IR 05000414/2024090
| ML24166A010 | |
| Person / Time | |
|---|---|
| Site: | Catawba  |
| Issue date: | 06/24/2024 |
| From: | Mark Franke Division Reactor Projects II |
| To: | Flippin N Duke Energy Carolinas |
| References | |
| EA?24-049 IR 2024090 | |
| Download: ML24166A010 (18) | |
Text
SUBJECT:
CATAWBA NUCLEAR STATION - NRC INSPECTION REPORT 05000414/2024090 AND PRELIMINARY WHITE FINDING AND APPARENT VIOLATION
Dear Nicole Flippin:
The enclosed report documents a finding with an associated apparent violation that the U.S. Nuclear Regulatory Commission (NRC) has preliminarily determined to be of low to moderate safety significance (i.e., White finding). This finding involved a failure to implement measures to maintain the functionality of the Unit 2 diesel building emergency ventilation system, which resulted in the 2A emergency diesel generator being inoperable for greater than the time allowed by plant Technical Specifications. We assessed the significance of the finding using the significance determination process (SDP) and the best available information at the time of the Significance and Enforcement Review Panel. The attachment to the inspection report contains a detailed risk evaluation with the basis of our preliminary significance determination. We are also considering escalated enforcement for the apparent violation consistent with our Enforcement Policy, which can be found at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html.
We intend to issue our final significance determination and enforcement decision, in writing, within 90 days from the date of this letter. The NRCs SDP is designed to encourage an open dialogue between your staff and the NRC; however, neither the dialogue nor the written information you provide should affect the timeliness of our final determination.
Before we make a final decision on this matter, we are providing you with an opportunity to (1) attend a Regulatory Conference where you can present, to the NRC, your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2) submit your position on the finding to the NRC in writing. If you request a Regulatory Conference, it should be held within 40 days of the receipt of this letter, and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. The focus of the Regulatory Conference is to discuss the significance of the finding and not necessarily the root cause(s) or corrective actions associated with the finding. If a Regulatory Conference is held, it will be open for public observation. If you decide to submit only a written response, such submittal should be sent to June 24, 2024 the NRC within 40 days of your receipt of this letter. If you decline to request a Regulatory Conference or to submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of NRC Inspection Manual Chapter 0609.
If you choose to send a written response, it should be clearly marked as a Response to Apparent Violation; (EA-24-049) and should include for the apparent violation: (1) the reason for the apparent violation or, if contested, the basis for disputing the apparent violation(s);
(2) the corrective steps that have been taken and the results achieved; (3) the corrective steps that will be taken; and (4) the date when full compliance will be achieved. Your response should be submitted under oath or affirmation and may reference or include previously docketed correspondence if the correspondence adequately addresses the required response.
Additionally, your response should be sent to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Center, Washington, DC 20555-0001 with a copy to Eric Stamm, Chief, Reactor Projects Branch 1, U.S. Nuclear Regulatory Commission, Region II, 245 Peachtree Center Avenue N.E., Suite 1200, Atlanta, GA, 30303, within 40 days of the date of this letter. If an adequate response is not received within the time specified or an extension of time has not been granted by the NRC, the NRC will proceed with its enforcement decision or schedule a Regulatory Conference.
Please contact Eric Stamm at 404-997-4575, or in writing, within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision.
Because the NRC has not made a final determination in this matter, no Notice of Violation is being issued for this inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violation described in the enclosed inspection report may change as a result of further NRC review. The final resolution of this finding and associated apparent violation will be conveyed in separate correspondence.
For administrative purposes, this inspection report provides an update to the apparent violation documented in NRC inspection report 05000413/2024001, 05000414/2024001 (Agency Documents Access and Management System (ADAMS) ML24129A196) dated May 10, 2024. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding.
Sincerely, Mark E. Franke, Director Division of Reactor Projects Docket No. 05000414 License No. NPF52
Enclosure:
IR 05000414/2024090 w/ Attachment:
UNIT 2 A-EDG ROOM VENTILATION DETAILED RISK EVALUATION
Inspection Report
Docket Number:
05000414
License Number:
Report Number:
Enterprise Identifier:
I2024-090-0007
Licensee:
Duke Energy Carolinas, LLC
Facility:
Catawba Nuclear Station
Location:
York, South Carolina
Inspection Dates:
April 1, 2024, to June 11, 2024
Inspectors:
D. Rivard, Senior Resident Inspector
A. Wang, Resident Inspector
S. Sandal, Senior Reactor Analyst
Approved By:
Mark E. Franke, Director
Division of Reactor Projects
SUMMARY
The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees
performance by conducting a NRC inspection at Catawba Nuclear Station, in accordance with
the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for
overseeing the safe operation of commercial nuclear power reactors. Refer to
https://www.nrc.gov/reactors/operating/oversight.html for more information.
