ML18337A440
| ML18337A440 | |
| Person / Time | |
|---|---|
| Site: | Palisades  |
| Issue date: | 11/28/2018 |
| From: | O'Brien K NRC/RGN-III |
| To: | |
| References | |
| EA-18-013 IR 2017007 | |
| Download: ML18337A440 (26) | |
See also: IR 05000255/2017007
Text
COVER PAGE
The U.S. Nuclear Regulatory Commission (NRC) strives to establish and maintain an environment
that encourages all employees to promptly raise concerns and differing views without fear of reprisal
and to promote methods for raising concerns that will enhance a strong safety culture and support
the agency's mission.
Employees are expected to discuss their views and concerns with their immediate supervisors on a
regular, ongoing basis. If informal discussions do not resolve concerns, employees have various
mechanisms for expressing and having their concerns and differing views heard and considered by
management.
Management Directive, MD 10.158, NRC Non-Concurrence Process, describes the Non-
Concurrence Process (NCP), http://nrcweb.nrc.gov:8600/policy/directives/catalog/md10.158.pdf.
The NCP allows employees to document their differing views and concerns early in the decision-
making process, have them responded to (if requested), and attach them to proposed documents
moving through the management approval chain to support the decision-making process.
NRC Form 757, Non-Concurrence Process is used to document the process.
Section A of the form includes the personal opinions, views, and concerns of a non-concurring NRC
employee.
Section B of the form includes the personal opinions and views of the non-concurring employee's
immediate supervisor.
Section C of the form includes the agency's evaluation of the concerns and the agency's final
position and outcome.
NOTE: Content in Sections A and B reflects personal opinions and views and does not represent
official factual representation of the issues, nor official rationale for the agency decision. Section C
includes the agency's official position on the facts, issues, and rationale for the final decision.
At the end of the process, the non-concurring employee(s):
Concurred
Continued to non-concur
Agreed with some of the changes to the subject document, but continued to non-concur
Requested that the process be discontinued
The non-concurring employee(s) requested that the record be non-public.
The non-concurring employee(s) requested that the record be public.
This record is non-public and for official use only.
This record has been reviewed and approved for public dissemination.
NCP-2018-004
Response to Disputed Non-Cited Violation Documented In Palisades Nuclear PlantNRC Design Bases
Assurance Inspection (Teams) Inspection Report 05000255/2017007Withdrawal of Non-Cited Violation
Ken O'Brien -------
9700
Director, Division of Reactor Safety
9747
COVER PAGE
The U.S. Nuclear Regulatory Commission (NRC) strives to establish and maintain an environment
that encourages all employees to promptly raise concerns and differing views without fear of reprisal
and to promote methods for raising concerns that will enhance a strong safety culture and support
the agency's mission.
Employees are expected to discuss their views and concerns with their immediate supervisors on a
regular, ongoing basis. If informal discussions do not resolve concerns, employees have various
mechanisms for expressing and having their concerns and differing views heard and considered by
management.
Management Directive, MD 10.158, NRC Non-Concurrence Process, describes the Non-
Concurrence Process (NCP), http://nrcweb.nrc.gov:8600/policy/directives/catalog/md10.158.pdf.
The NCP allows employees to document their differing views and concerns early in the decision-
making process, have them responded to (if requested), and attach them to proposed documents
moving through the management approval chain to support the decision-making process.
NRC Form 757, Non-Concurrence Process is used to document the process.
Section A of the form includes the personal opinions, views, and concerns of a non-concurring NRC
employee.
Section B of the form includes the personal opinions and views of the non-concurring employee's
immediate supervisor.
Section C of the form includes the agency's evaluation of the concerns and the agency's final
position and outcome.
NOTE: Content in Sections A and B reflects personal opinions and views and does not represent
official factual representation of the issues, nor official rationale for the agency decision. Section C
includes the agency's official position on the facts, issues, and rationale for the final decision.
At the end of the process, the non-concurring employee(s):
Concurred
Continued to non-concur
Agreed with some of the changes to the subject document, but continued to non-concur
Requested that the process be discontinued
The non-concurring employee(s) requested that the record be non-public.
The non-concurring employee(s) requested that the record be public.
This record is non-public and for official use only.
This record has been reviewed and approved for public dissemination.
NCP-2018-004
Response to Disputed Non-Cited Violation Documented In Palisades Nuclear PlantNRC Design Bases
Assurance Inspection (Teams) Inspection Report 05000255/2017007Withdrawal of Non-Cited Violation
Ken O'Brien -------
9700
Director, Division of Reactor Safety
9747
U. S. NUCLEAR REGULATORY COMMISSION NCP TRACKING NUMBER
NRC MD 10.158
(1 1 -2016)
NON.CONCU RRENCE PROCESS
TITLE OF SUBJECT DOCUMENT ADAMS ACCESSION NO
Response to Disputed Non-Cited Violation Documented in Palisades Nuclear Plant
NAME
Mark Jeffers
TITLE TELEPHONE NUMBER
Branch Chief, Engineering Branch 2 (630) 829-9798
ORGANIZA
Region III, Division of Reactor Safety
COMMENTS FOR THE NCP REVIEWER TO CONSIDER (use continuation pages or attach Word document)
I fully support the use of the Agency's non-concurrence process by Jamie Benjamin in expressing his reasons for the
non-concurence. I appreciate Jamie's focus on safety throughout this process and demonstrating the value of engineering
inspections to identify potential latent design issues before they manifest themselves into more signifcant events.
I recognize that a timely decision on the non-concurrence is important. However, I emphasize to the reviewer to fully review the
non-concurrence and the associated subject material in detail. Palisades' licensing basis can be complicated and be easily
misinterpreted if taken out of context. I encourage the reviewer to take the time to understand the licensing basis and the
requirements of the licensee.
