IR 05000498/2024050
| ML24320A137 | |
| Person / Time | |
|---|---|
| Site: | South Texas  |
| Issue date: | 11/21/2024 |
| From: | Geoffrey Miller NRC/RGN-IV/DORS |
| To: | Harshaw K South Texas |
| References | |
| EA-24-117, EA-24-121 IR 2024050 | |
| Download: ML24320A137 (1) | |
Text
November 21, 2024
SUBJECT:
SOUTH TEXAS PROJECT ELECTRIC GENERATING STATION, UNITS 1 AND 2 - NRC SPECIAL INSPECTION REPORT 05000498/2024050 AND 05000499/2024050 AND PRELIMINARY WHITE FINDING
Dear Kimberly A. Harshaw:
This letter refers to the announced special inspection conducted from September 9-12, 2024, by the U.S. Nuclear Regulatory Commission (NRC). The purpose of the special inspection was to identify the circumstances surrounding the May 12, 2024, South Texas Project (STP) Unit 2 automatic reactor trip and partial loss of offsite power (LOOP), as well as the July 24, 2024, STP Unit 1 automatic reactor trip and LOOP, and review the licensees actions to address the causes of the events. On November 12, 2024, a final exit briefing was conducted with you and other members of your staff. The results of this inspection are documented in the enclosed report.
The enclosed report discusses a preliminary White finding (i.e., a finding with low to moderate safety significance that may require additional NRC inspections), with an associated apparent violation. As described in the enclosed report, NRC inspectors determined the failure to establish adequate preventive maintenance instructions with relevant vendor recommendations pertaining to the calibration of protective relays and the maintenance of hand switch auxiliary contacts was a performance deficiency that was within the licensees ability to foresee and correct. This performance deficiency led to an inadvertent actuation of a protective relay, subsequent reactor trip with partial loss of offsite power, and failure of a safety-related load center breaker to close when called upon during the May 12, 2024, Unit 2 event. The finding was assessed based on the best available information, using the applicable significance determination process (SDP). The final resolution of this finding will be conveyed in separate correspondence.
The finding has an associated apparent violation which is being considered for escalated enforcement in accordance with the NRC Enforcement Policy, which can be found at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. The apparent violation involves the failure to demonstrate that the performance of a plant component, the control room hand switch for operating the load center E2A1 breaker, had been effectively controlled through the performance of appropriate preventive maintenance such that the component remained capable of performing its intended function in accordance with Title 10 of the Code of Federal Regulations (10 CFR) 50.65(a)(2).
In accordance with NRC Inspection Manual Chapter 0609, we intend to complete our evaluation using the best available information and issue our final significance determination and enforcement decision, in writing, within 90 days from the date of this letter. The significance determination process encourages an open dialogue between your staff and the NRC; however, the dialogue should not affect the timeliness of our final determination.
Before we make a final decision on this matter, we are providing you with an opportunity to either (1) attend a Regulatory Conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2) submit your position on the finding to us in writing. If you request a Regulatory Conference, it should be held within 40 days of your receipt of this letter, and we encourage you to submit supporting documentation at least 1 week prior to the conference in an effort to make the conference more efficient and effective. The focus of the Regulatory Conference is to discuss the significance of the finding and not necessarily the root cause(s) or corrective action(s) associated with the finding. If a Regulatory Conference is held, it will be open for public observation. If you decide to submit only a written response, such submittal should be sent to the NRC within 40 days of your receipt of this letter.
If you choose to send a written response, it should be clearly marked as a Response to Apparent Violation in NRC Inspection Report 05000498/2024050 and 05000499/2024050; EA-24-117 and should include for the apparent violation: (1) the reason for the apparent violation or, if contested, the basis for disputing the apparent violation; (2) the corrective steps that have been taken and the results achieved; (3) the corrective steps that will be taken; and (4) the date when full compliance will be achieved. Your response may reference or include previously docketed correspondence if the correspondence adequately addresses the required response. To the extent possible, your response should not include any personal privacy or proprietary information so that it can be made available to the public without redaction.
Additionally, your written response should be sent to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the Director, Division of Operating Reactor Safety, U.S. Nuclear Regulatory Commission, Region IV, 1600 East Lamar Blvd., Arlington, Texas 76011-4511, and the NRC Resident Inspector at South Texas Project, and emailed to R4Enforcement@nrc.gov, within 40 days of the date of this letter.
If an adequate response is not received within the time specified or an extension of time has not been granted by the NRC, the NRC will proceed with its enforcement decision or schedule a Regulatory Conference.
Please contact Patricia Vossmar at 817-200-1144 within 10 days from the issuance of this letter to notify the NRC of your intention to attend a Regulatory Conference or provide a written response. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision.
If you decline to request a Regulatory Conference or to submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of NRC Inspection Manual Chapter 0609. Two findings of very low safety significance (Green) are also documented in this report. Both of these findings involved violations of NRC requirements. Additionally, two Severity Level IV violations without associated findings are documented in this report. We are treating these four violations as non-cited violations (NCV) consistent with section 2.3.2 of the Enforcement Policy.
Regarding one of the two Severity Level IV violations, the NRC determined that a violation of 10 CFR 21.21(a)(1) occurred. The violation involved the failure to adopt appropriate procedures and report a defect associated with a substantial safety hazard for a steam generator power operated relief valve potentiometer. This violation was considered for escalated enforcement at Severity Level III in accordance with the NRC Enforcement Policy. However, in reviewing the specific circumstances of this violation (i.e., the NRC resident staff was aware of the issue; there was little to no impact to the inspection process/regulatory process; the potentiometers were only supplied to South Texas Project and no other licensees; and your staff entered the issue into the corrective action program), the NRC determined that it is more appropriately categorized as a Severity Level IV violation. Since the violation was entered into the corrective action program, not repetitive, and not willful, it is being treated as an NCV, consistent with section 2.3.2 of the NRC Enforcement Policy.
A licensee-identified violation which was determined to be of very low safety significance is also documented in this report. We are treating this violation as an NCV consistent with section 2.3.2 of the Enforcement Policy.
If you contest the violations or the significance or severity of the violations documented in this inspection report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN:
Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC Resident Inspector at South Texas Project Electric Generating Station, Units 1 and 2.
If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; and the NRC Resident Inspector at South Texas Project Electric Generating Station, Units 1 and 2.
Additionally, in the preceding 12 months the NRC issued three Severity Level IV traditional enforcement violations associated with impeding the regulatory process, as described in NRC Inspection Report 05000498/2024010 and 05000499/2024010, dated August 8, 2024, and in this report. In accordance with Inspection Manual Chapter 0305, the NRC has evaluated the use of Inspection Procedure 92723, Follow up Inspection for Three or More Severity Level IV Traditional Enforcement Violations in the Same Area in a 12-Month Period. The NRC determined Inspection Procedure 92723 would not be performed at this time because one of the three violations occurred outside of the 12-month period and because your staff contributed to identification of two of the three violations. However, the NRC concluded that use of this inspection procedure will be reevaluated if additional traditional enforcement violations are accrued. You may benefit from evaluating, and taking actions to address as appropriate, the underlying causes of the trend to avoid additional violations in this area. In accordance with 10 CFR 2.390 of the NRCs Agency Rules of Practice and Procedure, a copy of this letter, its enclosure, and your response, if you choose to provide one, will be made available electronically for public inspection in the NRC Public Document Room and from the NRCs Agencywide Documents Access and Management System (ADAMS), accessible from the NRC website at http://www.nrc.gov/reading-rm/adams.html.
If you have any questions concerning this matter, please contact Patricia Vossmar of my staff at 817-200-1144.
Sincerely, Geoffrey B. Miller, Director Division of Operating Reactor Safety Docket Nos. 05000498 and 05000499 License Nos. NPF-76 and NPF-80
Enclosure:
Inspection Report 05000498/2024050 and 05000499/2024050 with Attachments
Inspection Report
Docket Numbers:
05000498 and 05000499
License Numbers:
Report Numbers:
05000498/2024050 and 05000499/2024050
Enterprise Identifier:
I-2024-050-0000
Licensee:
STP Nuclear Operating Company
Facility:
South Texas Project Electric Generating Station, Units 1 and 2
Location:
Wadsworth, TX
Inspection Dates:
September 9 to 12, 2024
Inspectors:
K. Chambliss, Senior Resident Inspector
J. Drake, Senior Reactor Inspector
L. Flores, Resident Inspector
S. Hedger, Senior Emergency Preparedness Inspector
N. Okonkwo, Reactor Inspector
Approved By:
Geoffrey B. Miller, Director
Division of Operating Reactor Safety
SUMMARY
The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees performance by conducting a special inspection at South Texas Project Electric Generating Station, Units 1 and 2, in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors. Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information. A licensee-identified non-cited violation is documented in report section: 9381
List of Findings and Violations
Failure to Establish Adequate Preventive Maintenance Instructions Leading to Multiple Component Failures Cornerstone Significance Cross-Cutting Aspect Report Section Initiating Events Preliminary White AV 05000499/2024050-03 Open EA-24-117
[P.5] -
Operating Experience 93812 The inspectors identified a finding of preliminary low to moderate safety significance (White) and associated violation of 10 CFR 50.65(a)(2). Specifically, the licensee failed to establish adequate preventive maintenance instructions for a generator protective relay and a safety-related control room hand switch. This resulted in a partial loss of offsite power, an unplanned reactor trip, and subsequent loss of a safety-related motor control center during recovery activities on May 12, 2024.
Failure to Identify a Significant Condition Adverse to Quality Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000499/2024050-01 Open/Closed
[P.1] -
Identification 93812 The inspectors identified a Green finding and associated non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures and Drawings, for the licensees failure to follow procedures for identifying a significant condition adverse to quality. Specifically, the Condition Report Screening Committee screened condition report 2024-4882 as a condition adverse to quality, despite the fact that site Procedure CAP-0003, "Condition Report Screening," revision 6, required the condition report to be screened as significant. This error resulted in the failure to identify the failure mode associated with a safety-related control room hand switch such that corrective actions would prevent recurrence.
Failure to Adopt Appropriate 10 CFR Part 21 Procedures and Report Deviation of a Basic Component Cornerstone Severity Cross-Cutting Aspect Report Section Not Applicable Severity Level IV NCV 05000498,05000499/2024050-05 Open/Closed EA-24-121 Not Applicable 93812 The inspectors identified a Severity Level IV violation of 10 CFR 21.21(a)(1) for the licensee's failure to adopt appropriate 10 CFR Part 21 procedures and failure to properly evaluate the reportability of a deviation in a basic component. As a result, the licensee failed to report a deviation identified on May 12, 2024, that was associated with a reportable defect that could have created a substantial safety hazard were it to have remained uncorrected.
Failure to Provide Timely Notification of Emergency Declaration in Accordance with the Site Emergency Plan Cornerstone Significance Cross-Cutting Aspect Report Section Emergency Preparedness Green NCV 05000498,05000499/2024050-02 Open/Closed
[H.13] -
Consistent Process 93812 The inspectors reviewed a self-revealed Green finding and associated non-cited violation of 10 CFR 50.54(q)(2) for the licensees failure to follow their emergency plan. Specifically, the licensee failed to provide notification of an unusual event declared on July 24, 2024, to State and local governmental agencies within 15 minutes after declaration.
Failure to Satisfy 10 CFR 50.72 Reporting Requirements for an Emergency Declaration Cornerstone Severity Cross-Cutting Aspect Report Section Not Applicable Severity Level IV NCV 05000498,05000499/2024050-04 Open/Closed Not Applicable 93812 The inspectors reviewed a self-revealed Severity Level IV non-cited violation for the licensees failure to meet NRCs reporting requirements in 10 CFR 50.72(a)(3)associated with emergency classification timeliness. Specifically, the licensee failed to provide notification of an Unusual Event classification on July 24, 2024, not later than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after making the emergency declaration.
Additional Tracking Items
Type Issue Number Title Report Section Status URI 05000498, 05000499/2024050-
Repeated Failures of Steam Generator Power-Operated Relief Valves 93812 Open URI 05000498, 05000499/2024050-
Switchyard Fire Cause and Subsequent Switchyard Component Performance 93812 Open
INSPECTION SCOPES
Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with their attached revision histories are located on the public website at http://www.nrc.gov/reading-rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared complete when the IP requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter (IMC) 2515, Light-Water Reactor Inspection Program - Operations Phase. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.
OTHER ACTIVITIES
- TEMPORARY INSTRUCTIONS, INFREQUENT AND ABNORMAL
93812 - Special Inspection
In accordance with the attached original and revised Special Inspection Team (SIT) Charters (attachments 1 and 2), the inspection team conducted a detailed review of the South Texas Project (STP) Unit 2 partial loss of offsite power on May 12, 2024, and STP Unit 1 loss of offsite power on July 24, 2024.
Description of Events and Reactive Inspection Basis May 12, 2024, Event On May 12, 2024, at 4:41 p.m. CDT, STP, Unit 2, automatically tripped from approximately 15 percent power. The trip was caused by a loss of power from the unit auxiliary transformer due to actuation of its lockout relay, which resulted in a loss of power to the reactor coolant pumps and a reactor protection system actuation. Instrumentation and controls technicians were completing an unrelated work order in the same cabinet in the control room that contained the relay at the time of the event. Earlier in the day, the unit had been starting up from a planned refueling outage, and the turbine-generator was offline at the time of the event.
The interruption of power from the unit auxiliary transformer resulted in a loss of power to non-safety-related equipment including the reactor coolant pumps (RCP) and the main condenser. Consistent with the STP electrical distribution design, the loss of power from the unit auxiliary transformer also caused an interruption of power to the A and C engineered safety features (ESF) busses. Emergency diesel generators (EDG) 21 and 23 automatically started and provided power to the A and C busses, respectively. The engineered safeguards bus B was aligned to the standby transformer offsite power source and remained energized from offsite power throughout the event.
The operations crew responded to the event and stabilized the unit in a safe condition using natural circulation of the reactor coolant system. Decay heat removal was provided by the steam generator (SG) power operated relief valves (PORVs).