List of Findings and Violations
Failure to Implement Measures to Maintain Functionality of the 2A Diesel Building Emergency
Ventilation System
Cornerstone
Significance
Cross-Cutting
Aspect
Report
Section
Mitigating
Systems
Preliminary White
Open
EA24-049
[H.12] - Avoid
Complacency
The inspectors identified a preliminary White finding and an associated apparent violation of
Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion III,
Design Control, for the licensees failure to establish measures to assure the diesel building
ventilation system (VD) design basis was translated into applicable licensing basis
documents. Specifically, the licensee did not 1) translate regulatory requirements and the
design basis for all temperature conditions and 2) delineate verification of proper system
response and temperature control, into applicable documents, to ensure the VD system for
the 2A emergency diesel generator (EDG) remained functional.
Additional Tracking Items
None.
INSPECTION SCOPES
Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in
effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with
their attached revision histories are located on the public website at http://www.nrc.gov/reading-
rm/doc-collections/insp-manual/inspection-procedure/index.html. The inspectors reviewed
selected procedures and records, observed activities, and interviewed personnel to assess
licensee performance and compliance with Commission rules and regulations, license
conditions, site procedures, and standards.
INSPECTION RESULTS
Failure to Implement Measures to Maintain Functionality of the 2A Diesel Building Emergency
Ventilation System
Cornerstone
Significance
Cross-Cutting
Aspect
Report
Section
Mitigating
Systems
Preliminary White
Open
EA24-049
[H.12] - Avoid
Complacency
The inspectors identified a preliminary White finding and an associated apparent violation of
Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion III,
Design Control, for the licensees failure to establish measures to assure the diesel building
ventilation system (VD) design basis was translated into applicable licensing basis
documents. Specifically, the licensee did not 1) translate regulatory requirements and the
design basis for all temperature conditions and 2) delineate verification of proper system
response and temperature control, into applicable documents, to ensure the VD system for
the 2A emergency diesel generator (EDG) remained functional.
Description: On January 2, 2024, after starting the 2A EDG at 1031 for a 5-hour operability
run per procedure PT/2/A/4350/002 A, Diesel Generator 2A Operability Test, the licensee
aborted the run due to elevated temperatures and a strong diesel exhaust odor in the room.
The licensee determined that, based on trends of the room temperature data, the maximum
room temperature was observed to be 107 degrees Fahrenheit (°F) at the time 2A EDG was
secured and trending such that it would have exceeded the 120°F design limit for the room
prior to completion of the 5-hour run. The licensee secured the 2A EDG at ~1439 and
declared it operable due to meeting the testing criteria in procedure PT/2/A/4350/002 A. The
licensee performed troubleshooting and upon further evaluation determined that the 2A1
emergency ventilation fan damper controller VDTT7500 had failed low to a temperature
of 10°F. Therefore, it would not modulate outdoor inlet damper 2DSF-D3 open, nor modulate
recirculating damper 2DSF-D4 shut to provide excess exhaust air out of the two relief
backdraft dampers on the opposite side of the room to the exterior of the building. At 2045,
the licensee determined that the 2A EDG was not capable of operating for the defined
mission time (7 days) due to the failure of the 2A diesel building emergency ventilation
system (because the 2A2 fan was tagged out for maintenance) and declared it inoperable.
After repair of the failed damper controller, the licensee declared the 2A EDG operable on
January 3, 2024, at 0531.
The inspectors reviewed procedure PT/2/A/4350/002 A and noted that while the test
procedure confirmed that the fan indication lights and fans associated with the ventilation
system operate when an EDG is running, the procedure did not verify damper response or
room temperature response. Additionally, the inspectors reviewed the 2A EDG run history
and ambient temperature conditions. During the April 4, 2023, December 5, 2023, and
January 2, 2024, runs of the 2A EDG, temperatures were observed to reach 105°F and still
trending upward at the time the EDG was secured. Of those runs, April 4, 2023, was a 5-hour
run. The other 2A EDG runs were 1-hour runs. The 2A EDG did not exceed the temperature
limit of 120°F for a running EDG but, based on graphical data, could have trended beyond the
temperature limit if called upon for an extended duration run. The EDG runs on January 3,
2023, March 7, 2023, October 3, 2023, showed a greater than 5°F temperature difference
between the two sides of the room, with a maximum differential temperature of 9°F during the
April 4, 2023, run. The remaining monthly EDG runs reviewed did not appear to display
abnormal temperatures. The inspectors compared this to the previous 24-hour EDG run on
August 2, 2022, which had similar room temperatures on both sides of the room and was
capable of limiting the maximum room temperature to 106°F with an outside ambient
temperature of ~90°F.
CNS1579.VD00-0001, Diesel Building Ventilation System (VD) Design Basis Specification,
states the diesel emergency ventilation system is a support system designed to modulate
recirculation and inlet air dampers to maintain room temperature to roughly 85°F to ensure
that the EDG, as well as its associated electrical components, are capable of meeting the
EDG mission time in the event of design basis events like a loss of coolant accident or a loss
of offsite power (LOOP). The Catawba Updated Final Safety Analysis Report (UFSAR)
Section 9.4.4, Diesel Building Ventilation System, subsection 9.4.4.2, System Description,
described the emergency ventilation portion of the VD system as consisting of two 50 percent
capacity fans, ductwork, and modulating return air and outside air dampers, and designed to
maintain temperatures between 60°F and 120°F when the EDG is operating; and
proportioning controls are provided to modulate the outdoor air dampers toward the open
position and the return air dampers toward the closed position.