Furthermore, I encourage thc reviewer to also reflect on the recent Backfit Reset training that was provided to the Agency.
Although the licensee is not contending that the issue is a backfit, the current draft of NUREG-1409, "Backfitting and Issue Finality
Guidance," (MLl8l35A342) provides specific guidance to consider. Specifically, the guidance states that "this lbackfit] process
should also be entered when an appeal, dispute, oontest, or other formal disagreement with an agency action or position raises a
concem in which part or all of the concem meets the definition of backfitting." The licensee is contending that the inspection team
lacked clarity in their interpretation of EDG testing requirements as required by IEEE 308-1978. "Lacked clarity" does not
necessarily meet the definition of a backfit; howevero I encourage the reviewer to understand the intent of the IEEE standard and be
mindful if the Agency is taking a different position than what has been previously approved.
SIGNATURE DATE
/ /zqf't
NRC FORl\ 757 (11-2016) lJse ADAMS Template NRC-006 (ML063120159)
NRC FORtl 767 u. f. ilucLEAR REOUIoRY CotllllEslol{ NCP TRACKINO NUMBER
(11-20r8) NCP-2018-004
NON.CONCU RRENCE PROCESS
Response ø Disputed Non-Cited Violation Documentod in Palisades Inspection Roport 05000255/2017007
NAME
Kenneth G. O'Brien
ITLE TELEPHONE NUMBER
Division Director 6308299700
ORGANIZATON
Division of Rpacûor Safety, Region III
AGREED UPON SUMMARY OF ISSUES (uBe conünuatlon pegos ór ettadl Word documsnt)
See attsched summary of issues (agreed via e'mail on 7ll0ll8)
evnt_ueloru oF NON-oONcURRENCEAND RATTONALE FOR DECISION (u8e contlnustlon p8ge8 0r ettach Word documont)
See attaohed evaluation
TYPED NAME OF NCP COORDINAOR TITLE
David E. Hills Branch Chief
ORGANIZATION
Bngineering Branch l, Division of Reaoor Safety, Region III
DATE
u'o**T,lZ'Y^ ø;¿L t\/ //B
TYPED NAME OF NCP APPROVER TITLE
Kenneth G. O'Brien Division Direcûor
ORGANIZATION
Division o(Reactor Safety, Region III
DATE '
n/rc
NRC FORM 7ó7 (1r-201) tle ADAIûS tunplarr- NRC'ûûA øLAUmlEe)
Summary of Issues for NCP-2018-004
The submitter does not agree with the proposed NRC response to Entergys January 29, 2018,
letter that disputed a Green finding and associated non-cited violation (NCV) contained in the
December 29, 2017, NRC Design Bases Assurance Inspection Report 05000255/2017007, for
Palisades regarding the adequacy of emergency diesel generator (EDG) testing. In particular,
the submitter objects to the NRC withdrawing NCV 05000255/2017007-01 Failure to
Periodically Test the Emergency Diesel Generators Capacity to Start and Accelerate Design
Basis Sequenced Loads. That was an NCV of 10 CFR 50, Appendix B, Criterion XI Test
Control for the licensees failure to establish a testing program to demonstrate that the EDGs
could start and accelerate their sequenced loads within the applicable voltage and frequency
acceptance limits periodically as required by IEEE 308-1978 and following maintenance
activities that could adversely affect EDG frequency and voltage response (e.g. governor and
voltage regulator maintenance activities.) The proposed NCV withdrawal was based on a
conclusion that IEEE-308-1978 provides information on what parameters of the diesel
generator to test but does not give specifics on how to test those parameters and how often. In
particular, the standard does not provide voltage and frequency acceptance limits as stated in
the contrary to statement. The submitter maintains that the NCV is valid as the licensee was
still required to develop quality EDG tests, establish acceptance criteria, and document the
results to satisfy the 10 CFR Part 50, Appendix B, Criterion XI testing requirements described in
the current licensing basis (CLB) (i.e. IEEE 308-1978). The proposed NRC response also did
not address the post-maintenance testing aspect of the NCV, although the entire NCV was to be
withdrawn. The inspection team utilized all available resources and information available
including NRR to determine that the issue was a violation before it was issued, and no new
information has been presented that changes the basis for that conclusion.
The submitter maintains that the licensee is required to implement the testing requirements of
IEEE 308-1978. Section 7, Surveillance and Test Requirements. which states that operational
status information shall be provided for Class 1E power systems. The extent, selection, and
application of the various surveillance methods, including periodic testing, to indicate the
operational status of Class 1E power system will depend on individual plant design
requirements. Illustrative surveillance methods for Class 1E equipment are outlined in Table 3,
Illustrative Surveillance Methods. As seen in that table, starting capability, loading capability,
and breaker operation are annotated By Periodic Tests. The term loading is a represented of
a verb ending in an ing, i.e. a present participle. A present participle is used to communicate a
continuous form of the verb. Used in this context, and with respect to the loading testing
requirement, the purpose of the periodic test is to ensure that the Class 1E EDGs are loading
(i.e. continuous tense verb - as load is being applied or during the application of load) within the
individual Palisades plant design requirements which are specified in the UFSAR. Although
frequency and voltage are not specifically called out in the table under By Periodic Test, it can
be implied because loading directly refers to the output of the EDG which is voltage and
frequency during which loads are added in accordance with the design requirements.