Due to the reactor protection system actuation while critical, this event was reported as a 4-hour non-emergency notification per 10 CFR 50.72(b)(2)(iv)(B). This event was also reported per 10 CFR 50.72(b)(3)(iv)(A) as an event that resulted in a valid actuation of the emergency diesel generators. The NRC received this report, and it is documented as event notification57124 on the NRCs public website.
Several equipment problems occurred during the event. Control room operators noticed that the 480 V load center E2A feeder breaker failed to automatically close on a load sequencer signal and provide power to 480 V motor control centers (MCC) E2A1 and E2A3. The operators unsuccessfully attempted to close the breaker manually from the control room, placed the breaker hand switch in pull-to-lock and requested electrical maintenance support. These MCCs provide power to several A-train motor-operated valves, and essential cooling water (ECW)pump 2A and EDG 21 essential support components. Electrical maintenance performed a visual inspection and reported there was no obvious deficiency with the breaker. At 5:07 p.m. CDT, the operators removed the breaker hand switch from the pull-to-lock position and the breaker closed automatically, restoring power to the loads.
Additionally, when control room operators transferred SG PORVs from automatic to manual control to use them for decay heat removal, the SG PORV 2C failed to the full-open position when the operator began to manually open the valve. The operator closed the valve using manual control and tried a second time with the same result. The operator closed the SG PORV 2C and continued decay heat removal using the remaining three SG PORVs. Main steam isolation valves were manually closed due to a loss of the condenser as an available heat sink. Auxiliary feedwater (AFW) was used to feed the SGs.
During the event, reactor coolant pump 2B developed a high seal leakoff flow rate, indicating a degraded seal. While one stage of the multi-stage pump seal had failed, integrity of the seal was maintained as a result of the other intact seal stages. The licensee decided it was necessary to continue the cooldown to cold shutdown conditions to replace the reactor coolant pump seal.
Shortly after the event occurred, the licensee worked to realign available offsite power sources to supply the safety and non-safety electrical busses. Standby bus 2F was reenergized from the Unit 2 standby transformer at 5:29 p.m. CDT, and the safety-related 2A bus was transferred off the diesel generator and realigned to receive power from standby bus 2F at 11:33 p.m. CDT.
Standby bus 2H was reenergized from the Unit 1 standby transformer at 5:47 p.m. CDT, and the safety-related 2C bus was realigned from the diesel generator to receive power from standby bus 2H at 5:30 a.m. CDT the next morning, May 13, 2024. Normal decay heat removal was placed in service using the residual heat removal (RHR) pumps and the unit entered cold shutdown on May 14, 2024.
Management Directive (MD) 8.3, NRC Incident Investigation Program, was used to develop a recommendation on the level of NRC response for this event. In evaluating the deterministic criteria of MD 8.3, the staff determined that the event met two of the deterministic criteria.
Specifically, the event led to multiple failures in systems used to mitigate an actual event and involved an example of repetitive failures involving safety-related equipment. In evaluating the risk assessment criteria of MD 8.3, the estimated conditional core damage probability was determined to be approximately 2.1E-5. The MD 8.3 evaluation for the May 12, 2024, event is included as Attachment 3 to this inspection report.
Based on the deterministic criteria and risk insights related to this event, the perceived complexity of the event, and the need for inspection staff resources with electrical engineering expertise, Region IV management determined that the appropriate level of NRC response was to conduct a special inspection. The special inspection, originally scheduled for the week of July 8, 2024, was deferred to the week of September 9, 2024, due to Hurricane Beryl, which made landfall nearby on the Texas coast on July 8.
July 24, 2024, Event On July 24, 2024, at 7:02 a.m., CDT, STP, Unit 1, automatically tripped from full power. A failure of shunt reactor 2 in the switchyard, and a resulting fire, caused a main generator lockout, loss of power from the north and south buses, lockout of standby transformer 1, turbine trip and reactor trip. The event resulted in a loss of offsite power (LOOP) to each Unit 1 ESF bus and the autostart and loading of its associated EDG. All three trains of the AFW system automatically started.
The loss of the south switchyard bus also caused a loss of standby transformer 2. Unit 2 remained online with its output limited to Hillje circuit 64 and operators reduced power to 90 percent as requested by the grid operator. The Unit 2, unit auxiliary transformer remained available to provide power to Unit 2 ESF buses A and C. However, with the loss of standby transformer 2, offsite power was lost to ESF bus B, resulting in the autostart and loading of its associated EDG and the autostart of AFW train B.
The Unit 2 shift manager declared a notification of unusual event (NOUE) at 7:18 a.m., CDT, based on emergency action level (EAL) SU1 for loss of all offsite power capability to emergency buses for greater than 15 minutes, due to conditions on Unit 1, and assumed the duties of emergency director. Offsite fire responders arrived at the site and extinguished the fire using aqueous foam at 9:25 a.m., CDT.
Because offsite power was unavailable to operate the Unit 1 reactor coolant pumps or use the condenser as a heat sink, operators isolated the main steam lines and maintained natural circulation cooling in the reactor coolant system (RCS) using AFW flow to the steam generators and the SG PORVs as a heat sink to the atmosphere. At 9:53 a.m., CDT, after operators placed the SG PORV controllers in manual to keep them from cycling, they noticed that the SG PORV 1C was closed and could not be controlled in manual, nor would it operate when placed in automatic. The licensee declared the SG PORV 1C inoperable at 9:53 a.m. The main steam safety valve (MSSV) acoustic monitoring system was not available to indicate whether any MSSV had lifted. However, based on local observation and measured steam header pressure, the licensee concluded that at least one MSSV had lifted to reduce steam line 1C pressure.
The licensee terminated the NOUE at 11:46 a.m. The licensee determined that offsite power remained available from the 138 kV transmission line via the emergency transformer and this offsite source could have provided power to an ESF bus during the event.
The south switchyard bus, and standby transformer 2, were re-energized at 12:12 p.m. This allowed the licensee to proceed with restoring offsite power to Unit 2 ESF bus B and all three Unit 1 ESF buses. Unit 1 also restored offsite power to non-ESF buses and restored operation of a reactor coolant pump at 1:46 p.m., CDT. Standby transformer 1 remained unavailable due to damage to its feeder cables from the switchyard.
At 1:50 p.m., CDT, the licensee evaluated electrical bus alignment and ESF power availability and concluded both the north and south buses were operable and all Unit 2 ESF buses were powered by the unit auxiliary transformer.
The licensee performed troubleshooting of Unit 1 SG PORV 1C but was unable to identify a definitive cause of its failure. However, the licensee identified abnormal indications that plant computer signals for valve operation were being received by the valves servo amplifier circuit card but were not being transmitted beyond the card to the valve actuator. As a result, the licensee replaced the servo amplifier and some other suspect electrical components. Following post-maintenance testing, the licensee declared SG PORV 1C operable on July 28, 2024, at 2:50 p.m., CDT.
Regarding the cause of the shunt reactor failure, the licensee had not completed a causal review at the time of the inspection. However, the licensee believed that the stormy weather at the time of the event may have caused or contributed to the event. The licensee noted that during the event, several chain link fences around the protected area and switchyard were seen sparking over a period of several seconds prior to the shunt reactor failure. The licensee believed this phenomenon may have been the cause of the shunt reactor failure, resulting in grounding phases of the shunt reactor and igniting the oil-filled equipment.
On July 29, 2024, the licensee provided an update to the event notification that initially reported the NOUE. The update stated, After a review of station logs, it was determined that there was not a loss of all offsite AC power to Unit 1 An offsite power source was available through the 138 kV transmission line. This referred to the offsite power supply which provides power to the emergency transformer offsite source, which has capability to provide power to one ESF bus for each unit. The NRC staff noted that some licensee internal communication issues occurred during the event which challenged timely and accurate classification and notifications.
Unit 1 was restarted and placed online on August 1, 2024.
Management Directive 8.3, NRC Incident Investigation Program, was used to develop a recommendation on the level of NRC response for this event. In evaluating the deterministic criteria of MD 8.3, the staff determined that the event met one of the deterministic criteria.
Specifically, the event involved an example of repetitive failures involving safety-related equipment. In evaluating the risk assessment criteria of MD 8.3, the estimated conditional core damage probability was determined to be approximately 4.1E-5. The MD 8.3 evaluation for the July 24, 2024, event is included as Attachment 4 to this inspection report.
Based on the deterministic criteria and risk insights related to this event; the perceived complexity of the event; and the need for inspection staff resources with electrical engineering expertise and emergency preparedness expertise, Region IV management determined that the appropriate level of NRC response was to conduct a special inspection and that it could be combined with the previously-chartered special inspection.
Review of Charter Items
1. During the initial debrief to management on the first day of onsite inspection, provide a
recommendation to Region IV management as to whether the inspection should be upgraded to an augmented inspection team.
During the first day of the onsite special inspection, the inspectors met with members from the licensees operations, engineering, licensing, and maintenance departments. The licensee provided the inspectors with a brief overview of both events, current status of causal products, an overview of completed and planned corrective actions, and a site tour of structures, systems, and components affected by both events.
The inspectors determined no new significant issues were identified that were not previously assessed using MD 8.3 by Region IV during development of the charter items. Also, the inspectors reviewed LER 2024-001-00, Unit 2 Automatic Reactor Trip and Actuation of Two of Three Emergency Diesel Generators, and determined there was no new information of significance which would result in an increase in risk that would lead to recommending escalation of the special inspection into an augmented inspection.
Therefore, the inspectors provided a recommendation to regional management to not escalate the special inspection.
associated equipment failures. The chronology should include the status of plant equipment and licensee actions to respond and mitigate the conditions. The timeline should consider any licensee actions that served as missed opportunities to identify the equipment failures before they occurred during the event.
Time and Date Events and Actions
UNIT 2 AUTOMATIC REACTOR TRIP ON MAY 12, 2024 08/25/2021
During performance of work authorization number (WAN) 605160, when requested, Operations used the OIM up pushbutton to drive SG PORV 2C open. After holding the up pushbutton for an adequate time for a full-open stroke, the valve never moved.
04/25/2024
SG PORV 2C did not respond the Close(down) pushbutton being depressed for approximately 11 seconds during PSP05-MS-7411L.
SG PORV 2C did travel full closed after the delay.
Pre-Trip
Unit 2 in mode 1 at 15 percent power
Rod control in manual, due to startup from planned refueling outage.
Turbine offline at time of event.
Main generator was offline due to case expansion alarm.
At 2:21 p.m.,
05/12/2024 EVENT DAY
Performed a (manual) turbine trip below P-9 per 0POP04-TM-0002 due to main turbine generator low pressure (LP) differential expansion at 0.570 inches and lowering.
Evaluation from engineering and maintenance determined the alarm appeared valid.
Entered 0POP04-TM-0003. "Turbine trip below P-9"
Turbine trip also opens the main generator circuit breaker (MGCB).
This trip removed the restraining voltage to the 21/G1 relay. This resulted in the first vibration of the 21/G1 relay At 3:38 p.m.,
05/12/2024
Non-safety emergency transformer de-energized to support 138KV outage.
At 4:30 p.m.,
05/12/2024
Three instrumentation and control (I&C) personnel entered the Unit 2 control room requesting permission to investigate/replace the resistor for indicating light on CP008 extraction steam valve LV-7923.
At 4:41 p.m.,
05/12/24
Three
- (3) I&C technicians closed door to CP-10 that contained the relay and control room lights de-energized. Closing the door resulted in the second vibration of the 21/G1 relay.
Breakers o
Switchyard breakers Y590 and Y600 tripped.
o Load center E2A1 Class 1E 480 V supply breaker providing power to MCC E2A1 and MCC E2A3 failed to close automatically on load sequencer signal and following LOOP.
o Also, the E2A1 LC breaker 2E failed to close using the hand-switch due to high resistance between contacts.
o load center 2W deenergized.
o TS 3.8.3.1.a, Action A was entered.
Trip o
Reactor trip automatically due to UAT lockout.
o All rod bottom lights lit.
o Trip breakers open. Rx trip event was initiated by main generator distance relay trip signal due to agitation
/vibration.
EDGs 21 and 23 auto starts in less than 10 secs.
Buses o
13.8kV standby busses 2F and 2H lose power from unit auxiliary transformer (UAT) supply.
o All 13.8kV auxiliary busses 2F, 2G, 2H, and 2J, lost power.
o Condenser vacuum unavailable due to loss of aux busses.
Emergency Procedure 0POP05EO0000 entered and 0POP05ES0001 immediately after, to mitigate casualty.
Main transformer/generator lockout occurs.
LOOP o
Trip signal caused switchyard lockout which resulted in LOOP on A and C ESF busses. B ESF bus remained energized from offsite power.
o ECW/CCW on trains 2A and 2C started on sequencer LOOP Actuation.
o Loss of circ water pumps due to LOOP.
Feedwater isolation
All four RCP lost power. RCP 2A and RCP 2C trip on underfrequency and undervoltage.
SG PORV 2C failed to the full-open position when taken to manual for decay heat removal and the open pushbutton was pressed. SG PORV declared inoperable.
At 4:45 p.m.,
05/12/2024
Manually isolated main steam isolation valves (MSIVs) using safety grade solenoid switches, per site procedures from the control room.
At 5:05 p.m.,
05/12/2024
SG PORV 2C placed in manual for venting, SG PORV opened to full travel without required input from operator. SG PORV 2C declared INOPERABLE.
At 5:07 p.m.,
05/12/2024
After one unsuccessful attempt, LC Breaker E2A1 was successfully closed using hand-switch after placing it in "pull-to-lock" PTL and returning the hand switch to Automatic.
Class 1E 480 V Load Center E2A1 is energized.
Exited Technical Specification 3.8.3.1.a, Action 'A.
At 5:29 p.m.,
05/12/2024
2F standby bus was energized from standby 2 transformer.
At 5:33 p.m.,
05/12/2024
2H standby bus was energized from standby 1 transformer.
At 5:45 p.m.,
05/12/2024
2F auxiliary bus was energized from standby 2 transformer.
At 5:47 p.m.,
05/12/2024
2H auxiliary bus was energized from standby 1 transformer.