Licensee calculation CNC1211.00-00-0013, Diesel Generator Building HVAC Calculations,
feeds into CNS1579.VD00-0001. Prior to 2006, the licensee considered the failure of a
single VD fan as a failure of the VD system. PIP C06-05467 (legacy corrective action
document) documented the engineering change that was performed by the licensee in 2006
to modify CNC1211.00-00-0013 to provide additional guidance based on outside ambient air
temperature. Calculation CNC1211.00-00-0013 shows that, under some outside ambient air
temperature conditions and fan damper position conditions, a single ventilation fan can
maintain the diesel room within design temperatures; and under elevated outside ambient air
temperature conditions, both ventilation fans are required to maintain the diesel room
temperatures below the design values during operation. While this distinction in outside
ambient air temperatures and damper positioning was made in the calculation, it was not
reflected in licensing basis documents (e.g., UFSAR) that reflected the requirement of both
ventilation fans and associated dampers to be functional for the VD system to remain capable
of performing its safety-related design function of maintaining room temperatures within
design limits as required for operability of the EDG.
On November 13, 2023, the licensee tagged the 2A2 fan out of service (OOS) for planned
maintenance. The fan was originally planned to be OOS for seven days. However, due to
other emergent work activities, the fan remained OOS until February 6, 2024. When the
licensee tagged the 2A2 fan out of service, they issued a technical specification (TS) limiting
condition for operation (LCO) tracking record (LCOTR) against TS LCO 3.8.1 Condition B, for
one EDG inoperable. The least restrictive completion time to restore the EDG to operable
status is 14 days. However, the LCOTR was considered tracking only and had no
associated actions. The inspectors noted that a summary of the temperature restrictions for
single fan operation was included in the notes of the LCOTR, but it contained no instructions
to validate (via verification or tracking of) outside ambient air temperature.
The UFSAR subsection 9.4.4.4, Inspection and Testing Requirements, states in part,
essential electrical components, switchovers, and starting controls are tested during
preoperational tests and periodically thereafter coincident to testing of the diesels as required
by the technical specifications. The inspectors reviewed the completed procedures,
PT/2/A/4350/002 A, for the surveillances performed on December 5, 2023, and
January 2, 2024. In both procedures, the verification of the 2A2 fan start and verification of
the adequate air flow light - on, were not performed. Licensee procedure AD-HU-ALL0004,
"Procedure and Work Instruction Use and Adherence," contained a provision for problems
with equipment. This procedure section states in part, If the acceptance criteria of the
Procedure can be met and the Procedure step(s) can be performed as written, then
document the Discrepancy in the WR/WO and, if used, on Attachment 3, Equipment Problem
Evaluation Form, and continue with the Procedure. The licensee used this provision to
annotate the 2A2 fan as removed from service and continued with the procedure. However,
the inspectors determined that because the 2A2 fan was out of service, the verification step
(e.g., Enclosure 13.1, step 2.18) could not be performed as written. The inspectors also noted
that PT/2/A/4350/002 A, Enclosure 13.3, Start Data, did not indicate number of ventilation
fans required to be operating, or any actions to take in response to one or more fans not
operating.
TS LCO 3.8.1 (b) requires in part, two operable EDGs. With one EDG inoperable, the
inoperable EDG must be restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> per Required Action B.6
or place the unit in mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> per Required
Actions I.1 and I.2. The licensee may extend the completion time up to 14 days if Required
Action B.5 (evaluate availability of emergency supplemental power source) is completed. The
licensee determined the failed condition of the 2A1 emergency ventilation fan damper
controller, combined with the 2A2 ventilation fan out of service for maintenance, existed since
December 5, 2023. The NRC inspectors determined the damper controller failure most likely
occurred between August 2022, (last 24-hour EDG surveillance without abnormal
temperatures) and December 5, 2023. Therefore, the 2A EDG was inoperable between at
least December 5, 2023, and January 2, 2024. The licensee submitted licensee event report
2024-001-00, in accordance with 10 CFR 50.73(a)(2)(i)(B) for the condition prohibited by
technical specifications. From December 17, 2023, at 1943, to December 19, 2023, at 2057,
the Control Area Ventilation System (CRAVS) and Control Room Area Chilled Water System
(CRACWS) shared systems were inoperable due to maintenance on the B trains while the
A trains were supported by the inoperable 2A EDG. The licensee also reported this condition
under 10 CFR 50.73(a)(2)(v) for a condition that could have prevented fulfillment of a safety
function, and 10 CFR 50.73(a)(2)(i)(8) for an operation or condition prohibited by Technical
Specifications. Finally, on December 19, 2023, from 0302 until 0445, and 0904 until 1112,
the 2B EDG was declared inoperable in support of planned testing. This represented a
condition that could have prevented fulfillment of a safety function, and the licensee
reported this condition under 10 CFR 50.73(a)(2)(v) for Unit 2.