Additionally, since frequency and voltage are called out under By Continuous Monitoring, that
would cover the voltage and frequency parameters during ALL TIMES including the period when
load is being applied (Merriam-Webster Dictionary: Continuous 1) marked by uninterrupted
extension in space, time, or sequence (emphasis added)). In addition, IEEE 308-1978, Section
7.5.1, requires The system tests referred to in 7.3 Preoperational System Tests shall be
performed at scheduled intervals to demonstrate the performance of the system in accordance
with the requirements of IEEE Std 338-1977, Criteria for Periodic Testing of Nuclear Power
Generating Station Safety Systems. Section 7.3, Preoperational System Test (3) states that
The standby power supply can be started and can accept design load (emphasis added) within
the time specified in the design basis. The station informed the inspection team that they do not
perform or plan to perform this test, therefore, the team determined that the licensee was not
meeting the shall be performed at scheduled intervals since not performing the test means that
there is no scheduled interval. The submitter also provided a detailed breakdown of the
Palisades Technical Specification EDG surveillance testing requirements and with an
explanation of how each is not sufficient to meet separate requirements contained in IEEE 308-
1978.
The submitter also addresses the licensees statement that Palisades Nuclear Plant post-
maintenance testing is performed in accordance with industry guidance contained in various
Electric Power Research Institute (EPRI) reports, and that these reports do not require that
post-maintenance EDG testing include voltage and frequency testing. The licensee is required
to perform an adequate PMT on safety-related equipment in accordance with 10 CFR 50,
Appendix B, Criterion XI, and Test Control and not in accordance with EPRI standards even if
they are based upon industry guidance. That is not that the EPRI standard cant meet the Part
50 Criterion XI Test Control standards but is to say that the EPRI standard by itself may not be
adequate in a general or licensee specific application. Therefore, the licensees basis for NCV
withdrawal is not rooted in the regulations but rather founded in an everyone else does it this
way position which is not a regulatory basis. The licensee did not evaluate or describe how the
voltage regulator replacements and maintenance setup activities at no load operations ensured
that the voltage regulator would respond in a manner that ensured the quality of the design
basis was maintained. Following a maintenance activity that replaced the EDG voltage
regulators and a maintenance activity that provided gross tuning for the EDG voltages, NRC
regulations that ensure the minimum standards for safe operation would require the licensee to
ensure that the new and adjusted components would respond in accordance system design
requirements (i.e. UFSAR Section 8.4.1.2, Design Analysis, states, The generator is rated at
2500 kW at 0.8 power factor with a two-hour overload rating of 2750 kW.) The recovery time for
voltage to return to 90 % of the rated voltage after application of each load step is less than
three seconds. The 90 % percent voltage recovery in less than 3 seconds is the design basis
requirement and required to be translated into the design basis (i.e., calculations, procedures,
acceptance criteria, etc.). If the EPRI standard used is acceptable, it is still incumbent upon the
licensee to demonstrate that a written test procedure incorporates the requirements and
acceptance limits contained in applicable design documentation. . . and test results shall be
documented and evaluated to assure that test requirements have been met (Ref. 10 CFR 50,
Appendix B, Criterion XI, Test Control. Simply describing the PMT as an industry standard
does not meet the regulatory requirement and is not acceptable, otherwise quality is lost.
The submitter maintains that the level of detail of NRC regulations can be very specific as in the
case of performing technical specification surveillance requirements but can also be broader to
provide licensee greater flexibility and control. The IEEE 308-1978 standard does not need to
describe specifically each test and specifically how often each test is required to be performed
to be enforceable. The licensee does, however, have to meet the standard in order to satisfy the
regulations. Licensees that are committed or just simply follow the testing standard in
Regulatory Guide are assured that the activities are being performed in a manner deemed
acceptable by the NRC. The submitter also discussed the contrary to portion of the NCV, and
provided possible alternatives that he believed also applicable.
EVALUATION OF NON-CONCURRENCE AND RATIONALE FOR DECISION - NCP 2018-004
1. NCV 05000255/2017007-01 Failure to Periodically Test the Emergency Diesel Generators
Capacity to Start and Accelerate Design Basis Sequenced Loads.
The Enforcement Section of the finding prescribes the NCV as follows:
Title 10 CFR Part 50, Appendix B, Criterion XI, Test Control, requires, in part, that a
test program be established to assure that all testing required to demonstrate that
structures, systems, and components will perform satisfactorily in service is identified
and performed in accordance with written test procedures which incorporate the
requirements and acceptance limits contained in applicable design documents. It also
stated that test results shall be documented and evaluated to assure that test
requirements have been satisfied.
The UFSAR, Section 8.1.1, Design Basis, states in part that the engineered
safeguards electrical system is intended to meet all the other requirements identified
in IEEE 308-1978. The IEEE 308-1978, Section 7.4, Periodic Equipment Tests, states
that Tests shall be performed at scheduled intervals to (1) Detect the deterioration of
the system towards an unacceptable condition. (2) Demonstrate that standby power
equipment and other components that are not exercised during normal operation of
station are operable.
Contrary to the above, as of November 15, 2017, the licensee failed to establish a
testing program to demonstrate that the EDGs could start and accelerate their
sequenced loads within the applicable voltage and frequency acceptance limits
periodically as required by IEEE 308-1978 and following maintenance activities that
could adversely affect EDG frequency and voltage response (e.g. governor and voltage
regulator maintenance activities.) The licensee is still evaluating its planned corrective
actions, however, the team determined that the continued non-compliance does not
present an immediate safety concern because the licensee reasonably determined the
affected systems, structures, and components remained operable.