At 5:50 p.m.,
05/12/2024
2J auxiliary bus was re-energized from offsite power.
At 5:53 p.m.,
05/12/2024
2G auxiliary bus was re-energized from offsite power.
At 5:58 p.m.,
05/12/2024
RCP 2D restarted for forced cooling.
RCP 2B was not restarted. Was declared inoperable due to seal failure. Exited TS 3.4.1.2, Action C.
At 7:17 p.m.,
05/12/2024
RCP 2A started for plant stabilization.
At 7:18 p.m.,
05/12/2024
Load Center 2D1 energized from offsite power.
At 7:21 p.m.,
05/12/2024
Load Center 2D2 energized from offsite power.
At 7:50 p.m.,
05/12/2024
Completed NRC 4-hour notification under 10 CFR 50.72(b)(2)(iv)(B) for RPS actuation and 10 CFR 50.72(b)(3)(iv)(A)for EDG 21 and 23 actuations.
At 11:33 p.m.,
05/12/2024
2A ESF restored to 2F standby bus.
At 5:30 p.m.,
05/13/2024
2C ESF restored to 2H standby bus.
05/14/2024
Entered cold shutdown.
05/16/2024
Post maintenance and surveillance testing (PMST) done. After replacing the control room hand switch, the breaker and the new switch passed PMST.
Time and Date Events and Actions
UNIT 1 AUTOMATIC REACTOR TRIP ON JULY 24, 2024 At 10:37 a.m.,
11/16/2023
Due to a part 21 vendor notification under condition report (CR) 2023-10139 a plant impact form was completed. The licensee determined additional actions needed to be taken to correct the vulnerabilities with the impacted potentiometers for SG PORV 1C.
Due to the part 21 vendor notification, the potentiometers STP had in stock were sent off back to the vendor to be corrected.
At 7:13 p.m.,
01/23/2024
SG PORV 1C failed closed while operators attempted to open valve further in manual. An incorrect determination was made regarding the cause of the failure (servo amplifier).
01/30/2024
Management Performance Improvement Committee (MPIC) met.
Open station investigations on the SG PORV 1C was discussed but no actions taken.
02/06/2024
MPIC meeting notes on open station investigations section - LER needing a timeline, and common cause in the SG PORVs. Action was that after completion from the prompt equipment performance checklist (PEPC), an operational readiness checklist will be completed.
At 9:33 a.m.,
03/18/2023
Unit 1 pressurizer PORV failed to open when operated from the control room hand switch.
05/21/2024
MPIC meeting - Talked about the Rx trip May event and mentioned a cause was under investigation. There was also a PEPC on the transfer switch that malfunctioned and prevented operation of pressurizer PORV.
Pre-Trip
Unit 1 in mode 1, 100 percent power At 7:02 a.m.,
07/24/2024 EVENT DAY
UNITS o
Unit 1 automatically trips at full power.
o Unit 2 remained online with its output limited to Hillje circuit 64 and operators reduced power to 90 percent as requested by the grid operator.
ARC FLASHES o
Three
- (3) arc flashes were captured at the middle and ground level of the East side of RT2 and at the base of the C-phase bushing. The bushing erupts into a fireball.
o the PA fence was seen arching in multiple areas.
A failure of shunt reactor 2 (RT2) in the switchyard, and a resulting fire, caused a main generator lockout, loss of power from the north and south buses, lockout of standby transformer 1, turbine trip and reactor trip.
o CenterPoint Energy initiated investigation of the cause of the catastrophic failure of grounded 345kV shunt RT2 in the switchyard.
NORTH BUS o
345kV North bus tripped/experienced a C-phase to ground fault and the bus differential protective relaying picked up and tripped associated 345kV breakers Y650, Y620, Y590, Y560, Y530, Y500 within 3 cycles to clear the fault.
o Power was lost to the 13.8 kV auxiliary buses and A and C train ESF buses when switchyard breakers Y510 and Y520 opened.
o STP-1 protective relays tripped generator breaker G010 along with breakers Y510 and Y520 for an A-phase to ground fault.
LOOP o
The event resulted in a LOOP to each Unit 1 ESF bus and the AutoStart and loading of its associated EDG.
o All three trains of the AFW system automatically started.
o ESF diesel generators 11, and 13 for the STP Unit 1 A, and C ESF buses started and sequenced on LOOP program loads.
o ESF diesel generator 12 starts to power B train ESF buses.
SOUTH BUS o
The loss of the south switchyard bus also caused a loss of standby transformer 2. This also resulted in loss of offsite power to ESF bus B, resulting in the AutoStart and loading of its associated EDG and the autostart of AFW train B.
At 7:04 a.m.,
07/24/2024
SOUTH BUS o
345 kV south bus tripped on breaker RT20 breaker failure protection (even though breaker RT20 was already open).
o Breaker failure logic asserts in the shunt reactor protective relaying, thereby sending a trip signal to the 345 kV south bus. Breakers Y660, Y640, Y610, Y580, and Y550 associated with 345 kV South bus trip and lock-out.
o STP Unit 2 B train ESF buses aligned to standby transformer 2 lost power switchyard breakers directly connected to the 345 kV south bus opened after the initial STP Unit 1 LOOP and reactor trip; therefore, STP Unit 2 B train ESF buses aligned to standby transformer 2 lost power
CenterPoint is still evaluating exactly why this south bus trip occurred.
At 7:07 a.m.,
07/24/2024
Unit 1, shift manager (SM) was notified of the fire in the switchyard
Quintron phones were deenergized causing delay in PA announcements. Unit 1, SM asked Unit 2, SM to assume fire response duties through the ENS Communicator.
Operators had to manually log into the Quintron unit. Lost radio communications. Delayed comm (Quintron) was down for 5 minutes.
Phone lines were down for 30 seconds only. No dial tone. UPS failed.
Didnt auto reset.
At 7:08 a.m.,
07/24/2024
Breaker Y590 was manually closed via STP Unit 2 control room.
At 7:18 a.m.,
07/24/2024
Unit 2, SM assumed emergency director (ED) duties.
NOUE was declared by Unit 2 SM based on emergency action level (EAL) SU1 for loss of all offsite power capability to emergency buses for greater than 15 minutes, due to conditions on Unit 1.
Note: The ED/SM2 did not have time to review the EAL Tech Basis manual and therefore did not review the basis statement regard offsite capability (i.e., availability of 138kV line/emergency transformer).
Unit 2 control room staff contacted Bay City police department requesting fire dept support in accordance with 0POP04-ZO-0008, Fire/Explosion.
At 7:22 a.m.,
07/24/2024
Breaker Y590 tripped open again and the 345 kV north bus voltage also dropped but is restored almost immediately.
At 7:29 a.m.,
07/24/2024
The ED/Unit 2, SM approved ONM No. 1 (Offsite Notification Message) Unusual Event Initial Notification At 7:42 a.m.,
07/24/2024
Unit 2, SM retracted the NOUE declaration.
Between 7:29 a.m., CDT, when the initial ONM was approved by the Unit 2 SM and 7:42 a.m., CDT before retracting, the operations director, operations manager, and plant manager discussed and said the NOUE declaration was inappropriate.
At 8:02 a.m.,
07/24/2024
Bay City fire department arrived on site at the switchyard to extinguish the fire.
At 8:07 a.m.,
07/24/2024
Emergency notification response system (ENRS) activated.
49 minutes following the event declaration.
At 8:23 a.m.,
07/24/2024
CenterPoint Energy deenergized the north bus to isolate standby transformer 1.
At 8:30 a.m.,
07/24/2024
CenterPoint reenergized 345kV north bus and it was manually restored through breaker Y620.
At 8:31 a.m, 07/24/2024
NRC headquarters operations officer (HOO) notified. 73 minutes after evet declaration.
At 8:38 a.m.,
07/24/2024
Breaker Y590 was restored.
At 9:25 a.m, 07/24/2024
Offsite fire responders arrived at the site and extinguished the fire using aqueous foam.
At 9:32 a.m.,
07/24/2024
Attempted to open SG PORV 1C, PORV did not stroke, and demand did not change on controller. STP performed additional troubleshooting and determined that the actual cause of the failure was an A-B solenoid ground.
At 9:53 a.m.,
07/24/2024
The licensee declared the SG PORV 1C inoperable. Operators noticed that the SG PORV 1C was closed and could not be controlled in manual, nor would it operate when placed in automatic.
At 10:47 a.m.,
07/24/2024
ONM No. 2 was transmitted via Fax. Unusual Event Follow-Up Notification At 11:46 a.m.,
07/24/2024
NOUE was terminated.
At 11:55 a.m.,
07/24/2024
ONM No. 3 was approved by U2SM/ED. Termination Initial Notification At 12:12 p.m.,
07/24/2024
The 345kV south switchyard bus, and standby transformer 2, were re-energized.
At 12:23 p.m.,
07/24/2024
Standby bus 1F energized from standby 2 transformer.
At 12:37 p.m.,
07/24/2024
Auxiliary bus 1F energized from standby bus 1F.
At 12:49 p.m.,
07/24/2024
Auxiliary bus J energized from standby 2 transformer.
At 1:46 p.m.,
07/24/2024
Unit 1 also restored offsite power to non-ESF buses and restored operation of a reactor coolant pump.
At 1:50 p.m.,
07/24/2024
The licensee evaluated electrical bus alignment and ESF power availability and concluded both the north and south buses were operable and all Unit 2 ESF buses were powered by the unit auxiliary transformer.
Unit 2 then exited Technical Specification (TS) 3.8.1.1.e (two offsite power circuits inoperable) but remained in TS 3.8.1.1.a (one offsite power circuit inoperable).
At 2:21 p.m.,
07/24/2024
Standby bus 1G energized from standby 2 transformer.
At 2:29 p.m.,
07/24/2024
Auxiliary bus 1G energized from standby bus 1G.
At 2:42 p.m.,
07/24/2024
Standby bus 1D energized.
At 3:02 p.m.,
07/24/2024
Standby bus 1H energized from standby 2 transformer.
At 3:44 p.m.,
07/24/2024
Breaker Y610 was closed.
At 9:15 p.m.,
07/24/2024
Unit 2 was restored to 100 percent power.
At 2:50 p.m.,
07/28/2024
Following post-maintenance testing, the licensee declared SG PORV 1C operable.
07/29/2024
Licensee withdrew the NOUE declaration as they stated that an offsite power source was available through the 138 kV transmission line.
07/31/2024
STP Unit 1 remains offline and is recovering from the forced outage, and standby transformer 1 remains disconnected from the 345 kV north bus due to collateral damage to a tower, insulators, and overhead conductors.
08/1/2024
Unit 1 was restarted and placed online.
09/3/2024
MPIC committee met and discussed a Common Cause Charter for SG PORVs.
3. Review the licensees causal evaluation(s) and determine if they are being conducted at a
level of detail commensurate with the significance of the issues that were encountered during the events. Evaluate the identification of the failure mode and the troubleshooting approach that supports the stations confidence in determination of the direct causes.
Consider the licensees application of relevant industry operating experience.
The inspectors reviewed causal products related to the transformer lockout relay failure, the load sequencer failure, the repeated failures of the SG PORVs, and the emergency preparedness response for the July 24, 2024, event. Additionally, the inspectors reviewed the sites corrective action program Procedure CAP-003, Condition Report Screening, revision 6.
The inspectors determined not all causal evaluations were being conducted at a level of detail commensurate with the significance of the issue. Regarding the May 12, 2024, event, the site only utilized one causal evaluation (for the inadvertent actuation of the 21/G1 relay) above the lowest level product PEPC.
The site performed an inadequate causal review of the load sequencer failure and did not appropriately classify the failure as a significant condition adverse to quality (SCAQ). Licensee procedure CAP-003 defines, in part, a significant condition adverse to quality as a Condition Adverse to Quality, which if left uncorrected, could have a serious effect on safety or operability. Examples from this procedure of SCAQs include:
- The failure of one train of a safety-related system and the extent-of-condition investigation indicates a high degree of certainty that another train is similarly impacted, such as a common mode failure
- System failures resulting in the total loss of a safety-related function described in a Current Licensing Basis The load sequencer failed due to a suspected hand switch failure which, if left uncorrected, could result in two different SG PORVs from fulfilling their safety function. Per CAP-003, this should have resulted in a root cause evaluation. However, the site only performed a PEPC.
The inspectors documented a violation in the Inspection Results report section below related to the licensee's failure to identify a significant condition adverse to quality for the hand switch failure.
The inspectors determined the sites causal evaluations for the repeated SG PORV failures were not commensurate with the significance of the issues. Following each SG PORV failure, the site performed PEPC level evaluations and failed to identify failure modes to prevent further similar failures. Additionally, the sites troubleshooting approach failed to determine direct causes. After considerable questions were raised to the licensee by the NRC resident and SIT inspectors prior to the teams onsite arrival, the licensee chartered a common cause evaluation for the SG PORV failures which commenced the same week as the onsite week for the special inspection.
The inspectors determined that the site had completed an adequate review of operating experience relevant to the plant events at the time of the inspection. However, previously, the site had weaknesses in this area. Specifically, the licensee did not evaluate and implement actions related to external operating experience from 2007, which could have prevented the May 12, 2024, event.
4. Review the licensees extent-of-condition evaluation(s) to determine if the licensee has
adequately considered similar vulnerabilities with other transformer lockout relays, similar conditions that led to the load center breakers failure to close, and similar deficiencies in other steam generator PORVs for both units.