Corrective Actions: The licensee completed an equipment failure evaluation for recent EDG
damper controller failures; and updated their commercial grade dedication process to provide
a more comprehensive review of the internal electronics for the damper controllers and
evaluate impact on other safety-related applications of the damper controllers. The licensee
plans to replace all EDG damper controllers. The licensee also updated procedure
PT/2/A/4350/002 A to evaluate performance of the dampers during testing. The licensee
revised the VD system licensing basis documents for consistency in documentation and
revised the VD system operating procedure to include the process for taking one fan OOS.
Corrective Action References: NCRs 02499597 and 02499589
Performance Assessment:
Performance Deficiency: The licensees failure to implement measures to maintain the
functionality of the diesel building emergency ventilation system was a performance
deficiency.
1) The licensee removed the 2A2 fan from service on November 13, 2023, and maintained
the 2A2 fan out of service until February 6, 2024, without validating the impact to the
operability of the EDG. Specifically, the licensee failed to maintain the alignment of the
safety-related portion of the VD system to ensure the system was capable of performing its
function of maintaining room temperatures within design limits.
2) The licensee failed to delineate acceptance criteria to verify proper system response
during surveillance testing to ensure that the safety-related portion of the VD system would
remain capable of performing its function under design conditions. As a result, the licensee
failed to recognize the VD system outside air inlet damper and recirculation damper
associated with the 2A1 fan were nonfunctional due to a failed damper controller.
Screening: The inspectors determined the performance deficiency was more than minor
because it was associated with the Equipment Performance attribute of the Mitigating
Systems cornerstone and adversely affected the cornerstone objective to ensure the
availability, reliability, and capability of systems that respond to initiating events to prevent
undesirable consequences. Specifically, failure to translate VD design basis information for
maintenance and testing, and to incorporate verification of VD system response, allowed
latent ventilation conditions to be undetected. This adversely affected the availability,
reliability, and capability of the VD system to remain functional under all design conditions,
and consequently resulted in the inoperability of the 2A EDG.
Significance: The inspectors assessed the significance of the finding using IMC 0609,
Appendix AProperty "Inspection Manual Chapter" (as page type) with input value "NRC Inspection Manual 0609,</br></br>Appendix A" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., The Significance Determination Process (SDP) for Findings At-Power. The
affected cornerstone was Mitigating Systems, as determined by IMC 0609, Attachment 4,
Initial Characterization of Findings. The inspectors screened the performance deficiency
using Exhibit 2 of Appendix A and determined a detailed risk evaluation was required
because the degraded condition represented a loss of the probabilistic risk assessment
(PRA) function of one train of a multi-train TS system for greater than its TS allowed outage
time.
A Region II Senior Reactor Analyst performed a detailed risk evaluation. The finding was
determined to be preliminarily of low to moderate safety significance (i.e., WHITE). The
preliminary risk estimate was obtained by performing a conditional analysis of the A-train
EDG room ventilation equipment using the applicable condition exposure periods. The
dominant Standardized Plant Analysis Risk (SPAR) model sequences included weather-
related LOOP initiating events. The LOOP was accompanied by failures of the B-train EDG
and the emergency supplemental power source diesel generators leading to a station
blackout (SBO) condition with subsequent failure of the flexible coping (FLEX) 480V diesel
generator resulting in core damage. Because the A-train EDG would have been expected to
operate for some period prior to the onset of SBO conditions, the analysis also considered
adjustments to power recovery terms. See Attachment, UNIT 2 A-EDG ROOM
VENTILATION DETAILED RISK EVALUATION, for a summary of the basis for the
preliminary risk determination.
Cross-Cutting Aspect: H.12 - Avoid Complacency: Individuals recognize and plan for the
possibility of mistakes, latent issues, and inherent risk, even while expecting successful
outcomes. Individuals implement appropriate error reduction tools. The licensee considered
surveillance procedure requirements met when support system equipment was tagged out for
maintenance. The licensee did not have a method to validate temperature response in EDG
rooms during EDG surveillance testing and did not perform a thorough evaluation of
abnormal diesel room ventilation conditions (unexpected odor and high temperatures) during
surveillance testing.
Enforcement:
Violation: 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that
measures be established to assure that applicable regulatory requirements and the design
basis are correctly translated into specifications, drawings, procedures, and instructionsand
design control measures shall be applied to items such as delineation of acceptance criteria
for inspections and tests.
UFSAR Section 9.4.4, Diesel Building Ventilation System, subsection 9.4.4.2, System
Description, states in part that the emergency ventilation system of the diesel building
ventilation (VD) system for each diesel enclosure consists of two 50 percent capacity fans,
ductwork, and modulating return air and outside air dampers arranged to maintain space
temperature between 60°F and 120°F when the diesel is operating. proportioning controls
are provided to modulate the outdoor air dampers toward the open position and the return air
dampers toward the closed position.
