
Pressure Coolant Injection, Appendix E16, PNPS-NE-07-006, Revision 1
Pilgrim Nuclear Power Station Emergency Plan, Revision 44
Event Notification 50790, Loss of Sea Water Intake Bay Level
Instrumentation Due to Loss of Instrument Air, dated 2/5/2015
High Pressure Coolant Injection System, Reference Text, Revision 15
Automatic Depressurization System, Reference Text, Revision 6
O-RO-03-04-06, EOP-04 Secondary Containment Control, Revision 9
O-RO-03-04-09, EOP-17/27, Emergency RPV Depressurization, Revision 8
Operability Evaluation for CR-PNP-2015-00908 (SRVs), 2/5/15
Past Operability Evaluation for CR-PNP-2015-00561 (SRV C), 2/5/15
V-2072, Vendor Manual for K-117 Backup Diesel Air Compressor, Revision 0
PDC 02-05, Replacement of Diesel-Driven Backup Air Compressor, Revision 0
A5-4
Attachment 5
Design Basis Documents
SDBD-01, Automatic Depressurization System/Main Steam System, Revision E1
SDBD-23, High Pressure Coolant Injection System, Revision 1
Drawings
M244, Sh. 1, HPCI System, Revision 31
M15, Equipment Location, Reactor Building Plan Basement, Revision E22
M252, Sh. 1, Nuclear Boiler, Revision 69
M18C-13, Air Compressor Control Power Electrical Wiring Diagram, Revision 0
A5-5
Attachment 5
LIST OF ACRONYMS
10 CFR
Title 10 of the Code of Federal Regulations
Alternating Current
Automatic Depressurization System
Apparent Violation
Corrective Action Program
Conditional Core Damage Probability
Common Cause Failure
CR
Condition Report
Condensate Storage Tank
Division of Reactor Safety
Emergency Action Level
EN
Event Notification
Entergy
Entergy Nuclear Operations, Inc.
Emergency Operating Procedure
High Pressure Coolant Injection
Initiating Condition
kV
Kilovolt
LCO
Limiting Condition for Operation
Mean Sea Level
Non-cited Violation
NEI
Nuclear Energy Institute
NRC
Nuclear Regulatory Commission
NTS
National Technical Systems
Pilgrim Nuclear Power Station
Programmable Logic Controller
Reactor Core Isolation Cooling
Regulatory Guide
Station Blackout
Significance Determination Process Enforcement Review Panel
Significance Determination Process
SDT
Shutdown Transformer
Special Inspection Team
Severity Level
Standardized Plant Analysis Risk
Safety/Relief Valve
Structure, System, and Component
TS
Technical Specification
VDC
Volts Direct Current