The inspection team reviewed all condition reports and extent of conditions generated for lockout relay failures, load center breakers, and SG PORVs for both units. Regarding the transformer protective relays, the inspection team concluded the site performed an adequate extent-of-condition evaluation. The inspection noted this can be attributed to the sites utilization of the root cause evaluation process for this issue. The inspection team noted the site had previously been issued a Green non-cited violation for a similar hand switch failure for high head safety injection (HHSI) pump 2B as described in NRC Inspection Report 05000498/2021004 and 05000499/2021004, dated January 30, 2022. Additionally, on February 29, 2024, a hand switch failure resulted in the loss of pressurizer PORV 0656A. The inspectors determined that although the extent of condition the licensee was performing at the time of the inspection for the pressurizer PORV hand switch failure was broadly scoped, a more comprehensive extent of condition for the HHSI pump could have prevented the failure of the load center breaker to close during the May 12, 2024, event. Prior to the arrival of the special inspection team, the licensee had not yet performed an extent of condition evaluation related to the SG PORV failures. The licensee commenced a common cause evaluation addressing the failures of the SG PORVs on September 9, 2024; and, as of completion of the special inspection, the common cause evaluation was not complete. The inspectors identified an unresolved item (URI) related to the licensees extent of condition for the SG PORV failures which is documented in the results section of this report.
5. Review completed and proposed corrective actions to determine if the licensee has/is
taking appropriate actions to address the auxiliary transformer lockout, load center feeder breaker, steam generator PORV conditions, and July 24, 2024, event.
The inspection team reviewed all the condition reports and casual evaluations in order to assess completed and proposed corrective actions for each of the charter items.
The inspectors did not identify any issues of concern associated with the corrective actions for the lockout relay failure. The site performed a root cause evaluation and identified multiple contributing factors to the relays failure. Additionally, the site is using information provided by an independent laboratory analysis to inform and correct the calibration procedure and determine enhancements to the wiring configuration for the relays.
The inspectors determined the corrective actions for both the load center feeder breaker failure and SG PORV failure were inadequate. The site failed to recognize the significance of the failure of the load center breaker failure. The inspectors identified a non-cited violation for the failure to classify the issue as a significant condition adverse to quality, which is documented in the results section of this inspection report. At the time of the inspection, the site had yet to develop substantial corrective actions for the repeated SG PORV failures; however, the site had recently commissioned a common cause evaluation of these repeated PORV failures. The inspectors have identified an URI which is documented in the results section of this report.
6. Determine if the steam generator PORV degraded condition observed during the May 12,
2024, event would likely have prevented successful operation of the valve in both automatic and manual mode.
The inspection team reviewed the condition reports, and the licensee event report related to the May 12, 2024, event. Additionally, the inspectors reviewed the licensees updated final safety analysis report (UFSAR).
UFSAR section 10.3.2.4 states: The automatic operation of these valves is assumed in the safety analysis as discussed in Chapter 15. Section 15 details several accident analyses where successful operation of the SG PORVs is assumed. The operation of these PORVs is also credited in accident scenarios for pressure control and cooldown of the RCS. For example, during a small-break loss of coolant accident, the SG PORVs are required to be able to be operated in manual mode. Specifically, operator action to lower the SG PORV setpoints to 1000 psig within 45 minutes of accident initiation is credited for the purpose of providing a more rapid cooldown of the primary side by depressurizing the secondary side via the PORVs.
Operators must take manual action to change the setpoint.
During the May 12, 2024, event, SG PORV 2C could only move to the full-open position on an open signal or the full close position on a close signal. The feedback loop was inoperable and did not allow automatic nor operator-controlled manual modulation of the SG PORV valve position. The inspectors determined the SG PORV degraded condition observed during the May 12, 2024, event would have prevented successful operation of the valve in both automatic and manual mode.
7. Evaluate steam generator PORV deficiencies over the last 2 years, including failures
during the Unit 1 January 21, and February 29, 2024, forced outages and the Unit 2, 2024 refueling outage. Determine if past licensee corrective actions to address failures were adequate.
The inspection team reviewed every SG PORV failure over the past 2 years as well as a few condition reports related to SG PORV failures from earlier than 2 years ago. The inspection team developed an exhaustive list of all SG PORV failures, as shown below:
UNIT 1 SG PORV FAILURES SG PORV CR STATUS DATE CONDITION REPORT #
ISSUES Closed 12/09/2020 CR 20-12405 While performing 0PSP03-MS-0001 SG PORV 1A failed to open in manual from the control room.
Open 01/22/2024 CR 24-750 SG PORV 1A not responding to open or closed signal from the control room in auto or manual.
SG PORV 1A Open 09/05/2024 CR 24-8566 During initial strokes of SG PORV 1A for PM 91000084, received SG PORV 1A low N2 pressure ICS alarm, and PORV position indications on the controller went erratic and indicated full-open and full-closed multiple times. Also received ICS alarm SG PORV 1A POSITION bad data.
Locally valve had smooth strokes.
SG PORV 1B N/A N/A N/A N/A Open 11/16/2023 CR 24-10508-1 Due to a part 21 vendor notification under CR 23-10139 a plant impact form was completed. Identified vulnerabilities with potentiometers for SG PORVs 1C, 2A, 2B, and 2C.
Open 01/23/2024 CR 24-806 LER 1-24-001, Green NCV for violation of 10 CFR 50, Appendix B, Criterion XVI for failure to correct a condition adverse to quality. SG PORV 1C failed closed while attempting to open valve further in manual. Valve unable to be opened.
Open 03/01/2024 CR 24-2042 Attempted to open SG PORV 1C 7431, PORV did not stroke, and demand did not change on controller.
SG PORV 1C Open 07/24/2024 CR 24-7221 Attempted to open SG PORV 1C, and it did not stroke, and demand did not change on controller. During LOOP, PORV was initially functioning normally in AUTO. Operator placed PORV controller in MANUAL, per ongoing EOPs, and PORV closed and would not respond in MANUAL or AUTO (M/A) (SG pressure above PORV setpoint). PORV remained closed.
Closed 10/09/2021 CR 21-10382 While venting SG PORV 1D during 0POP03-ZG-0007, while opening PORV (with control room M/A station)and with position indication indicating approximately 90 percent open, observed indication peg low to 0 percent and then return to 90 percent two times. No other indications the valve moved.
SG PORV 1D Closed 04/12/2023 CR 23-3925/
Unit 1 Negative acceptance criteria trend for SG PORV 1D closing Stroke time measured in 0PSP03-MS-0001.
24.19 seconds was within acceptance criteria but warranted evaluation prior to next performance. If trend continued, Acceptance Criteria may not be met in 18 months. Current Margin is only 0.09 seconds from criteria of 14.57 - 24.28 seconds.
UNIT 2 SG PORV FAILURES SG PORV CR STATUS DATE CONDITION REPORT #
ISSUES Closed 05/27/2020 CR 20-6023 While performing 0PSP03-MS-0001 for SG PORV 2A, valve did not meet acceptance criteria for closed stroke time. When down arrow depressed on controlling station, the valve did not respond for 10 seconds, then began to move and continued to full closed position. Stroke time was 31.15 seconds, acceptance criteria 14.83 to 24.72 seconds. Visual observation locally and control room indications for full closed indication were simultaneous. No abnormal operation or indications in field.
Closed 03/20/2021 CR 21-3017 Received erratic stroking indication of SG PORV 2A when attempted to open
>10 percent to support plant cooldown.
Valve indication in the control room position was cycling between open and closed while attempting to open.
SG PORV 2A Open 11/16/2023 CR 23-10508-2 Due to a part 21 vendor notification under CR 23-10139 a plant impact form was completed. Identified vulnerabilities with potentiometers for SG PORVs 1C, 2A, 2B, and 2C.
SG PORV 2B Closed 12/02/2022 CR 22-12288 Received Plant Computer alarms:
SG 2B PORV POSIT at 2.1 percent and slowly increasing (~1 percent/
30 mins), and SG 2B PORV OPEN with no observable increases in steam flow from SG PORV 2B or effects on RCS. Dispatched operator reported SG PORV 2B indicated closed locally and could hear no audible steam flow other than slight gurgling seen at PORV tailpipe. Control room indication for PORV 2B slowly increased and showed dual. Attempted to take manual control and close, but CR indication did not respond and no changes observed in field parameters which still showed PORV closed.
Closed 08/25/2021 CR 21-8976 During performance of WAN 605160 when requested, Operations used the OIM up pushbutton to drive PORV 2C open. After holding the up pushbutton for an adequate time for a full-open stroke, the valve never moved.
Open 04/25/2024 CR 24-4183 SG PORV 2C did not respond to close pushbutton being depressed for 11 seconds during PSP05-MS-7411L. SG PORV 2C went full closed after delay.
SG PORV 2C Open 05/12/2024 CR 24-4879 SG PORV 2C was taken to manual to establish natural circulation cooling.
When the up arrow was depressed, the valve went full-open. The down arrow button worked to close SG PORV 2C.
SG PORV 2D N/A N/A N/A N/A The inspectors determined the licensees corrective actions to address the repeated failures were inadequate.
The site experienced repeat failures of the same deficiency in multiple SG PORVs without identifying nor correcting the underlying issue. For example, the site failed to adequately address a series of potentiometer failures that resulted in the inoperability of the SG PORVs.
These potentiometer failures were previously the subject of a 10 CFR Part 21 report. The site failed to recognize the repeat potentiometer failures should have resulted in a more detailed 10 CFR Part 21 notification as required by NEI 14-09, Guidelines for Implementation of 10 CFR Part 21 Reporting of Defects and Noncompliance, revision 1, which was endorsed by Regulatory Guide 1.234, Evaluating Deviations and Reporting Defects and Noncompliance Under 10 CFR Part 21, revision 0. The inspectors documented a violation in the Inspection Results section of this report related to the licensee's failure to evaluate a deviation and report a defect. Additionally, the inspectors determined the licensee failed to have a required, appropriate procedure for evaluating and reporting 10 CFR Part 21 issues.
The inspectors questioned the licensee on its ineffective corrective actions for the SG PORVs both prior and during the on-site portion of the special inspection. As a result, the site commissioned a more thorough common cause evaluation of the SG PORVs to determine more appropriate corrective actions. The inspectors identified an URI related to the licensees common cause evaluation for the SG PORV failures.
8. Review the design bases documents (USAR, calculations, etc.) and operational
procedures to determine if the licensees operational practices with respect to offsite power source alignments and automatic/manual transfer capabilities are consistent with these documents.
The inspection team reviewed the UFSAR, drawings, operational procedures, emergency procedures, and interviewed engineers to determine the sites capabilities for offsite power source alignments.
At the time of the inspection, the site did not have any automatic fast bus transfer capabilities.
During initial construction, an automatic fast bus transfer existed in the original design of the turbine generator and switchyard protection scheme. During revisions of the protection scheme, the fast bus transfer was removed. The latest revision for offsite power sources was finalized in 1986, 3 years before initial plant start-up. The site did not have any record regarding the decision to remove the automatic fast bus transfer. As part of the root cause evaluation for the failure of the lockout relay, an enhancement for adding a fast bus transfer was recommended. However, the wiring for the protection relays for the turbine generator did not align with the vendor recommendations. The vendor included a wiring diagram for blocking the operation of the backup distance relay, the relay that initiated the unit auxiliary transformer lockout during the May 12, 2024, event, when the turbine generator was offline. The site failed to recognize this vulnerability during initial construction and failed to recognize this vulnerability when reviewing external operating experience from 2007 of a similar failure.
However, the inspection team determined that licensees operational practice with respect to offsite power source alignments was consistent with the design basis.
switches, evaluate the licensees monitoring and maintenance including review of system health reports, maintenance history, and corrective action program effectiveness for possible trends and overall timeliness of evaluating associated failures and deficiencies.
The inspection team reviewed condition reports and causal analyses related to safety-related breakers, load sequencers, and control room hand switches in both units. Additionally, the inspection team reviewed the most recent work orders related to post maintenance testing and surveillance testing of the systems, structures, and components. The inspectors interviewed licensee personnel responsible for oversight of the sites maintenance rule program.
The inspectors identified inadequacies in the preventive maintenance strategy for the control room hand switches; furthermore, the inspection team uncovered weaknesses within the corrective action program to adequately capture and assess trends. The MPIC was the responsible organization onsite for reviewing and classifying condition reports. During discussions with the MPIC members, the members informed the inspection team the assigned system engineer had responsibility for trending of condition reports, deficiencies, and failures.
However, the assigned system engineer informed the inspection team the MPIC had responsibility to review the trends submitted to them. The inspection team was unable to determine the ultimate division of responsibility and provided this observation to the licensee.
The NRC previously issued a Green non-cited violation for a control room hand switch failure in 2021, described in NRC Inspection Report 05000498/2021004 and 05000499/2021004, dated January 30, 2022. The site also experienced a control room hand switch failure on February 29, 2024. Each of these previous events presented opportunities for the site to develop a corrective action to address control room hand switch issues that could have potentially prevented the May 12, 2024, failure. Additionally, condition reports for these failures contained corrective actions to develop a preventive maintenance strategy. On May 12, 2024, the licensee still did not have a preventive maintenance strategy implemented for control room hand switches.
The inspectors documented an apparent violation in the inspection results section of this report related to the licensee's failure to have adequate preventive maintenance procedures for the control room hand switch that failed during the May 12, 2024, event.
10. Review the licensees implementation of the Emergency Plan during the July 24, 2024, event and related implementing procedures, including both equipment and staff performance.
The inspection team reviewed condition reports, timelines, various licensee logs, security procedures, emergency planning procedures, and licensee analyses related to the failure of shunt reactor 2 in the switchyard, the resulting fire and the declaration of an NOUE on July 24, 2024. In addition, the inspectors performed a switchyard walkdown, reviewed drawings of the switchyard and the impacted components, and interviewed licensee personnel responsible for implementation and oversight of the emergency preparedness program.
The inspectors interviewed members of the security forces and emergency preparedness personnel on duty at the time of the incident as well as reviewed the EALs and recent changes to security and emergency plan procedures.
The inspectors also reviewed the training and response procedures for both security and emergency preparedness. The inspectors identified a potential vulnerability in the definitions regarding security and emergency events. Specifically, there was common terminology in both processes that appeared to have different definitions, which could create confusion during an event. The inspection team relayed this observation to the licensee.
The inspectors identified multiple violations of the emergency plan procedures, as well as needed enhancements to security and emergency plan procedures. The violations are documented in the inspection results section of this report.
11. Gather information available at the time of the onsite inspection related to probable causes of the July 24, 2024, initiating event and subsequent switchyard equipment performance to support determination of whether the initiating event was foreseeable and preventable by the licensee. Examples may include site electrical grounding system capability, weather conditions, breaker performance, or other switchyard layout or component issues.