The Contrary to statement is vague as licensee periodic testing does demonstrate starting
and load sequencing of the EDGs to attain steady state voltage and frequency, and in
required time (final fully loaded condition), including verifying the time of each sequenced
load is within +/- 0.3 seconds of design timing for each automatic load sequencer per
Technical Specifications. However, the Description Section of the finding notes that
UFSAR, Section 8.4.1.3, Design Basis, states that the recovery time for the EDG voltage
to return to 90 percent of rated voltage after application of each load step is less than 3
seconds and that the licensee, in surveillance procedures RT-8C and RT-8D, is only
evaluating the steady-state voltage and frequency at the EDG terminals after the load
sequencing is complete. Discussion with the submitter confirmed that the focus of the NCV
is that the licensees testing does not verify that a necessary minimum voltage is retained
throughout the loading sequence, in particular verifying the UFSAR design requirement that
EDG voltage returns to 90 percent of rated voltage within three seconds for each load step,
instead providing a voltage verification only at the final fully loaded condition, and hence
misses a testing opportunity that could identify a deteriorating EDG. The non-concurrence
maintains that the IEEE 308-1978 EDG testing requirement is distinct and in addition to
Palisades Technical Specification surveillance requirements.
1
The NCVs paraphrasing of the IEEE 308-1978 IEEE Standard Criteria for Class 1E Power
Systems for Nuclear Power Generating Stations requirement leaves out the words as well
as practicable with respect to tests to detect the deterioration of the system towards an
unacceptable condition. The inspection report notes that historic LOOP/LOCA frequency
and voltage trace data was available based upon the frequency and voltage recorders
continuing to run during EDG output breaker time testing. Hence, the licensee does have
the capability to verify that necessary minimum voltage is retained throughout the loading
sequence during testing.
2. Palisades Plant Specific Licensing Basis for Periodic EDG Testing
The inspection report states that the licensee is not committed to NRC Regulatory Guides
(RGs) 1.108 and 1.9, however these RGs describe an acceptable approach to test the
diesel generators and provides the following excerpts from those documents:
Position C.2.a.2 of RG 1.108 states that testing of diesel generator units during the
Plant Preoperational Test Program and at least once every 18 months should
demonstrate proper operation for design-accident-loading-sequence to design-load
requirements and verify that voltage and frequency are maintained within required
limits.
Position C.4 of RG 1.9 stated, in part, that at no time during the loading sequence
should the frequency and voltage decrease to less than 95 percent of nominal and 75
percent of nominal, respectively. It also stated that Frequency should be restored to
within 2 percent of nominal, and voltage should be restored to within 10 percent of
nominal within 60 percent of each load-sequence time interval.
Although more specific than IEEE 308-1978, the excerpt from RG 1.108 Periodic Testing
of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants
is still written at a fairly high/broad level and does not specifically mention the need to verify
that a necessary minimum voltage is retained throughout the loading sequence test.
Further, the inspection report wording taken in context appears to imply that RG 1.9
Selection, Design, Qualification, and Testing of Emergency Diesel Generator Units Used
as Class 1E Onsite Electric Power Systems at Nuclear Power Plants prescribes testing to
verify that frequency and voltage do not decrease to less than 95 percent of nominal and
75 percent of nominal, respectively, and to verify that frequency should be restored to
within 2 percent of nominal, and that voltage should be restored to within 10 percent of
nominal within 60 percent of each load-sequence time interval. In fact, that excerpt is
actually from the Design Considerations portion of that RG, and not the Diesel Generator
Testing portion of the RG. While the inspection report does not specify the specific revision
being referenced, the most recent revision, Revision 4, in its Diesel Generator Testing
portion requires only that the testing verify that the EDG starts on the autostart signal from
its standby conditions; attains the required voltage and frequency, and energizes
permanently connected loads within acceptable limits and time; and energizes all
autoconnected shutdown loads through the load sequencer. It does not further describe
what is meant by attains the required voltage and frequency and acceptable limits and
time. Further, RG 1.9 covered only design considerations and not testing until Revision 3
was issued in July 1993, at which point RG 1.108 was withdrawn. Palisades received its
provisional operating license in 1971 and full term operating license in 1991, well before
testing provisions were added to RG 1.9. As such, while the inspection report assumes
2
that RGs 1.108 and 1.9 prescribe testing similar to that advocated by the NCV, there is not
necessarily a clear case for that conclusion. And as noted below, the Palisades licensing
basis would tend to suggest otherwise.
In particular, current EDG testing requirements in Palisades Improved Technical
Specifications align with NUREG 1432 Standard Technical Specifications: Combustion
Engineering (CE) Plants, Revision 1. With respect to surveillance requirements (SR),
Palisades Technical Specification Bases and CE Standard Technical Specifications Bases B.3.8.1 state that the SRs for demonstrating the operability of the DGs are in accordance
with the recommendations of RG 1.9, Revision 3.
Further, Palisades EDG testing was specifically evaluated as part of the NRCs Systematic
Evaluation Program (SEP). As indicated in NUREG 0820 Integrated Plant Safety
Assessment Systematic Evaluation Program (SEP) - Palisades Plant Final Report, dated
October 1982, the SEP was initiated by the NRC to review the design of older operating
nuclear reactor plants to reconfirm and document their safety. This report documents the
review completed under the SEP for the Palisades Plant. The review has provided for (1)
an assessment of the significance of differences between current technical positions on
selected safety issues and those that existed when the Palisades Plant was licensed, (2) a
basis for deciding on how these differences should be resolved in an integrated plant
review, and (3) a documented evaluation of plant safety when all supplements to the Final
IPSAR and the Safety Evaluation Report for converting the license from a provisional to a
full-term license have been issued. The NRCs evaluation of EDG testing under SEP
Topic VIII-2 Onsite Emergency Power Systems (Diesel Generators) was documented in a
letter from D.M. Crutchfield (NRC) to D.P. Hoffman (CPCo) dated February 27, 1981. In
that review, NRC staff compared testing prescribed by Palisades Technical Specifications,
as they existed then, with testing prescribed in RG 1.108. Note that Technical Specification
required EDG testing then was minimal compared to current Palisades Improved Technical
Specifications, and for the portion most pertinent to this issue requiring verification of the
EDG starting within 10 seconds, loading to 2400 plus or minus 100 kW, verifying of bus
load shedding, and restoration of emergency power within 30 seconds. This did not include
testing advocated in our subject NCV. The NRC review noted several differences with
respect to RG 1.108, concluding Palisades EDG testing did not meet current (at that time)
licensing criteria. However, with respect to RG 1.108 testing aspects having to do with
verifying the loading sequence and required voltage and frequency are maintained within
required requirements, the NRC staff determined Palisades EDG testing to be acceptable.