UFSAR subsection 9.4.4.4, Inspection and Testing Requirements, state in part, essential
electrical components, switchovers, and starting controls are tested during preoperational
tests and periodically thereafter coincident to testing of the diesels as required by the
technical specifications.
TS 3.8.1, AC Sources - Operating, LCO 3.8.1.b requires, in part, that two diesel generators
capable of supplying the onsite essential auxiliary power systems shall be operable while in
modes 1, 2, 3, or 4. TS 3.8.1, Required Action D.3, requires that required features supported
by an inoperable EDG be declared inoperable. TS 3.7.10, Control Area Ventilation System
(CRAVS), and TS 3.7.11, Control Room Area Chilled Water System (CRACWS), contain
requirements for systems supported by the EDGs. Specifically, TS 3.7.10 requires, in part,
two CRAVS trains to be operable, and Condition F states, in part, to enter LCO 3.0.3
immediately with two trains of CRAVS are inoperable. TS 3.7.11 requires, in part, two
CRACWS trains to be operable and Condition E states, in part, to enter LCO 3.0.3
immediately when two trains of CRACWS are inoperable. LCO 3.0.3 requires in part, that
when an LCO is not met, and the associated actions are not met, action shall be initiated
within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to place the unit, in mode 3 within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />; mode 4 within 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />; and mode 5
within 37 hours4.282407e-4 days <br />0.0103 hours <br />6.117725e-5 weeks <br />1.40785e-5 months <br />.
Contrary to the above, from at least 2006, the licensee failed to establish measures to assure
the design basis for the VD system was correctly translated into procedures and instructions;
and to apply design control measures for delineating acceptance criteria for VD system
testing to ensure the VD system remained functional. Specifically,
1) The licensee did not ensure design basis information contained in UFSAR Section 9.4.4.2
was translated into surveillance procedures and maintenance instructions associated with the
VD system. This resulted in the licensee tagging the 2A2 fan out of service for an extended
period of time (85 days) and relying on one 50 percent capacity fan. Additionally, the 2A2 fan
was not tested coincident with the diesels in accordance with UFSAR subsection 9.4.4.4,
during the December and January EDG surveillance tests.
2) The licensee did not delineate acceptance criteria to verify proper system response (i.e.,
damper modulation) of essential electrical components (damper controller) during
surveillance testing. Test procedures validated that the fan indication illuminated, and fans
were operational, but did not verify that damper response was consistent with the systems
design basis. This allowed the failed damper controller to go undetected sometime after the
August 2, 2022, surveillance test.
As a result, with the 2A2 emergency ventilation fan tagged out of service for maintenance and
the 2A1 emergency ventilation fan unable to provide outside air due to the failed damper
controller, the 2A EDG VD system was nonfunctional which resulted in the 2A EDG being
inoperable. With the 2A EDG inoperable from at least December 5, 2023, to January 2, 2024,
the licensee failed to meet the required actions of TS LCO 3.8.1, Condition B for one
LCO 3.8.1.b [EDG] inoperable. Consequently, because the B Train CRAVS and B Train
CRACWS shared systems were declared inoperable for planned maintenance between
December 17, 2023, at 1543, and December 19, 2023, at 2057, and the A train CRAVS and
A train CRACWS were inoperable per LCO 3.8.1 Required Action D.3 beginning
December 17, 2023, at 1943, LCOs 3.7.10 (CRAVS) Condition F and 3.7.11 (CRACWS)
Condition E, required immediate entry into LCO 3.0.3 for two inoperable trains. Therefore, the
licensee failed to meet LCOs 3.7.10, 3.7.11, and 3.0.3.
Enforcement Action: This violation is being treated as an apparent violation pending a final
significance (enforcement) determination.
EXIT MEETINGS AND DEBRIEFS
The inspectors verified no proprietary information was retained or documented in this report.
On June 18, 2024, the inspectors presented the NRC inspection results to Nicole Flippin
and other members of the licensee staff.
ATTACHMENT: UNIT 2 A-EDG ROOM VENTILATION DETAILED RISK EVALUATION
OVERALL RISK SUMMARY
The Catawba Unit 2 A-train emergency diesel generator (EDG) emergency room ventilation
system was rendered nonfunctional due to the removal of the 2A2 fan motor from service for
maintenance and the failure of the 2A1 fan inlet damper controller. A risk evaluation that
considered the exposure period of these conditions, including the overlap period when both 2A1
and 2A2 conditions existed, preliminarily estimated the delta-Core Damage Frequency (CDF) to
be 5.13E06/year for Unit 2 which represented a risk increase of low to moderate significance
(preliminary WHITE).