The inspectors performed a site walkdown, reviewed drawings of the switchyard and its affected components, reviewed the licensee memorandum of understanding with the switchyard owner, and interviewed licensee personnel responsible for switchyard oversight.
The switchyard owner, CenterPoint, contracted a third party to perform a review of the event and to determine a cause for the fire in the shunt reactor and an associated current transformer which resulted in the loss of offsite power for STP, Unit 1.
At the time of the arrival of the special inspection team, the licensee did not have sufficient information for the team to perform a full review of the cause of the July 24, 2024, event due to the ongoing third-party review.
The inspectors identified an URI related to the licensees review and evaluation of the third-party report. The URI is documented in the inspection results section of this report.
12. Collect data necessary to support completion of the significance determination process, if applicable.
The inspectors identified and documented multiple violations in the inspection results section of this report. The violations were related to a lockout relay failure, a hand switch failure, a failure to identify a significant condition adverse to quality, a failure to adopt an appropriate 10 CFR Part 21 procedure as well as a failure to evaluate and report a 10 CFR Part 21 defect, an inadequate emergency declaration, a failure to notify state and local authorities within the prescribed time, and a failure to notify the NRC within the prescribed time. Additionally, the team documented two unresolved items related to potential common cause failures of the SG PORVs and the cause of the July 24, 2024, event.
Some of the violations involved performance deficiencies that required evaluation using the significance determination process. A Region IV senior reactor analyst assisted the team with these evaluations, which included the senior reactor analyst visiting the site to complete a detailed risk evaluation for one of the findings, which has been characterized as a Preliminary White apparent violation. The results of the significance determination process for each violation and apparent violation, or application of the traditional enforcement process, are documented in the inspection results section of this report.
INSPECTION RESULTS
Failure to Establish Adequate Preventive Maintenance Instructions Leading to Multiple Component Failures Cornerstone Significance Cross-Cutting Aspect Report Section Initiating Events Preliminary White AV 05000499/2024050-03 Open EA-24-117
[P.5] - Operating Experience 93812 The inspectors identified a finding of preliminary low to moderate safety significance (White) and associated violation of 10 CFR 50.65(a)(2). Specifically, the licensee failed to establish adequate preventive maintenance instructions for a generator protective relay and a safety-related control room hand switch. This resulted in a partial loss of offsite power, an unplanned reactor trip, and subsequent loss of a safety-related motor control center during recovery activities on May 12, 2024.
Description:
On May 12, 2024, while the unit was offline and the reactor was at 15 percent power, STP Unit 2 experienced a partial LOOP due to a lockout condition of the UAT, resulting in an automatic reactor trip and actuation of standby diesel generators 21 and 23. All three ESF busses were energized. During the event, the power supply breaker for load center E2A1 failed to close automatically or manually, and this resulted in unavailability of several safety-related loads.
Lockout Relay Discussion
The cause of the reactor trip was the loss of forced cooling flow due to loss of power to the RCPs when the UAT experienced the lockout. The UAT lockout occurred following actuation of the main generator backup distance 21/G1 relay (a KD-11 relay). The relay actuated because its contacts were out of adjustment and the relay experienced two vibrations causing the moving contact to drift to the left and close the contact.
Upon actuation of the 21/G1 relay, the time delay 62/G1 relay was triggered.
Following a one second delay, the main generator lockout relay 86/G1 was triggered as well as the main transformer lockout relay 86/SY. The 345kV switchyard breakers Y590 and Y600 tripped upon receiving the signal from the 86/SY relay. This secured power to the reactor coolant pumps.
South Texas Projects calibration procedure for the 21/G1 relay, 0PMP05-ZE-0045, Calibration of KD-10 and KD-11 Relays, revision 16, did not include instructions for adjusting the 21/G1 relay contacts in accordance with the vendor technical document, VTD-B455-0076, Type KD-10 and KD-11 Compensator Distance Relay, revision G. For the KD-11 relay, section 14.6.2 of the vendor technical document provided specific guidance for proper adjustment of the relay. Furthermore, the NRC identified other instructions not included in the calibration procedure. Specifically, section 14.7 of the vendor technical document provided guidance for the setting the spring restraint of the relay contact.
Additionally, the protection scheme for the 21/G1 relay was not fully updated during original construction to prevent an inadvertent initiation of the time delay relay and subsequent lockout relays when the main generator was offline, and the main generator circuit breaker was open. The vendor technical document offered a wiring recommendation for use in a generator backup protection relay scheme using an auxiliary contact 52a from the output breaker to disable the 21/G1 relay when the main generator was offline, and the output breaker was open. However, this vendor recommended design was not implemented during the design phase of the main generator backup protection scheme.
Hand switch Discussion
Following a loss of offsite power and prior to startup of the standby diesel generators, the unit automatically sheds loads. After the standby diesel generators reach rated speed and are ready to assume load, the load sequencer sequentially sends close signals to breakers which power essential loads. During the event, the load sequencers close signal to the E2A1 breaker failed to close the breaker due to a high resistance condition in the Unit 2 control room hand switch (HS-0001) for the E2A1 breaker.
Following the unsuccessful automatic closing of the E2A1 breaker, a control room operator attempted to manually close the breaker by taking hand switch HS-0001 to close. This attempt was unsuccessful in closing the breaker. The control room operator then took the switch to pull-to-lock and electrical maintenance personnel responded to the breaker switchgear location. Electrical maintenance personnel found no breaker flags present at the switchgear.
The control room operator then took the hand switch out of pull-to-lock and placed it in the normal position and breaker E2A1 then closed. The time from unsuccessful automatic closure of breaker E2A1 to closure following the hand switch being taken out of pull-to-lock was 26 minutes.
Load center breaker E2A1 powers both MCC E2A1 and E2A3. Due to the hand switch failure, none of the loads from these MCCs were available. This included the following essential loads:
- motor-operated valves associated with RHR pumps 2A and 2C;
- essential cooling water train 2A;
- safety Injection valves including low head safety injection and HHSI;
- fans and pumps associated with the A train of control room HVAC;
- train 2A diesel generator emergency (EDG No. 21) supply fan 21A;
- AFW containment isolation valve to steam generator 2A;
- and with EDG 21 unable to perform its design functions, the capability of SG PORV 2D to perform its design functions reliably was also lost.
Hand switch HS-0001 was a GE SBM type hand switch, and at the time of this inspection, it had no preventive maintenance strategy and was scoped into the maintenance rule function PL 480 Vac 1E Load Centers. At the time of the inspection, this function had been in (a)(2) status since January 26, 2022. The hand switch was also original plant equipment but was replaced following its failure on May 12, 2024.
Vendor technical document 0PGP04-ZA-0108, Control and Transfer Switch, Type SBM, revision E, recommended as part of the maintenance for the hand switch, in part: at a regular interval, to inspect for wear and burning by using the inspection hole built into the hand switch. The vendor technical document directed maintenance personnel to clean with a burnishing tool if there was buildup. The hand switch was cycled during load center breaker overhauls, an activity which was last accomplished on October 20, 2022. The last surveillance of the load center breaker was on April 24, 2024, which would constitute the last manipulation of hand switch HS-0001.
Previously, the NRC issued a Green non-cited violation of 10CFR50.65(a)(2) on January 30, 2022, for failing to create adequate preventive maintenance actions to inspect the auxiliary contacts in the control room hand switch for the HHSI pump 2B that automatically starts the associated room cooler fans. The HHSI pump 2B hand switch was also a GE SBM type hand switch and was subject to the same vendor technical document as the load center E2A1 hand switch.
The degraded conditions described above for the 21/G1 relay and the GE SBM type hand switch resulted from the same proximate cause: the failure to incorporate relevant vendor recommendations into the preventive maintenance program.
Applicable excerpts from South Texas Project Procedure 0PGP03-ZM-0002, Preventive Maintenance Program, revision 43, include the following:
Step 4.1.2 states: manufacturers recommendations, and equipment performance experience SHALL be reviewed to identify activities to be included into the program.
Step 4.1.6 states: the scope/intent and frequency of PMs should be established to optimize reliability. Step 4.1.11 states, in part: justification for deviating from vendor recommendations and EPRI PM Templates Database shall be documented in the PMMI. Step 4.2.2 states: PM work instructions SHALL be developed or revised as necessary to describe the maintenance activity in sufficient detail so that the PM is performed properly and, as a minimum accomplishes the intent of the PM.
The inspectors determined the failures of the 21/G1 relay and the hand switch were both foreseeable and preventable, and should have been corrected and were caused from the same failure to do so. This issue resulted in a violation of the Maintenance Rule for the hand switch. However, because the 21/G1 relay was not safety related and did not similarly result in a Maintenance Rule violation, it constituted an ROP finding rather than a violation of NRC requirements and is not discussed in the Enforcement section of this inspection result.
Corrective Actions: The licensee entered the conditions into their corrective action program and have begun implementing corrective actions for the failures. The licensee performed a root cause evaluation for the relay failure and sent the relay to an independent lab for analysis. The licensee replaced the failed hand switch and began evaluating further corrective actions for other hand switches as part of an extent of condition evaluation.
Corrective Action References: Condition reports 2024-4882, 2024-4884, and 2024-8892
Performance Assessment:
Performance Deficiency: The inspectors determined the failure to establish adequate preventive maintenance instructions pertaining to the calibration of protective relays and the maintenance of hand switch auxiliary contacts, was a performance deficiency that was within the licensees ability to foresee and correct. Specifically, the licensee failed to incorporate relevant vendor recommendations in the preventive maintenance program as required by Procedure 0PGP03-ZM-0002, Preventive Maintenance Program, revision 43. This led to an inadvertent actuation of a protective relay, subsequent reactor trip with partial loss-of-offsite power, and failure of a safety-related load center breaker to close when called upon by the load sequencer.
Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Procedure Quality attribute of the Initiating Events cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the failure to incorporate vendor calibration guidance into the relays calibration procedure led to an inadvertent actuation of the relay and subsequent reactor trip.
Significance: The inspectors assessed the significance of the finding using Manual Chapter 0609, appendix A, The Significance Determination Process (SDP) for Findings At-Power. Using Exhibit 1 - Initiating Events Screening Questions, the inspectors determined that the finding caused a reactor trip and the loss of mitigating equipment (offsite power to two safety buses and the Load Center E2A1 supply breaker). As a result, a Detailed Risk Evaluation was required.
Conclusion: The incremental conditional core damage probability (CCDP) resulting from the failure to establish adequate instructions pertaining to the calibration of protective relays and the preventive maintenance of hand switch auxiliary contacts which led to a reactor trip with a loss of the main condenser and a coincident breaker failure, was estimated to be 1.9E-6, or of low to moderate safety significance (White).
Influential Assumptions:
1. The reactor tripped and the unit auxiliary transformer locked out because the
performance deficiency allowed for the improperly calibrated 21/G1 relay to be installed in a manner which allowed typical minor physical perturbances to its cabinet to actuate it. This actuation of the 21/G1 relay from these minor physical perturbances could have occurred at any time in the operating cycle.
2. The lockout of the unit auxiliary transformer was not recoverable.
3. The breaker feeding 480-volt load center E1A1 failed to reclose because of
the performance deficiency for inadequate maintenance to ensure the hand switch allowed for proper breaker operation.
4. The breaker feeding the 480-volt load center E1A1 was able to be recovered
by the licensee in enough time for the loads on the load center to perform their event mitigation functions.
Model Modifications: The analyst used a model based on South Texas Project SPAR model, version 8.80, run on SAPHIRE, version 8.2.11, that was modified by Idaho National Laboratory to include the following changes: (Note: The references in this section refer to Unit a since the SPAR model uses Unit 1 labeling and the South Texas Project SPAR model is used for both Units 1 and 2.)
- Offsite power alignment. At the time of the event, safety buses E1A and E1C were supplied by the unit auxiliary transformer. The analyst added basic event ACP-TFM-FC-UT001A, Failure of Unit Aux Transformer UT002A, and removed basic event ACP-TFM-FC-ST001A, Failure of Standby Transformer ST001A, under fault trees ACP-STB1F-E1A and ACP-STB1H-E1C, to reflect this alignment. Also, basic event ACP-TFM-FC-ET001A was added to credit use of the stations emergency transformer to power an ESF bus. The emergency transformer was ANDed with house event HE-SBO as the licensee only credits use of the emergency transformer during station blackout events.
- FLEX modeling. Because South Texas has developed Diverse and Flexible Coping (FLEX) Strategies, the analyst incorporated use of these FLEX strategies into the model. The analyst changed the basic event FLX-XHE-XM-ELAP, Operators Fail to Declare ELAP when Beneficial, from a failure probability of 1.0 to 1.0E-2 to reflect nominal probabilistic success for the decision to employ these strategies. For the FLEX equipment failures, the analyst noted that the South Texas SPAR model used failure data for the FLEX equipment that was typical of installed permanent equipment at the plant. The analyst changed the failure rates to those from the PWR Owners Group data. Finally, because South Texas has their FLEX diesel generators permanently installed and readily deployable, the analyst changed the failure rate for basic event for FLX-XHE-XM-4802 from TRUE to 5.0E-2.
- Feed-and-bleed success criteria. The success criteria for the feed-and-bleed strategy were adjusted to only requiring one of the two primary power-operated relief valves (PORVs) to successfully implement the strategy. This change in success criteria was made after the NRC Office of Nuclear Regulatory Research reviewed thermal-hydraulic analyses for the South Texas Project plants and considered those analyses consistent with those made in NUREG2187, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Risk Models - Byron Unit 1, which were used to adjust SPAR model success criteria. The analyst complemented pertinent basic events in fault tree FAB to do this.
The RCS pressure relief success criteria were adjusted to requiring 2 primary PORV or primary safety valve failures vice zero failures to fail the ATWS pressure relief strategy. Analysts noted that this change in success criteria to the current revision of the SPAR model was needed after reviewing plant-specific calculations detailing the pressure relief valve capabilities for the South Texas Project units during ATWS events. This change appropriately eliminated conservatisms in the estimate of the conditional core damage probability by reducing the overestimation of the probabilities from core damage sequences containing ATWS events. The analyst complemented pertinent basic events in fault tree RCSPRESS to do this.