Even for the identified testing differences, potential changes would have constituted
backfits under the general premise of the SEP program. There was no indication from that
review that Palisades EDG testing did not meet its original licensing basis requirements.
Although the SEP resulted in a considerable number of backfits in diverse areas, the NRC
staff opted not to address these EDG testing differences immediately. Specifically, a letter
from D.M. Crutchfield (NRC) to D.P. Hoffman (CPCo) dated October 29, 1981, for SEP
Topic VIII-2 stated that as a result of the work done by the University of Dayton, a generic
program for implementing the results of the recommendations for reliability enhancement
that are contained in the University of Dayton report is being conducted by NRC. This latter
program will also determine the adequacy of the diesel generator testing program on a
case-by-case basis and enforce any necessary changes. As indicated in NUREG 0933
Resolution of Generic Safety Issues, the University of Dayton study was encompassed
under Generic Safety Issue B-56: Diesel Reliability with the intent to identify the more
significant causes of EDG unreliability and recommend corrective actions. The results of
3
that study were published in NUREG/CR-0660 Enhancement of Onsite Emergency Diesel
Generator Reliability, dated February 1979. The issue was resolved by the inclusion of
guidance on EDG reliability in Regulatory Guide 1.160 which was issued in conjunction with
the Maintenance Rule (10 CFR 50.65). This guide endorsed NUMARC 93-01, "Industry
Guidelines for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants,"
which addressed the optimization of EDG reliability and availability and contained an
example of an acceptable means of establishing performance criteria and/or goals for
EDGs. Closely related aspects of the Station Blackout Rule (10 CFR 50.63) were in turn
resolved in the Palisades licensing basis via reference to this same effort, as well as
reference to the ongoing Improved Technical Specifications effort. In addition, Regulatory
Guide 1.9, Revision 3 was issued to integrate into a single document pertinent guidance
previously addressed in the following documents: RG 1.9, Revision 2; Regulatory Guide
1.108, Revision 1; and Generic Letter 84-15. Further, later implementation of Palisades
Improved Technical Specifications resulted in substantially more robust EDG testing.
Clearly though, these regulatory efforts and associated licensing reviews, and in some
cases follow-up inspections, specific to EDG testing and reliability, did not result in the
implementation of testing at Palisades advocated by the NCV.
3. Evaluation for Periodic Testing
The licensee agreed that it is committed to IEEE 308-1978, including the Section 7.4
provision that applies to Class 1E power systems, and is the focal point of the NCV, that
Tests shall be performed at scheduled intervals to (1) Detect as well as practicable the
deterioration of the system towards an unacceptable condition. (2) Demonstrate that
standby power equipment and other components that are not exercised during normal
operation of station are operable. The primary question is whether that high level/broad
statement from IEEE 308-1978 should reasonably be construed as requiring that licensee
EDG testing verify a necessary minimum voltage is retained throughout the loading
sequence, in particular verifying the UFSAR design requirement that EDG voltage returns
to 90 percent of rated voltage within three seconds for each load step. And a key
consideration is what was considered as well as practicable within the context of
Palisades plant specific licensing basis.
Enforcement is usually fairly straightforward for when a specific test is found not to be
adequate to accomplish its stated intent, is not in accordance with specific requirements for
that particular testing, testing conditions are non-conservative with respect to design or
accident conditions, or has inappropriate or no acceptance criteria established. However,
because of the potential for regulatory overreach, we must be particularly cautious with
enforcement aimed at promoting the establishment of a test that is not explicitly and clearly
required. A licensee is not required to implement testing simply because it can be
envisioned by an inspector, can be physically accomplished, or can even be construed as
value added from a safety standpoint. Nor is the licensee necessarily required to repeat its
in-depth construction, preoperational, and startup testing described in UFSAR Chapter 13
without something specific to require that. In fact, some of that testing is conducted as
proof of design with the presumption that as long as that design and equipment is
maintained, the ability to accomplish that design function will not change. Likewise, a
licensee is not required to periodically test every single safety design function, or detailed
aspect thereof, described in the UFSAR. There has to be a regulatory requirement or
commitment driving those tests. Relying solely on a very high level/non-specific statement,
such as the subject IEEE 308-1978 requirement, for an enforcement action without a more
4
explicit documented licensing basis testing tie or other more specific requirement or
commitment is almost as arbitrary. Absent that more specific requirement or commitment,
any testing that can be reasonably construed as accomplishing that high level/non-specific
intent can likely be considered as meeting the IEEE 308-1978 requirement. For example,
an inspector could reasonably conclude, as did the NRCs independent reviewer for the
disputed NCV, that Palisades Technical Specification surveillance testing aimed at
demonstrating starting and load sequencing of the EDGs to attain steady state voltage and
frequency, and in required time (final fully loaded condition), coupled with other Technical
Specification EDG surveillance requirements, meets the IEEE 308-1978 requirement,
specifically that the testing detects as well as practicable the deterioration of the system
toward an unacceptable condition. Admittedly, Technical Specification surveillance testing
is not as in-depth and hence is not as adept at identifying some types of voltage regulator
(or other components) deterioration compared to a test that also evaluates voltage recovery
time following addition of each load. However, it does provide some level of deterioration
monitoring and does prove that the system could perform its safety function at the time of
the test. Without some limitations, there would be no end to what an inspector could
envision and the question becomes where does one arbitrarily draw the line? For
example, another inspector might conclude that the IEEE standard requires periodic
Megger testing of every wire in designed circuits associated with EDG starting and loading
described in the UFSAR as it is necessary and practicable and it can be an early indication
of wire insulation deterioration. Does this IEEE requirement require the licensee to buy and
implement any new testing equipment and methodology that a vendor develops that an
NRC inspector surmises provides added safety benefit with respect to identifying system or
component deterioration? Although the NCV left out the words as well as practicable
from the requirement, considering those words does little to clarify the requirement as that
can reasonably mean different things to different people, and reflect a different state of
technical capability at any given time, and noting that all the hypothetical examples above
can be physically accomplished. Absent more specificity, the meaning of the subject IEEE
requirement, which isnt even specific to EDGs, has to be evaluated within the context of
the plants licensing basis, specifically insights and conclusions gained during previous
NRC licensing reviews of Palisades EDG testing, or its meaning becomes arbitrary.