EXPOSURE TIME
Because the 2A1 fan inlet damper position was not verified during the performance of
surveillance tests, room temperature data was evaluated to determine if abnormal temperature
increases occurred prior to the performance of the December 5, 2023, test. Based on that
review, the last 24-hour surveillance test of the 2A EDG was performed on August 2, 2022. This
August 2022 test included substantial 2A EDG run time with no indication of abnormal room
temperatures identified during performance of the test. The remaining surveillance tests that
were performed between August 2, 2022, and December 5, 2023, were for significantly shorter
durations which would provide less opportunity to observe room heat up due to a closed
ventilation inlet damper. The analyst concluded that the use of a T/2 exposure period between
August 2, 2022, and December 5, 2023, was most appropriate for the circumstances. Because
post-test data reviews indicated that the 2A1 inlet damper was closed during the
December 5, 2023, surveillance test, the analyst concluded that the full exposure period
between December 5, 2023, and January 3, 2024 (including repair time), would apply. This
resulted in an overall condition exposure period of 274 days that was used in the analysis for
the 2A1 fan controller.
The 2A2 was removed from service for maintenance from November 13, 2023, until
February 6, 2024, which corresponded to a condition exposure period of 85 days.
The overlapping period for these two conditions were addressed by dividing the analysis into
three separate condition exposure periods while considering that 22 days of the overlap period
for the 2A1 fan flow path would be treated as T/2 exposure and therefore considered to be 11
days. This resulted in an overall condition overlap of 40 days (i.e., the sum of 11 days using T/2
and 29 days using T with repair time).
Condition
Exposure Period (days)
Fan 2A2 maintenance
Fan 2A2 maintenance & 2A1 controller failed
Fan 2A1 controller failed
245
The conditions were evaluated separately in the analysis and the results were summed to
estimate the overall increase in risk that was attributed to the performance deficiency.
RISK ANALYSIS CONSIDERATIONS
1.
The room temperature used for the risk analysis was 131°F based on the most limiting
components in the room. Temperature-induced failure of these components would lead to a
failure of the EDG function.
2.
A simplifying assumption for the analysis was that outside air temperatures were constant
when evaluating the time to reach the limiting EDG room temperature of 131°F. The
assumption was necessary to prevent the addition of a substantial amount of complexity to
the evaluation.
3.
Based on room heat up rates, the analysis assumes that EDG room temperatures will not
reach 131°F during the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of operation if outside air temperatures remain below
67°F with no credit for operator action. The analysis evaluated the potential for EDG failure
for outside air temperatures greater than 67°F.
4.
Room heatup rates were based on EDG heat output for loss of coolant accident (LOCA)
sequences. Because loss of offsite power (LOOP) sequence heat output was estimated to
only be approximately 1.1 percent less than LOCA loading, the use of LOCA EDG heat up
rates was determined to not be overly influential in the analysis results.
5.
No recovery or repair credit for the failure of the EDG ventilation system was included in the
evaluation for the preliminary best estimate.
6.
Flexible Coping (FLEX) mitigating strategies and equipment were credited in the analysis
using a 24-hour PRA mission time. FLEX equipment reliability was modeled using
information contained in PWROG18042-NP, Revision 1, FLEX Equipment Data Collection
and Analysis, (ADAMS ML22123A259).
Systems Analysis Program for Hands-On Integrated Reliability Evaluations (SAPHIRE) software
version 8.2.9 (and 8.2.10) and Catawba Standardized Plant Analysis Risk (SPAR) model
version 8.82 were used for the evaluation.
1.
The Catawba SPAR model is a Unit 1 model. Unit 1 basic events were used as surrogates
to model the Unit 2 plant conditions associated with the finding. Additionally, the 2A1 fan
was used as a surrogate to represent the closed inlet damper impact to the fan flow path.
2.
FLEX basic events were adjusted in the base SPAR model to account for best-estimate
reliability of FLEX equipment using industry failure data at a 24-hour mission time. Based on
the unavailability of industry reliability data for load-run basic events, the model was
adjusted to ignore those failures. These adjusted values were used for both the nominal and
conditional case as the performance deficiency did not impact FLEX strategies.
3.
The basic event for failure of operators to declare an Extended Loss of AC Power (ELAP)
when required (FLX-XHE-XE-ELAP) was changed from the default value of 1.0 to 1.0E02
to enable FLEX mitigation sequences in the model.
4.
144 years of daily high temperature data from the National Weather Service for Charlotte,
North Carolina was used to evaluate the likelihood of ambient high temperatures. The data
was used to determine the high temperature standard deviation and a normal distribution
(Mean=72°F, StDev=13°F) was used to estimate those temperature likelihoods.
5.
The time to reach 131°F was evaluated as a function of outside air temperature. The heat
up times were used to establish power recovery times that were offset to account for the
delayed onset of station blackout (SBO) conditions.
6.
The fault tree logic for the EDG ventilation system was modified to split the fail-to-run (FTR)
basic event into separate components so that adjustments could be made to credit EDG
operation prior to temperature-induced failure. Although the fan flowpaths would be failed or
unavailable at the start of the accident sequence, the ultimate failure of the EDG would not
be expected to occur until the loss of ventilation resulted in enough of a temperature
increase to fail the affected EDG. This delayed onset of the EDG failure condition was
modeled by splitting the fan FTR components rather than the EDG FTR basic events.