- Load center breaker failure and recovery. The analyst created new basic event ACP-CRB-OO-LCE1A1, Feeder Breaker for Load Center E1A1 Fails to Close after Load Shed, to fault tree ACP-LCCE1A1, to account for the observed failure of the breaker during the event. Similar failures for the similar five other buses were made. A common cause component group for all six similar buses was also made. This basic event was ANDed with a new basic event ACP-XHE-XM-E1A1RECOVERY, Operators Fail to Close Feeder Breaker to Load Center Bus E1A1, to allow for recovery from the failure of the breaker to close. Inclusion of this recovery basic event recognized a range of possibilities of operators being able to reclose the breaker, including the actual time it took during the event. The basic event was quantified with a value of 2.2E-2 and was created by using nominal ratings for all performance shaping factors except for stress for which high stress was credited for both diagnosis and action. Also, these events were ANDed with house HE-LOOP to ensure the failure was only present for loss of power events to the load center.
- Crediting steam dumps and steam generator safety valves. The base SPAR model only credited the steam generator power operated relief valves for steaming of the steam generators to reject heat after postulated events. The model was enhanced to recognize that the steam dump system would be available for events where the condenser remained available and to recognize that the steam generator safety valves would be available as an alternate heat rejection path.
- Alternate room cooling. The licensee informed the analyst that upon their loss of normal cooling, alternate room cooling for electrical equipment rooms would not be available during loss of offsite power events. The model was updated to disallow room cooling during loss of offsite power events by ANDing the loss of normal room cooling with operator action to establish alternate room cooling and house events which flag for losses of offsite power.
Internal Events: In the Event and Condition Assessment module of SAPHIRE for the modified model, the analyst ran an initiating events analysis for a loss of condenser heat sink because the main condenser was rendered unavailable as a path to remove decay heat. This event resulted in the bulk of the reactor decay heat going to the environment through the steam generator power operated relief valves rather than the normal heat sink (main condenser through the turbine bypass valves).
Per the guidance in Section 8.0, Initiating Events Analysis, of the Risk Assessment of Operational Events (RASP) Handbook for initiating events analysis, the risk from the performance deficiency should consider the increase in the frequency of the loss of condenser heat sink events. The nominal frequency for loss of condenser heat sink events in the NRC SPAR model is approximately one event occurring every 40 years.
This performance deficiency was associated with losing the condenser as a heat sink which RASP guidance dictates setting the initiating event frequency for a loss of condenser heat sink to 1.0 and setting all other initiating event frequencies to zero.
Additionally, the analyst set basic events ACP-TFM-FC-UT001A, Failure of the Unit Aux Transformer UT001A, and ACP-CRB-OO-LCE1A1, Feeder Breaker 1A12 from Bus E1A Fails to Close, to TRUE to represent the unit auxiliary transformer lockout and load center E1A1 breaker failures, respectively. The inputs resulted in an estimate on the CCDP from internal events from the performance deficiency of 1.95E-6.
The analyst then subtracted out the core damage probability, obtained from applying the nominal transformer fire initiating event frequency of 2.53E-2/year to nominal failure probabilities, which yielded an incremental CCDP of 1.9E-6.
The results of this initiating events analysis contained numerous potential core damage sequences at this higher frequency caused by the occurrence of the event along with the various probabilistic failures of the remaining mitigating equipment, potentially increasing workload and challenges to the operational staff. The dominant sequence which accounted for approximately 75 percent of the CCDP estimate was a loss of the condenser heat sink events in which all auxiliary feedwater capability was lost along with the ability to perform reactor coolant system feed-and-bleed operations.
External Events: The probability of an external event concurrent with the performance deficiency is extremely low and therefore the CCDP from such events would be negligible and the CCDP from internal events would be the best representation of the risk of this event.
Conditional Large Early Release Probability (CLERP): The analyst evaluated the CLERP using Inspection Manual Chapter 0609, appendix H, Containment Integrity Significance Determination Process. The top core damage sequences screened out as being risk-significant using Table 6.1, Phase 1 Screening - Type A Findings at Full Power. From this, the analyst considered that the significance was best estimated by using the CCDP of the issue.
Licensee Results: The licensee estimated the CCDP for this finding with their model to be 5.58E-7. The licensee was able to run this case as a partial loss of offsite power in their model. Despite the different initiators used with the SPAR and licensee models, the analyst and licensee PRA engineers found that most of the risk was coming from the same top core damage sequence.
The analyst worked with licensee PRA personnel to conclude that the disparity between the results produced by the SPAR model and the licensees model was mainly attributable to two sources. The first source of disparity was the failure data used in the models. The SPAR model uses industry average data from the nations nuclear power plants analyzed and prepared by the Idaho National Laboratory. The licensee uses a combination of the industry data updated with their plant-specific data. The second source of disparity in the results was from the contribution of ATWS events to the results. The licensee results did not include ATWS sequences, because in part the licensee model credits recovery of offsite power as successfully mitigating ATWS events. The SPAR results included contribution from ATWS events, which is consistent with the NRCs risk assessment methodology described in the RASP Handbook.
Sensitivities: The analyst estimated the CCDP for changes to key assumptions made in the evaluation.
- Just unit auxiliary transformer failure: The analyst ran the event as just a lockout of the unit auxiliary transformer and did not include the load center breaker failure and obtained an estimate of CCDP of 1.93E-6.
- Varied breaker recovery rates: The analyst ran cases to test the importance of the failure rate of recovering load center E1A1 by closing the failed breaker.
Failure Probability Success Probability CCDP 1.1E-3 99.9%
1.94E-6 2.2E-2 (NRC value)97.8%
1.95E-6 2.5E-2 (licensee value)97.5%
1.96E-6 1.0E-1 90%
1.98E-6 No credited recovery (TRUE)0%
2.30E-6
- Review of ATWS difference in the licensee and SPAR models: Since the licensee model did not reflect ATWS events for their initiator, the analyst estimated changes in both models with respect to ATWS event contributions.
o Exclusion of ATWS sequences from SPAR model: The analyst removed the contribution of ATWS events to the CCP and obtained an estimate of CCDP of 1.74E-6.
o Inclusion of SPAR ATWS events to licensee CCDP estimate: The analyst added the ATWS contribution to the licensees results to obtain an estimate of CCDP of 7.59E-7.
- Review of differences in key failure probabilities used in the licensee and SPAR models: Upon review of the models, licensee PRA personnel and the analyst noted differences in failure data between their respective models. The analyst adjusted several events individually and collectively to appreciate their contribution to the differences in the models.
o Use of the licensee value for tank failures: The failure rate for tanks in the SPAR model includes all tanks and not just condensate tanks.
Licensee personnel expressed that use of this failure rate overestimates the value for what was applicable to condensate tank failures. The analyst substituted the licensees condensate tank failure value into the SPAR model to obtain an estimate of CCDP of 1.71E-6.
o Exclusion of pump volute failures: Unlike the SPAR model, the licensee model did not have the common cause failure event for auxiliary feedwater pump volutes. The analyst removed this input from the SPAR model results to obtain an estimate of CCDP of 1.78E-6.
o Use of licensee failure probability for operators failing to initiate feed-and-bleed: The licensee developed a new estimate for the human error probability for feed-and-bleed applicable to the event with a value of 5.52E-3. The analyst used this value in the SPAR model to obtain an estimate of CCDP of 1.68E-6.
o Use of license failure rate for the turbine driven auxiliary feedwater pump: The licensee noted that the failure rate for the basic event for the turbine driven auxiliary failing to run in the SPAR model was approximately twice as large as the value in their model. The analyst ran the sensitivity which yielded an estimate of CCDP of 1.50E-6.
o Use of licensee emergency diesel generator failure data: The licensee stated that they use site-specific data for failures of the emergency diesel generators in their model and not industry data. The analyst ran use the licensee failure data in the SPAR model to obtain an estimate of CCDP of 1.24E-6.
o Use of key and influential licensee model failure data: The analyst picked the basic events from the top SPAR core damage sequences and substituted licensee failure data, and then subtracted out ATWS events. This sensitivity was done to compare the results of the licensee and SPAR models with similar data inputs. This sensitivity yielded an estimate of CCDP of 4.75E-7.
Uncertainties: The analyst performed an uncertainties analysis using the Monte Carlo method with 5000 runs on the internal events estimate in SAPHIRE. The distribution of results was tight around the point estimate with most of the results in the range of 1.0E-6 to 1.0E-5. The median CCDP estimate of the uncertainties was 1.69E-6, representing that more than half of the results were greater than 1.0E-6 (White).
Cross-Cutting Aspect: P.5 - Operating Experience: The organization systematically and effectively collects, evaluates, and implements relevant internal and external operating experience in a timely manner. Specifically, the licensee did not utilize internal operating experience from a 2022 GE SGM hand switch failure in the control room to evaluate for vulnerabilities of other similar control room hand switches, the site did not review external operating experience from a 2007 event which would have revealed a vulnerability in the relay wiring configuration, and the site did not properly utilize the vendor manual recommendations as a source of external operating experience which would have demonstrated the correct way to perform preventive maintenance on the components.
Enforcement:
Violation: Title 10 CFR 50.65(a)(1), requires, in part, that the holders of an operating license shall monitor the performance or condition of SSCs within the scope of the rule, against licensee-established goals, in a manner sufficient to provide reasonable assurance that such SSCs, as defined by 10 CFR 50.65(b), are capable of fulfilling their intended functions.
Title 10 CFR 50.65(a)(2) states, in part, that monitoring as specified in 10 CFR 50.65(a)(1) is not required where it has been demonstrated that the performance or condition of an SSC is being effectively controlled through the performance of appropriate preventive maintenance, such that the SSC remains capable of performing its intended function.
Contrary to the above, as of May 12, 2024, the licensee failed to demonstrate that the performance of an SSC, load center E2A1 breaker, had been effectively controlled through the performance of appropriate preventive maintenance such that the SSC remained capable of performing its intended function. Specifically, the licensee failed to implement adequate preventive maintenance procedures such that the load center E2A1 hand switch HS-0001 remained capable of performing its intended function by not preventing a close signal from reaching the breaker.
Enforcement Action: This violation is being treated as an apparent violation pending a final significance (enforcement) determination.
Failure to Identify a Significant Condition Adverse to Quality Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems
Green NCV 05000499/2024050-01 Open/Closed
[P.1] -
Identification 93812 The inspectors identified a Green finding and associated non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures and Drawings, for the licensees failure to follow procedures for identifying a significant condition adverse to quality. Specifically, the Condition Report Screening Committee screened condition report 2024-4882 as a condition adverse to quality, despite the fact that site procedure CAP-0003, Condition Report Screening, revision 6, required the condition report to be screened as significant. This error resulted in the failure to identify the failure mode associated with a safety-related control room hand switch such that corrective actions would prevent recurrence.
Description:
On May 12, 2024, South Texas Project, Unit 2 experienced a partial loss of offsite power. This resulted in a loss of ESF buses A and C. The standby diesel generators 21 and 23, associated with these buses automatically started and, when the diesel generators came to rated speed and were ready to assume load, the load sequencers began to close the breakers for the diesel generators loads in the appropriate order. However, the load center E2A1 breaker failed to close automatically and when attempted to be operated manually, due to a failed control room hand switch.
When load center E2A1 breaker failed to close, power for the hydraulic pump motor for SG PORV 2A was lost. Load center E2A1 powers train 2A diesel generator emergency supply fan 21A which is required auxiliary equipment needed to provide adequate forced ventilation cooling flow for standby diesel generator 21 to operate over its mission time. With standby diesel generator 21 unable to perform its design functions, the capability of SG PORV 2D to perform its design functions reliably was also lost. The reliability of the SG PORV to meet its design functions during the mission time could not be ensured due to the limited capability of standby diesel generator 21 to perform its functions without forced ventilation.
The failure of the hand switch was submitted as condition report 2024-4882. Per license Procedure CAP-003, Condition Report Screening, revision 6, the CRSC is responsible for screening condition reports to validate the correct significance level.
On May 13, 2024, the CRSC screened CR 2024-4882 as a condition adverse to quality and assigned a PEPC review, a level of review that was normally associated with condition reports of low consequence.
The single failure of the hand switch impacted the ability of two separate safety-related trains to perform their safety function. Per licensee Procedure CAP-003, Condition Report Screening, revision 6, a SCAQ was defined as: a Condition Adverse to Quality, which if left uncorrected, could have a serious effect on safety or operability.
Examples of SCAQs from this procedure included:
the failure of one train of a safety-related system and the extent-of-condition investigation indicates a high degree of certainty that another train is similarly impacted, such as a common mode failure;
system failures resulting in the total loss of a safety-related function described in a Current Licensing Basis.
Site Procedure CAP-003 further stated, in part, that root cause investigations were performed for SCAQs and the resulting actions of the root cause were intended to preclude repetition of the identified problem or to mitigate consequences to an acceptable level.
The inspection team interviewed MPIC members who review condition reports and are composed of line management from operations, maintenance, performance improvement, engineering, regulatory affairs, and training. MPIC informed the inspectors that SCAQs could not be downgraded to a lower-level causal evaluation and a root cause evaluation was required for all SCAQs.
The inspectors determined the failure to follow site procedures for condition report screening led to the site failing to identify a significant condition adverse quality and developing the appropriate corrective actions to prevent recurrence for the May 12, 2024, hand switch failure.
Corrective Actions: The licensee entered the issue into the corrective action program and initiated a new causal evaluation for the hand switch failure on May 12, 2024.
Corrective Action References: Condition report 2024-8892
Performance Assessment:
Performance Deficiency: The licensee's failure to appropriately screen a significant condition adverse to quality was a performance deficiency. Specifically, the failure of the control room hand switch led to the loss of multiple safety-related trains. Per site procedures, this required the licensee to classify the failure as a significant condition adverse to quality and it should have been screened as such.
Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the site failed to develop corrective actions to prevent recurrence as prescribed by site procedures, which left reasonable doubt that additional control room hand switches would not experience similar failures as the control room hand switch failure on May 12, 2024.
Significance: The inspectors assessed the significance of the finding using IMC 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power.
The finding was determined to be of very low safety significance (Green) because it:
- (1) did not represent a deficiency affecting the design or qualification of a mitigating SSC;
- (2) did not represent a loss of the PRA function of a single train TS system;
- (3) did not represent an actual loss of the PRA function of one train of a multi-train TS system for more than its TS allowed outage time OR;
- (4) two separate safety systems for more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />;
- (5) did not represent a loss of a PRA system and/or function as defined in the PRIB or the licensees PRA for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />; and
- (6) did not represent a loss of a PRA function of one or more non-TS trains of equipment designated as risk-significant in accordance with the licensees maintenance rule program for greater than 3 days.
Cross-Cutting Aspect: P.1 - Identification: The organization implements a corrective action program with a low threshold for identifying issues. Individuals identify issues completely, accurately, and in a timely manner in accordance with the program. The cause of this finding is related to the problem identification and resolution cross-cutting component of identification, in that licensee failed to properly classify and evaluate a significant condition adverse to quality.
Enforcement:
Violation: Violation: Title 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Site Procedure CAP-003, Condition Report Screening, revision 6, a quality-related procedure, prescribes how to properly screen condition reports and assign the appropriate causal evaluation.
CAP-003 defines a SCAQ as: a Condition Adverse to Quality, which if left uncorrected, could have a serious effect on safety or operability. Examples of SCAQs from this procedure include:
the failure of one train of a safety-related system and the extent-of-condition investigation indicates a high degree of certainty that another train is similarly impacted, such as a common mode failure;
system failures resulting in the total loss of a safety-related function described in a Current Licensing Basis.
CAP-003, addendum 2, Cause Analysis Determination Guideline, specifies that root cause analyses are assigned for significant conditions adverse to quality.
Contrary to the above, from May 13 to September 12, 2024, the licensee failed to accomplish the site Procedure CAP-003 requirements to classify a condition adverse to quality, which if left uncorrected, could have a serious effect on safety or operability, as an SCAQ and failed to perform a root cause analysis. Specifically, the licensee failed to identify an SCAQ associated with a control room hand switch failure that, if left uncorrected, would have resulted in the loss of two separate safety-related trains of SG PORVs. As a result, a root cause analysis was not assigned or performed for the condition.
Enforcement Action: This violation is being treated as a non-cited violation, consistent with section 2.3.2 of the Enforcement Policy.
Failure to Adopt Appropriate 10 CFR Part 21 (Part 21) Procedures and Report Deviation of a Basic Component Cornerstone Severity Cross-Cutting Aspect Report Section Not Applicable Severity Level IV NCV 05000498,05000499/2024050-05 Open/Closed EA-24-121 Not Applicable 93812 The inspectors identified a Severity Level IV violation of 10 CFR 21.21(a)(1) for the licensee's failure to adopt appropriate Part 21 procedures and failure to properly evaluate the reportability of a deviation in a basic component. As a result, the licensee failed to report a deviation identified on May 12, 2024, that was associated with a reportable defect that could have created a substantial safety hazard were it to have remained uncorrected.
Description:
On May 12, 2024, during recovery efforts following a partial loss of offsite power for South Texas Project Unit 2, SG PORV 2C failed to modulate in either automatic or manual modes of operation due to a potentiometer failure. This deviation was previously evaluated by the vendor for reportability under Part 21, but the vendor concluded the deviation was not reportable because the vendor determined post-installation testing would reveal any deviations, and therefore the issue would not affect the function of the valve while in service. However, the events of May 12, 2024, revealed new information regarding this vulnerability that should have been evaluated for Part 21 reportability. Subsequent inspector review also determined the site did not have the required Part 21 procedures in place.
The main steam system consists of four trains that carry saturated steam from the steam generators to the high-pressure turbine and auxiliary equipment. Each train contains an SG PORV that provides the capability for a controlled plant cooldown with two active SGs in conjunction with the auxiliary feedwater system when the main condenser is unavailable. The SG PORVs can be operated in both automatic and manual modes. The operation of these SG PORVs is also credited in accident scenarios for pressure control and cooldown of the RCS. For example, during a small-break loss of coolant accident, the SG PORVs are required to be able to be operated in manual mode. Specifically, operator action to lower the SG PORV setpoints to 1000 psig within 45 minutes of accident initiation is credited for the purpose of providing a more rapid cooldown of the primary side by depressurizing the secondary side via the SG PORVs. Operators must take manual action to change the setpoint.
On October 27, 2023, Enertech submitted a Part 21 report to the NRC in accordance with 10 CFR 21.21(a)(2) when they determined that there was a potential defect of the potentiometer used in modulating actuators used in SG PORV operation. Their finding was that the potentiometer showed inconsistent resistance values at some stroke positions which was caused by the wiper separating from the coil of wire, and this deviation could cause signal interruptions and possibly affect functionality of the modulating actuator.
On November 2, 2023, STP documented the Part 21 notification in CR 2023-10139 with interim immediate actions to restrict stock codes to prevent use of the potentiometers. System engineering performed a plant impact evaluation as required by 0PGP03-ZX-0013A, Processing Industry Operating Experience, revision 1, and determined that SG PORVs 1C, 2A, 2B, and 2C had potentiometers that were listed in the Part 21 notification already installed.
On December 7, 2023, Enertech sent a finalized Part 21 report to the NRC documenting that their assessment was that the deviation did not pose a substantial safety hazard nor violate any technical specification safety limits. Enertech stated:
after the installation of the potentiometer, the actuator performance test will pinpoint any potentiometer-related defects. Hence, the actuators proper functionality will validate the potentiometers performance. This indicated that after installation of the Part 21-identified potentiometers, if the PORV passed the post-maintenance testing (PMT), then the deviation would not affect functionality of the SG PORV.
On May 12, 2024, during a partial loss of offsite power when SG PORV 2C was taken to manual, the valve went full-open and could not be modulated by operators. The licensee determined the cause of the failure to be a short in the potentiometer. This potentiometer was also identified in the Part 21 notification. The licensees causal product attributed the cause to the failure of the SG PORV to modulate when given a signal from the control room to be the previously known potentiometer deviation described in the Enertech Part 21 evaluation.
The inspectors determined since the potentiometer deviation affected the functionality of the SG PORV after the successful post-maintenance testing during installation of the potentiometer, this was new information that would require a more detailed evaluation since it was not addressed in the previous Enertech evaluation.
Regulatory Guide 1.234, Evaluating Deviations and Reporting Defects and Noncompliance Under 10 CFR Part 21, revision 0, endorses NEI 14-09, Guidelines for Implementation of 10 CFR Part 21 Reporting of Defects and Noncompliance, revision 1. NEI 14-09, revision 1, section 8.1 states that an entity is required to:
evaluate a specific deviation or failure to comply for a specific item by simply determining whether the deviation is consistent with one of the general deviations that were already evaluated in detail (and) perform a more detailed evaluation for those deviations that are not addressed by the evaluations already performed. Section 8.6 states: if, based upon this evaluation, it is concluded that that deviation could create a substantial safety hazard then the deviation would be reported as a defect to the NRC. NEI 14-09 defines substantial safety hazard as a loss of safety function to the extent that there is a major reduction in the degree of protection provided to public health and safety for any facility or activity licensed or otherwise approved or regulated by the NRC, other than for export, under parts 30, 40, 50, 52, 60, 61, 63, 70, 71, or 72 of this chapter.
The deviation that was discovered as part of the May 12, 2024, event was not appropriately evaluated under the original evaluation. The inspectors concluded that NEI 14-09 section 8.1 should have prompted STP to perform a more detailed evaluation for those deviation(s) that were not addressed by the evaluation(s) already performed. Since this event revealed that the defect could affect the potentiometer even after successfully passing installation testing, STP was required to perform a more thorough evaluation since the failure could be defined as a substantial safety hazard. The site was aware of the deviation prior to the event, but the event revealed new information concerning its impact on the function of the SG PORVs, thereby qualifying it as a reportable defect. Since this was a known manufacturing issue, this defect was subject to Part 21 and the licensee was required to submit a Part 21 report.
Licensee Procedure 0PGP03-ZX-0013A, Processing Industry Operating Experience, revision 1, has instructions in section 4.6 about processing 10 CFR Part 21 Notifications from outside entities, but it does not contain any guidance on submitting a Part 21 report for potential deviations identified onsite. The inspectors concluded that the lack of suitable Part 21 procedures contributed to the licensees failure to report a defect.
Corrective Actions: The licensee entered the condition into their corrective action program and initiated an evaluation of the deviation for reportability. Additionally, the licensee had previously removed the potentiometers from the active stock.
Corrective Action References: Condition report 2024-9905
Performance Assessment:
The inspectors determined this violation was associated with a minor performance deficiency under the reactor oversight process (ROP).
Specifically, the failure to make a timely Part 21 report and lack of appropriate procedure was contrary to 10 CFR Part 21.21(a) and was a performance deficiency.
This performance deficiency was minor because the inspectors answered No to all three screening questions in appendix B of IMC 0612.
Enforcement:
The ROPs significance determination process does not specifically consider the regulatory process impact in its assessment of licensee performance.
Therefore, it is necessary to address this violation which impedes the NRCs ability to regulate using traditional enforcement to adequately deter non-compliance.
Severity: The violation involved the failure to adopt appropriate procedures and report a defect associated with a substantial safety hazard for a steam generator power operated relief valve potentiometer. This violation was considered for escalated enforcement at Severity Level III in accordance with the NRC Enforcement Policy.
However, in reviewing the specific circumstances of this violation (i.e., the NRC resident staff was aware of the issue; there was little to no impact to the inspection process/regulatory process; the potentiometers were only supplied to South Texas Project and no other licensees; and your staff entered the issue into the corrective action program), the NRC determined that it is more appropriately categorized as a Severity Level IV violation.
Violation: Title 10 CFR 21.21(a)(1) requires, in part, that entities subject to the regulations in 10 CFR Part 21 shall adopt appropriate procedures to evaluate deviations and failures to comply to identify defects associated with substantial safety hazards as soon as practicable and, except as provided in 10 CFR 21.21(a)(2), in all cases within 60 days of discovery, in order to identify a reportable defect that could create a substantial safety hazard, were it to remain uncorrected.
Contrary to the above, from July 11 to November 12, 2024, the licensee failed to adopt appropriate procedures to evaluate deviations and failures to comply to identify defects associated with substantial safety hazards as soon as practicable and failed within 60 days of discovery to identify a reportable defect that could create a substantial safety hazard, were it to remain uncorrected. Specifically, the licensee failed to have a procedure to identify and notify the Commission or vendors of 10 CFR Part 21 defects. As a result, the licensee identified a potentiometer defect on SG PORV 2C caused by a manufacturing deviation that resulted in the valve being inoperable and then failed to notify the Commission within 60 days after discovery of the defect associated with a substantial safety hazard evaluation described in 10 CFR 21.21(a)(1).
Enforcement Action: This violation is being treated as a non-cited violation, consistent with section 2.3.2 of the Enforcement Policy.
Failure to Provide Timely Notification of Emergency Declaration in Accordance with the Site Emergency Plan Cornerstone Significance Cross-Cutting Aspect Report Section Emergency Preparedness
Green NCV 05000498,05000499/2024050-02 Open/Closed
[H.13] -
Consistent Process 93812 The inspectors reviewed a self-revealed Green finding and associated non-cited violation of 10 CFR 50.54(q)(2) for the licensees failure to follow their emergency plan. Specifically, the licensee failed to provide notification of an unusual event declared on July 24, 2024, to State and local governmental agencies within 15 minutes after declaration.
Description:
The inspectors reviewed actions taken to notify the State and local response organizations of an unusual event declaration during a July 24, 2024, loss of offsite power event. To assess this, the inspectors reviewed the NRC event report (event number 57237), the licensees post event evaluation report dated August 14, 2024, the licensees Emergency Action Level Technical Bases Manual (EP-0003.000, revision 0, considered part of the licensees emergency plan), and related corrective action documentation (CRs 2024-7311, 2024-7314, and 2024-7919). An Unusual Event was declared under emergency action level SU1.1 for Unit 1 at 7:18 a.m., CDT.
The state of Texas and Matagorda County were notified of the declaration by 8:07 a.m., CDT.
The inspectors reviewed STPs emergency plan to verify what the licensees commitments were regarding providing notifications associated with event declarations. STP Emergency Plan (EP-0001.000) revision 1, section E.1.b, states that initial notifications to the State and County are made within 15 minutes of Emergency Classification Level (ECL) declaration. This is consistently documented in site emergency notification procedure (0EPR01-IP-0002, revision 1, section 4.2, second bullet), and the shift managers checklist (0EPR02-CK-OPS01, revision 1, section 1.2.4).
With the 15-minute notification requirement clearly documented within site emergency plan documentation, the inspectors reviewed the circumstances in the event to gain insight into why the notifications were untimely. Based on the licensees post event evaluation report, several site management personnel questioned the decisions made by the Unit 2 shift manager (in the role of emergency director) to implement the emergency plan after the declaration was made, including the declaration determination. With the event declaration completed, the shift manager is required to carry out immediate actions in accordance with section D.3 of the emergency plan, and further detailed in the shift manager s checklist. The emergency plan, section M, allows for re-assessment of conditions leading to declarations in the recovery/re-entry process, but that comes at a time after all of the actions required in response to the emergency declaration are addressed. Managements lack of understanding of the emergency plan requirements resulted in unnecessary distraction and delays to the function of the licensee emergency response organization.
The inspectors determined that the licensee did not follow procedures for notification of State and local response organizations in that they were not implemented in a manner to meet the timeliness requirements in regulation. Therefore, the inspectors concluded that the licensee did not follow the requirements of the site emergency plan.
Corrective Actions: The licensee entered these issues into the corrective action program.