At least within the context of the Palisades licensing basis, the inspection report is incorrect
in its assumption that RGs 1.108 and 1.9 prescribe the testing that is advocated in the
NCV. As noted above, the Palisades plant specific licensing basis includes references that
indicate previous NRC staff positions that licensee EDG testing conducted pursuant to
Technical Specifications meets those RG provisions that are pertinent to this issue,
specifically testing having to do with verifying EDG loading and that required voltage and
frequency are maintained within requirements. Further, even RG 1.9 which prescribed a
very specific requirement in its design section similar to that UFSAR design specification,
did not carry that over to its requirements for periodic testing in its testing section. The
submitter is correct that the IEEE 308-1978 testing provision is distinct and in addition to
Palisades Technical Specification surveillance requirements. However, previous NRC staff
review of Palisades EDG testing, conducted via the SEP, focused on Technical
Specification surveillance requirements, and determined testing, at least those aspects
pertinent to this issue, to be adequate in that it met RG 1.108 requirements. There were
later regulatory initiatives that related to EDG reliability and testing, including
implementation of the Maintenance Rule, the Station Blackout Rule, and transition to the
Palisades Improved Technical Specifications. In fact, EDG testing requirements in the
current Palisades Improved Technical Specifications are considerably more stringent than
those reviewed during the SEP, and as they are aligned with CE Standard Technical
5
Specifications, are deemed in accordance with RG 1.9 per NUREG 1432. The submitter
provided no evidence to suggest that the licensee is not in compliance with any
requirements associated with these regulatory initiatives with respect to EDG testing.
The submitter pointed out that another part of IEEE-308-1978 does provide more specific
guidance with respect to EDG testing than that part referenced in the inspection report.
Specifically, Section 7.1 Surveillance Methods states Operational status information shall
be provided for Class lE power systems. The extent, selection, and application of the
various surveillance methods, including periodic testing, to indicate the operational status of
Class 1E power systems will depend on individual plant design requirements. Illustrative
surveillance methods for Class lE equipment are outlined in Table 3. Table 3 lists several
operating parameters for diesel generators including voltage, frequency, starting capability,
and loading capability. Under the column By Continuous Monitoring, the table notes for
these operating parameters whether it is provided inside or outside the main control room
and via instrument, indicating light, annunciator, or computer, or some combination of
those. A footnote for another column By Periodic Test states periodic test is a
supplementary or alternate to continuous surveillance as indicated. Voltage and
frequency are indicated only under the By Continuous Monitoring column and starting
capability and loading capability are indicated only under the By Periodic Test column.
Hence, it is reasonable to conclude that the intent of that provision is to ensure that voltage
and frequency are continuously monitored from specific locations and via specified means
whenever the diesel generator is being operated, and that supplementary periodic tests be
conducted to verify starting and loading capability. As voltage and frequency are not
indicated in the By Periodic Test column, it would be a reach to presume that the table
requires anything more for those two parameters during periodic testing than the routine
monitoring done during any operation of the diesel generator. Starting and loading
capability indicated in the By Periodic Test column would obviously entail some degree of
voltage and frequency verification to accomplish that, but given the lack of specifics in the
standard, it is reasonable to conclude that Section 7.1 of the standard does not require
anything more for periodic EDG starting and loading surveillance testing than that currently
prescribed in the Palisades Technical Specifications. The overall ambiguous nature of the
intent of the table, without explicit documented evidence, makes an alternative, more
stringent interpretation speculative, and unenforceable.
The submitter also pointed out still another portion of IEEE-308-1978, not mentioned in the
inspection report, but believes is applicable here. Specifically, Section 7.5.1 states for
Class IE power systems that The system tests referred to in 7.3 shall be performed at
scheduled intervals to demonstrate the performance of the system in accordance with the
requirements of IEEE Std 338-1977, Criteria for Periodic Testing of Nuclear Power
Generating Station Safety Systems. Section 7.3 states that preoperational tests shall
demonstrate that . . . the standby power supply can be started and can accept design load
within the time specified in the design basis. IEEE 338-1977 states periodic testing shall
include Individually tripping actuating devices and observing proper load group operation
(for example, trip bus under-voltage relays and observe bus transfer, load shedding, diesel
generator start, and load sequencing.) Again, there is nothing specific enough here to
imply the Technical Specification testing is not sufficient to meet this requirement. The
submitter remembers licensee staff mentioning that Palisades preoperational testing of
EDGs did include verification of voltage recovery time after application of each load step.