Modeling the delayed failure using the fan basic components allowed SAPHIRE to calculate
the conditional common cause failure terms for the fans instead of the EDGs without
introducing any modeling errors in the emergency power system fault trees since either a
hardware failure of the EDG or fans would have the same overall impact to system success.
The model was adjusted using change sets for the conditional case. Basic event
EPS-FAN-FR-EX1A2 was set to TRUE so that the FTR common cause change would be
calculated by SAPHIRE. The change set also set the new basic event EPS-FAN-FR-EX1A1-
EXT to 1.0 so the failure would show up in cutsets for post-processing adjustment made for
credited EDG run time prior to ventilation-induced failure.
7.
Event tree post-processing rules were used in the evaluation to account for potential
sources of over-estimation of risk:
a) To substitute the appropriate power recovery terms based on expected EDG operation
prior to failure. As an example, if the EDG would be expected to operate for
approximately six hours (at nominal failure likelihood) prior to failure due to the
performance deficiency, the one-, two-and four-hour non-recovery terms for LOOP
offsite power recovery would be adjusted to seven, eight and ten hours respectively.
b) To account for post-trip reactor decay heat removal by a motor-driven auxiliary
feedwater (MDAFW) pump for some period prior to the start of SBO conditions. Post
processing was used to consider the potential for FLEX mitigation of sequences that
involved early failure of the turbine-driven auxiliary feedwater pump for a sequence
where at least one MDAFW pump would run for a period of hours prior to the expected
failure of its associated EDG.
8.
The following SPAR model event sequences were used in evaluating the nominal and
conditional cases:
Internal Events
Seismic
Hurricane
Tornado
9.
SAPHIRE condition assessments were performed using the Event and Condition
Assessment (ECA) module for each of the plant conditions using the applicable exposure
periods.
LARGE EARLY RELEASE FREQUENCY IMPACT
The finding was evaluated in accordance with Inspection Manual Chapter (IMC) 0609,
Appendix HProperty "Inspection Manual Chapter" (as page type) with input value "NRC Inspection Manual 0609,</br></br>Appendix H" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., Containment Integrity Significance Determination Process, as a Type A finding.
The dominant sequences in the analysis are LOOP sequences and not Steam Generator Tube
Rupture or Interfacing System Loss of Coolant Accident. The standby shutdown facility (SSF)
can power the Unit 2 A-train hydrogen igniters through the power distribution system.
Additionally, the FLEX diesel generators (DGs) can also be aligned to provide power to the
Unit 2 A-train hydrogen igniter supply transformers. The ability to restore power to the hydrogen
igniters from either the SSF or FLEX equipment helps reduce the likelihood of containment
failure for SBO scenarios. For a LOOP/SBO sequence to represent an increase in Large Early
Release Frequency (LERF) risk, core damage and containment failure must occur early in the
sequence and prior to the implementation of the site emergency plan for evacuation. The
analyst noted that when those cutsets associated with success of the SSF or FLEX DGs were
excluded, the resulting risk would not be high enough to alter the overall conclusions of the
analysis even if a conservative LERF screening factor of 1.0 were used for the remaining SBO
delta-CDF cutsets (i.e., E07 range). Accordingly, the analyst concluded that delta-CDF was the
most appropriate risk metric to be used for the evaluation.
CALCULATIONS
Best Estimate:
Fan 2A2
tagged out
(45 days)
Fan 2A2 tagged
out & 2A1 recirc
(40 days)
Fan 2A1 recirc
(245 days)
Total
Internal Events
1.27E08
1.25E06
7.55E07
2.02E06
Seismic
8.12E11
4.26E08
1.73E08
6.00E08
2.79E11
7.79E09
4.15E09
1.20E08
Hurricane
1.21E11
1.90E08
8.54E09
2.76E08
Tornado
3.91E12
8.24E09
3.63E09
1.19E08
2.13E06
SAPHIRE condition assessments were performed using the ECA module. The SPAR model
overall estimated increase in risk was a delta-CDP of 2.13E06. INTERNAL EVENT sequences
were determined to be strongly dominant in the results. Dominant cutsets included weather-
related LOOP initiating events. The loop was accompanied by failures of the B-train EDG and
the emergency supplemental power source (ESPS) diesel generators leading to a station
blackout condition with subsequent failure of the FLEX 480V diesel generator resulting in core
damage.
FIRE results provided from the licensees PRA model indicated that estimated fire risk
was 3.49E07/year when including credit for opening doors for room cooling. The impact of
crediting operator actions in the licensees overall risk evaluation was approximately one order
of magnitude in their INTERNAL EVENTS/INTERNAL FLOOD model. Based on this, the
inferred risk contribution due to FIRE with no credit for opening room doors would be
roughly 3E06/year which would indicate a risk estimate in the low-to mid-E06 range.