That may well be the case, but requirements/commitments specific to this preoperational
testing, for example FSAR Chapter 13, were incredibly vague compared to plants that
came after Palisades receiving its provisional operating license in 1971. There is no
6
indication that the licensee or the inspectors explored that aspect of the licensing basis,
and so that history and the implications of what was explicitly required for that testing is an
unknown.
Finally, the submitter again pointed out IEEE 308-1978, Section 7.5.1 and noted that the
Palisades LOOP/LOCA tests are performed under conditions not representative of design
loading conditions (i.e. starting of a large induction motor at pump minimum flow/no flow
demand conditions is less loading/current draw than starting a large induction motor with a
pump with design basis flow demand.) Enforcement action might be viable for this concern
as there is extensive regulatory precedent regarding the need for Technical Specification
required EDG testing to reflect the design basis worst case conditions for EDG loading
during an accident, for example as described in NRC Information Notice 91-13: Inadequate
Testing Of Emergency Diesel Generators. The 10 CFR 50, Appendix B, Criterion XI
requirement and associated Contrary to statement from the subject NCV might apply,
given how vague it was, although other enforcement approaches might be better suited for
this issue. Regardless, this specific concern (which may even be another example of a
violation of the same requirement) was not discussed in the inspection report, has a
distinctly different focus then the concern discussed therein, and hence is not part of the
existing NCV. As such, additional inspection and a new enforcement action, if applicable,
would be needed to focus on this new issue, and to provide the licensee appropriate
opportunities to weigh in on this new issue during the inspection and enforcement process.
4. Evaluation for Post-Maintenance Testing (PMT)
The Contrary to statement actually addresses two types of testing, periodic testing and
post-maintenance testing. In combining both into a single sentence though, the resultant
wording essentially implies that post-maintenance testing is required to demonstrate that
the EDGs could start and accelerate their sequenced loads within the applicable voltage
and frequency acceptance limits. As IEEE 308-1978 does not address post-maintenance
testing, the inspection report provides minimal insight into the PMT aspect of the NCV. The
Introduction section of the finding states that the licensee did not perform adequate post-
modification testing after replacing the EDG governor controller system or voltage
regulators. The Description section states that when the electronic governor or electronic
voltage regulator are replaced or otherwise adversely affected during maintenance
activities, the licensee tunes the new device using an approximate approach in an
unloading condition which yield a gross setting. The Contrary to statement itself is vague
with respect to the PMT aspect, and the connection between that and these two supporting
statements is as well. More explanation in the inspection report specific to PMT would
have been helpful.
The Institute for Nuclear Power Operations has issued guidelines for overall conduct of
PMT, and in the mid-1990s (and later updated in 2004), the Electric Power Research
Institute (EPRI) published report 1009709, Post-Maintenance Testing Guideline, which
provided additional technical reference material to augment that programmatic guidance
and aid member utilities in the identification of post-maintenance testing (PMT). Using this
guide or subsequently generated related software, member utilities are able to enhance
their PMT programs with more consistent test selection and implementation of PMT. The
document does prescribe specific maintenance/installation checks, termination integrity
checks, operational checks, and functional testing for EDG maintenance work, as well as
for more specific subcomponents. As the industry guidance is not specifically endorsed by
7
the NRC, following that guidance does not necessarily mean that regulatory requirements
are met. Likewise, without a corresponding requirement in the licensees program or
procedures, failing to follow this voluntary guidance would not be the focus of enforcement.
However, that guidance does provide some insights into typical industry practices with
respect to PMT for EDG maintenance work.
On the surface, limiting PMT to gross component tuning following EDG governor controller
or voltage regulator replacement, as the inspection report implies, would seem lacking
given industry guidance. In discussion with the submitter, he recalled looking at the details
of the PMT, did not believe the subject maintenance was conducted with other EDG work
that received an EDG surveillance run, and thought that the tuning was done as part of the
work activity and the licensee did not do any activity it called a PMT. However, he
expressed some degree of uncertainty, as his primary focus during that review was on
verifying whether testing looked at voltage recovery following the addition of each load
throughout the loading sequence. (Note that the inspection report list of documents
reviewed does include one work order for EDG voltage regulator replacement and industry
guidance does discuss integrating some PMT into the maintenance work activity.)
Regardless, he believes the PMT issue to be a direct violation of 10 CFR Part 50, Appendix
B, Criterion XI, Test Control as the licensee failed to establish a test program to ensure
that replacement safety-related EDG governors would perform satisfactorily in service (i.e.
meeting voltage recovery specification described in the UFSAR). Note that this position is
much less vague (more direct) and more understandable than the wording in the existing
Inadequacy in the extent of PMT following EDG governor controller and voltage regulator
replacement might possibly be a violation judging by the extent of PMT implied in the
inspection report. However, given the above uncertainty in some of the details, further
inspection would be necessarily to solidify that, specifically exploring the extent of
maintenance/installation checks, termination integrity checks, operational checks, and
functional testing performed for a specific maintenance activity or group of activities
involving an EDG, coupled with a look at associated licensee administrative procedures
covering PMT and other references. And likely the enforcement, if applicable, would take
on a different direction than the subject NCV.
Most pertinent to the non-concurrence, there is insufficient rationale provided to support the
submitters PMT contention that 10 CFR 50, Appendix B, Criterion XI requires that PMT
following EDG governor controller and voltage regulator replacement include testing of the
voltage recovery specification described in the USFAR, specifically testing to verify the
recovery time for the EDG voltage to return to 90 percent of rated voltage after application
of each load step is less than 3 seconds. References noted in the inspection report and the
non-concurrence focused on periodic testing with no mention of PMT requirements, and
none of those specifically called for that testing even for periodic testing. NRC approved
Entergy Quality Assurance Program Manual, Section B.8 Test Control, in describing the
licensees method of complying with 10 CFR 50, Appendix B, Criterion XI, requires the
licensee to establish and implement a test control program that includes post-maintenance
tests. The inspection report and the non-concurrence provide no discussion of related
licensee PMT program requirements, or industry PMT guidance on which that may be
based, including what would normally be expected for this type work. Industry guidance
suggests functional testing for EDG work, such as verifying the diesel generator auto-start
functions, and verifying synchronization and load speed control and governor control, as
well as for example governor specific functional testing that includes an operational test
8
that verifies several specific governor characteristics during ramp up and ramp down, but
no mention of the subject desired testing. The inspection report and non-concurrence do
not provide a technical rationale that would invalidate other possible testing as sufficient to
meet regulatory requirements, such as component checks combined with Technical
Specification startup and loading sequencing surveillances. Nor is the PMT part of the
NCV informed by Palisades plant specific licensing basis with respect to periodic EDG
testing, including related previous NRC reviews. A leap from the Criterion XI requirement
directly to inadequate PMT in a Contrary to statement might prevail, if the PMT were non-
existent or so unreasonably deficient to be non-debatable, or if associated with an actual
event with pertinent safety equipment failing that could have been discovered earlier and
addressed with more robust PMT (a smoking gun), for example as described in NRC
Information Notice 2007-27: Recurring Events Involving Emergency Diesel Generator
Operability. And this enforcement approach becomes especially challenging when the
Contrary to statement and related inspection report description promotes one specific
test/verification as required as this one does. Rationale for the PMT portion of the
enforcement action in this instance falls short for what is essentially a judgement call in
regulatory space. While testing for the UFSAR design requirement that EDG voltage
returns to 90 percent of rated voltage within three seconds for each load step might provide
value added for safety with respect to PMT compared to licensee program requirements
and industry guidance, that is not sufficient to conclude that it is required by the regulation.
The submitter is correct in that the proposed disputed NCV response does not really
address the post-maintenance testing part of the NCV with rationale, and yet withdraws the
entire NCV. Discussion with the NRC independent reviewer for the disputed violation
revealed the reason for that is that the inspection report itself does little to support that part
of the NCV. Nor is a specific example of governor controller or voltage regulator
replacement, and deficiencies noted therein, provided in the NCV or discussed anywhere in
the finding.
5. Conclusion
Both the submitter of the non-concurrence and independent reviewer for the disputed NCV
are to be commended for their willingness to share their views on an enforcement action
that reflects on some finer points within the enforcement framework, and that admittedly is
subject to some professional judgement and experience with respect to regulatory reach.
And their views reflect a clear and sincere appreciation for public health and safety. The
testing promoted via the NCV would provide some value added with respect to safety, in
that in certain instances this testing might provide an early indication of a deteriorating EDG
or related equipment, that might not show up in the current testing regime. Further, the
inspection report and discussion with the submitter indicate the licensee already collects
suitable data during existing testing, and hence would only need to evaluate that data.
However, absent the identification of a more specific and clear requirement, and
considering Palisades plant specific licensing basis and associated NRC regulatory
initiatives and related reviews with respect to EDG testing, I believe that IEEE 308-1978
does not require the licensee to periodically verify through testing that a necessary
minimum voltage is retained throughout the loading sequence, specifically to verify the
UFSAR design requirement that EDG voltage returns to 90 percent of rated voltage within
three seconds for each load step. Further, there is insufficient rationale provided to support
the submitters PMT contention that 10 CFR 50, Appendix B, Criterion XI requires that PMT
following EDG governor controller and voltage regulator replacement include testing of the
9
voltage recovery specification described in the USFAR, specifically a test to verify the
recovery time for the EDG voltage to return to 90 percent of rated voltage after application
of each load step is less than 3 seconds. Hence, I agree with the independent reviewer for
the disputed NCV that the NCV should be withdrawn in its entirety. However, the submitter
of the non-concurrence correctly points out that the proposed withdrawal letter while
acknowledging both parts of the NCV, only gives withdrawal rationale for the periodic
testing portion. Hence, the proposed NCV withdrawal letter should be revised to give some
brief rationale for withdrawing the PMT portion. It also needs some minor wording revision
to be consistent with the above evaluation. Regardless, the letter should continue to be
brief as possible as it currently is.
Further, as noted in the above discussion, there are two possibilities for additional
inspection that might result in some sort of enforcement action. Specifically, (1) whether
the load profile during Technical Specification EDG surveillance testing is reflective of worst
case accident conditions, and (2) the actual extent of Palisades PMT (specific to that
activity and in aggregate with other EDG work activities) following specific/actual EDG
governor controller and voltage regulator replacements, and whether that was so minimal
as to be reasonably considered inadequate or otherwise failed to satisfy requirements in
the licensees required PMT program or procedures. Region III, Division of Reactor Safety,
Engineering Branch 2 should evaluate further to determine whether that inspection would
be prudent and how best to incorporate that review into existing NRC baseline inspection
activities, or whether to simply verbally pass on that information to the licensee for
review/action.
Regardless of NCV disposition, verifying via testing the UFSAR design requirement that
EDG voltage returns to 90 percent of rated voltage within three seconds for each load step
appears both doable and would provide some additional safety confidence. As such,
verbally communicating that to the licensee as an inspection observation would be both
advisable and within process. In addition, the Maintenance Rule being a performance
based rule, does not specifically require this testing, as it allows licensees considerable
latitude in deciding how to meet EDG reliability goals. But the licensee could in the future
voluntarily elect to initiate similar testing in response to actual reliability challenges, if they
occur.
10