Sensitivity - Recovery Credit
The licensee developed an analysis of the impact of opening EDG room stairwell doors as a
means of introducing some air exchange in the room following failure of the ventilation system.
The analysis calculated the mass rate of air exchange as a function of EDG room temperature
for outside air temperatures that were approximately 65°F or less. A sensitivity was performed
to explore the impact of the analysis results with respect to credit for operators opening the
stairwell door to the EDG room to establish buoyancy-driven counter-current air flow through the
upper and lower stairwell doorframes (i.e., cool outside air flowing into the bottom portion of the
doorframes while warm air flows out of the upper portion of the same doorframes in the
stairwell). A screening Human Error Probability (HEP) of 1.0E01 (Sensitivity #1) and the
licensees HEP of 2.3E02 (Sensitivity #2) were used for the sensitivity. Because the SPAR
INTERNAL EVENTS sequences were so strongly dominant in the results, the sensitivity used
those results in combination with estimated FIRE results based on the licensees PRA to
estimate the overall risk change due to varying degrees of recovery credit.
SAPHIRE condition assessments were performed using the ECA module for INTERNAL
EVENTS and the applicable exposure periods.
Event Sequence
Best Estimate
(No Recovery)
Sensitivity #1
HEP 1.0E01
Sensitivity #2
HEP 2.3E02
Fire
3.0E06 (est.)*
5.55E07 (est.)*
3.49E07
Internal Events
2.02E06
4.31E07
2.97E07
Total
5.02E06
9.86E07
6.46E07
As expected, the sensitivity results indicated that the analysis is highly influenced by
consideration of recovery credit with results crossing the E06 threshold at an approximate HEP
of 1.0E01. Because the buoyancy-driven counter-current air flow analysis did not include
consideration of the impact of higher outside ambient air temperatures (i.e., greater than 67°F)
on air mass exchange, the analyst determined that inclusion of this recovery action in the
analysis best estimate results would not be warranted.
- FIRE risk for these cases were estimated values that were inferred from licensee PRA results
which included a recovery HEP of 2.3E02.
LICENSEE EVALUATION
On May 16, 2024, Duke provided an evaluation of the estimated increase in risk due to the
performance deficiency. The analysis concluded that, without crediting operator recovery
actions to open doors to the room for cooling, the estimated delta-CDF for the INTERNAL
EVENTS/INTERNAL FLOOD model was in the low E06 range (excluding credit for FLEX
mitigation). Dominant cutsets for internal events were generally consistent with SPAR model
cutsets and included LOOP initiators accompanied by unavailability of the B-train EDG and
failure of the ESPS diesel generators. If the analysis were adjusted to account for actual (non-
probabilistic) outside temperatures, operator recovery actions to open doors for room cooling,
and power recovery terms adjusted for delayed onset of SBO conditions, the licensees
estimated risk lowered to the low to mid E-07 range for the combination of INTERNAL
EVENTS/INTERNAL FLOOD and FIRE models. On June 5. 2024, Duke provided a revised
PRA evaluation that included, in part, an assessment of FLEX mitigation of the condition and
estimated LERF risk. The revised PRA evaluation is currently under review.
DELTA CDF FOR EXPOSURE TIME
The overall results are summarized below:
Event Sequence
Best
Estimate
Sensitivity #1
HEP 1.0E01
Sensitivity #2
HEP 2.3E02
Fire
3E06 (est.)*
5.55E07 (est.)*
3.49E07
Internal Events
2.02E06
4.31E07
2.97E07
6.00E08
-
-
Seismic
1.20E08
-
-
Hurricane
2.76E08
-
-
Tornado
1.19E08
-
-
Total
5.13E06
9.86E07
6.46E07
Considering that SAPHIRE calculates the difference in core damage probability over a given
exposure time, and that changes in CDF over the same period are numerically equivalent, the
change in CDF due to the finding would be on the order of 5.13E06/year (including estimated
FIRE risk).
- FIRE risk for these cases were estimated values that were inferred from licensee PRA results
which included a recovery HEP of 2.3E02.
EXTERNAL EVENTS CONSIDERATIONS
Internal event risk estimates were greater than 1E07, therefore external event sequences were
included in the risk assessment.
CONCLUSIONS/RECOMMENDATIONS
The preliminary estimated risk increase (delta-CDF) over the nominal case for the unavailability
of the Unit 2 A-train EDG room ventilation equipment was 5.13E06/year. The dominant SPAR
model sequences included weather-related LOOP initiating events. The LOOP was
accompanied by failures of the B-train EDG and the ESPS diesel generators leading to a station
blackout condition with subsequent failure of the FLEX 480V diesel generator resulting in core
damage. Because the A-train EDG would have been expected to operate for some period prior
to the onset of SBO conditions, the analysis also considered adjustments to power recovery
terms. Accordingly, the finding should be preliminarily considered to be a finding of low to
moderate safety significance (i.e., preliminary WHITE).