Corrective Action References: Condition reports 2024-7311, 2024-7314, 2024-7919
Performance Assessment:
Performance Deficiency: The inspectors determined that the failure to demonstrate the capability to notify state and local government agencies of an emergency declaration within 15-minutes is a performance deficiency within the licensees ability to foresee and correct.
Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the ERO performance attribute of the Emergency Preparedness cornerstone and adversely affected the cornerstone objective to ensure that the licensee is capable of implementing adequate measures to protect the health and safety of the public in the event of a radiological emergency.
The licensees ability to take adequate measures to protect the health and safety of the public is degraded when they cannot provide necessary declaration information to state and local agencies so that they can respond themselves to the event in a timely manner.
Significance: The inspectors assessed the significance of the finding using IMC 0609 Appendix B, Emergency Preparedness SDP. Using Attachment 1, dated September 22, 2015, the performance deficiency was determined to have very low safety significance (Green) because it was a failure to implement a risk-significant planning standard meeting NRC requirements during an actual event, and was associated with a declared Unusual Event.
Cross-Cutting Aspect: H.13 - Consistent Process: Individuals use a consistent, systematic approach to make decisions. Risk insights are incorporated as appropriate.
The licensee did not use a consistent, systematic process to make decisions.
Specifically, site management inhibited the proper function of emergency response processes designed to ensure that appropriate measures are taken during in event response in a reliable manner.
Enforcement:
Violation: Title 10 CFR 50.54(q)(2) requires, in part, that a power reactor licensee follow an emergency plan which meets the requirements of Appendix E to 10 CFR Part 50 and the standards of 10 CFR 50.47(b). Title 10 CFR 50.47(b)(5)requires, in part, that procedures have been established for notification, by the licensee, of State and local response organizations. Title 10 CFR Part 50, appendix E, section IV.D.3, states, in part, that a licensee shall have the capability to notify responsible State and local governmental agencies within 15 minutes after declaring an emergency.
Contrary to the above, on July 24, 2024, the licensee failed to follow an emergency plan which met the requirements of Appendix E to 10 CFR Part 50 and the standards of 10 CFR 50.47(b). Specifically, the licensee failed to have the capability to notify responsible State and local governmental agencies within 15 minutes after declaring an emergency.
Enforcement Action: This violation is being treated as a non-cited violation, consistent with section 2.3.2 of the Enforcement Policy.
Failure to Satisfy 10 CFR 50.72 Reporting Requirements for an Emergency Declaration Cornerstone Severity Cross-Cutting Aspect Report Section Not Applicable Severity Level IV NCV 05000498;05000499/2024050-04 Open/Closed Not Applicable 93812 The inspectors reviewed a self-revealed Severity Level IV non-cited violation for the licensees failure to meet NRCs reporting requirements in 10 CFR 50.72(a)(3)associated with emergency classification timeliness. Specifically, the licensee failed to provide notification of an Unusual Event classification on July 24, 2024, not later than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after making the emergency declaration.
Description:
The inspectors reviewed actions taken to notify the NRC of an unusual event declaration during a loss of offsite power event that occurred on July 24, 2024.
To assess this, the inspectors reviewed the NRC event report (Event Number 57237),the licensees post event evaluation report, dated August 14, 2024, the licensees Emergency Action Level Technical Bases Manual (EP-0003.000, revision 0, considered part of the licensees emergency plan), and related corrective action documentation (condition reports 2024-7313, 2024-7314, and 2024-7919). An unusual event was declared under emergency action level SU1.1 for Unit 1 at 7:18 a.m., CDT.
The state of Texas and Matagorda County were notified of the declaration by 8:07 a.m., CDT. The NRC Operations Center received a notification call at 8:31 a.m.
CDT.
The inspectors reviewed STPs emergency plan to verify what the licensees commitments were regarding providing notifications associated with event declarations. South Texas Project Electric Generating Station (STPEGS) Emergency Plan (EP-0001.000) revision 1, section E.1.3, states that STPEGS will notify the NRC using the Emergency Notification System (ENS) as soon as possible after notification of State and County agencies, and not later than 60 minutes after event declaration.
This is consistently documented in site emergency notification procedure (0EPR01-IP-0002, revision 1, section 4.2, fourth bullet), and the Emergency Notification System communicators checklist (0EPR02-CK-OPS02, revision 0, section 2.2.1). Furthermore, 10 CFR 50.72(a)(3) discusses the requirement to notify the NRC within one hour of the emergency declaration.
The licensee took 73 minutes after event declaration (24 minutes after notifying the applicable state and county agencies) to notify the NRC of the declaration. The inspectors concluded the delay was not justified by the circumstances. Additionally, the licensee exceeded the timeliness requirements to notify the NRC not later than 60 minutes after event declaration. Issues with emergency response organization function, detailed in a related finding in this report contributed to the delays in this notification as well.
The inspectors determined that the licensee failed to meet NRC timeliness requirements stated in 10 CFR Part 50.72 for declared event notifications. In addition, the licensee did not follow the requirements of the site emergency plan.
Corrective Actions: The licensee entered these issues into the corrective action program.
Corrective Action References: Condition Report 2024-7313
Performance Assessment:
None. The failure to meet reporting requirements is not a performance deficiency evaluated under the ROP emergency preparedness cornerstone. It is assessed using traditional enforcement.
Enforcement:
The ROPs significance determination process does not specifically consider the regulatory process impact in its assessment of licensee performance.
Therefore, it is necessary to address this violation which impedes the NRCs ability to regulate using traditional enforcement to adequately deter non-compliance.
Severity: The issue was determined to be a Severity Level IV violation using NRC Enforcement Policy, dated August 23, 2024, section 6.9.d.9 of the Enforcement Policy because it involved a licensee failure to make a report required by 10 CFR 50.72.
Violation: Title 10 CFR 50.72(a)(3) requires, in part, that the licensee shall notify the NRC immediately after notification of the appropriate State and local agencies and not later than one hour after the time the licensee declares one of the emergency classes.
Contrary to the above, on July 24, 2024, the licensee failed to notify the NRC of an Unusual Event declaration immediately after State and local agency notification, and not later than one hour after the emergency declaration.
Enforcement Action: This violation is being treated as a non-cited violation, consistent with section 2.3.2 of the Enforcement Policy.
Unresolved Item (Open)
Repeated Failures of Steam Generator Power-Operated Relief Valves URI 05000498,05000499/2024050-06 93812
Description:
South Texas Project has experienced multiple SG PORV failures over both units recent history. Many of these failures involved the failure of the SG PORV to either stroke on demand or to exhibit erratic movement. The licensee captured each of these failures in their corrective action program and dispositioned each of them using their lowest level causal evaluation: a PEPC.
On May 12, 2024, during a partial loss of offsite power for Unit 2, SG PORV 2C failed to modulate in either the automatic or manual mode of operation. Given the risk analysis from the events of the partial loss of offsite power, the NRC commissioned a special inspection team to review the event and the subsequent equipment failures that occurred, including the failure of SG PORV 2C.
By the time of the special inspection teams arrival, the site had yet to commence a common cause evaluation for the repeated failures of the SG PORVs in both units.
The charter for the special inspection team included items to review the SG PORV failures over the past 2 years, review the licensees causal products for the SG PORVs, and to gather information to support the significance determination process, if required.
Planned Closure Actions: Further NRC inspection is required to determine if a performance deficiency exits. When completed by the licensee, the NRC plans to review the licensees common cause evaluation for the repeated failures of the SG PORVs, including failures during the Unit 1 January 21, 2024, and February 29, 2024, forced outages and the Unit 2 2024 refueling outage. If a performance deficiency is identified, a more than minor assessment and review of potential NRC violations will be conducted.
Licensee Actions: On September 5, 2024, the licensee commissioned a common cause evaluation for the repeated SG PORV failures. The evaluation began on September 9, 2024. The licensee entered the condition into its corrective action program (CRs 2024-7221 and 2024-10685) and initiated actions to review the results of the evaluation when completed.
Unresolved Item (Open)
Switchyard Fire Cause and Subsequent Switchyard Component Performance URI 05000498,05000499/2024050-07 93812
Description:
On July 24, 2024, STP, Unit 1 experienced a complete loss of offsite power after due to a fire in the electrical switchyard located outside of the protected area. The fire began in a shunt reactor and caused the north and south buses to trip causing the loss of offsite power.
The NRC scoped this event into an existing special inspection which was scheduled to arrive on September 9, 2024. The revised charter included items to review the cause of the fire and subsequent switchyard equipment performance for any potential issues of concern.
The owner of the switchyard commissioned a third-party vendor to perform a cause evaluation to determine why the shunt reactor caught fire and to analyze subsequent performance of switchyard equipment, including a current transformer which did not fully function as designed. By the time the special inspection team arrived onsite for the special inspection, the third-party analysis had not yet been completed and the charter items related to the July 24, 2024, fire could not be performed.
Planned Closure Actions: The NRC plans to review the third-party causal evaluation for probable causes of the July 24, 2024, initiating event and subsequent switchyard performance to support determination of whether the initiating event was foreseeable and preventable by the licensee and whether a performance deficiency exits. If a performance deficiency is identified, a more than minor assessment and review of potential NRC violations will be conducted.
Licensee Actions: The licensee has maintained contact with the owner of the switchyard to stay informed of the progress of the third-party review. The licensee entered the condition into its corrective action program (condition report 2024-7216) and initiated actions to review the results of the evaluation when completed.
Licensee-Identified Non-Cited Violation 93812 This violation of very low safety significance was identified by the licensee and has been entered into the licensee corrective action program and is being treated as a non-cited violation, consistent with section 2.3.2 of the Enforcement Policy.
Violation: Title 10 CFR 50.54(q)(2) requires, in part, that a power reactor licensee follow an emergency plan which meets the requirements of Appendix E to 10 CFR Part 50 and the standards of 10 CFR 50.47(b). Title 10 CFR 50.47(b)(4) requires, in part, that a standard emergency action classification and action level scheme is in use by the nuclear facility licensee.
Contrary to the above, on July 24, 2024, the licensee failed to follow an emergency plan which met the requirements of Appendix E and the Standards of 10 CFR 50.47(b).
Specifically, the licensee failed to accurately classify an unusual event in accordance with the licensees emergency action level scheme. The licensee declared the emergency based on the loss of all available alternating current power to the Unit 1 safety buses for greater than 15-minutes, a condition which did not exist and was not effectively communicated within the emergency response organization. This was identified in the licensees post event report dated August 14, 2024.
Significance/Severity: Green. The inspectors assessed the significance of the finding using IMC 0609 Appendix B, Emergency Preparedness SDP. Using this, the performance deficiency was determined to have very low safety significance (Green)because it was a failure to comply with NRC requirements, was associated with a risk-significant planning standard, and was not a lost or degraded planning standard function.
Corrective Action References: Condition reports 2024-7310 and 2024-7920
EXIT MEETINGS AND DEBRIEFS
The inspectors verified no proprietary information was retained or documented in this report.
- On November 12, 2024, the inspectors presented the special inspection results to Kimberly A. Harshaw, Acting President and CEO and CNO, and other members of the licensee staff.
DOCUMENTS REVIEWED
Inspection
Procedure
Type
Designation
Description or Title
Revision
or Date
93812
Corrective
Action
Documents
CR-YYYY-NNNN
24-9905, 2024-7310, 2024-7311, 2024-7312,
24-7313, 2024-7314, 2024-7919, 2024-7920,24-692, 2024-4851, 2024-2037, 2024-5067,
21-10753, 2013-14445, 2024-2801, 2019-376,
21-8012, 2023-8823, 2023-9788, 2023-10538,
24-4882, 2024-4884, 2024-9027, 2023-10139,
21-10753, 2017-20177, 2024-8566, 2024-750,24-806, 2022-1228, 2021-2048, 2019-12557,
24-8750, 2024-8727, 2024-7221, 2023-999,
24-5067, 2024-7919, 2024-7923, 2024-7922,
24-7921, 2024-7920, 2024-4884, 2024-7314,
24-7313, 2024-7312, 2024-7311, 2024-7310,
24-6407, 2024-4478, 2024-4882, 2018-8692,
2017-18577, 2019-12401, 2019-13709, 2023-9788,
23-10352, 2022-11716, 2024-7313, 2024-7314,
24-7312, 2024-7221, 2024-7311, 2024-7310,
24-7216, 2019-376, 2024-2042, 2024-4183,
24-4154, 2024-4153, 2024-4152, 2024-4151,
24-3813, 2024-3810, 2024-3709, 2023-10994,
23-10993, 2023-10508, 2023-9670, 2023-9669,
23-8846, 2023-7860, 2023-7838, 2023-7270,
23-6890, 2023-5689, 2023-4281, 2023-4250,
23-4248, 2023-3925, 2023-3523, 2023-3272,
23-1614, 2023-1456, 2023-1455, 2022-12669,
22-11986, 2022-11826, 2022-11255,
22-11254, 2022-211092, 2022-3472, 2022-3151,
22-1325, 2021-12791, 2021-11696, 2021-11210,
21-10843, 2021-10792, 2021-10382, 2021-8976,
21-8812, 2021-8400, 2021-7784, 2021-6250,
21-4048, 2021-3407, 2021-3388, 2021-3017,
20-12405, 2020-8085, 2020-7278, 2020-7236,
20-6394, 2020-6023, 2020-5628, 2020-5622,
Inspection
Procedure
Type
Designation
Description or Title
Revision
or Date
20-5535, 2020-5533, 2020-5211, 2020-5072,
20-4322, 2020-4172, 2020-3882, 2020-2563,20-609, 2020-259, 2019-12945, 2019-12702,
2019-12581, 2019-12068, 2019-11985,
2019-11939, 2019-11352, 2019-10397
93812
Corrective
Action
Documents
Resulting from
Inspection
CR-YYYY-NNNN
24-8636, 2024-8719, 2024-8727, 2024-8750,
24-8779, 2024-8820, 2024-8840, 2024-8848,
24-8876, 2024-8892, 2024-9027
00009E0NZ02 #2,
Sheet 1
Elementary Drawing, Typ. BKR Internal Conn.
Diag., (480V, 5KV, 15K)
00009E0GM01 #2
Sheet 1
Elementary Diagram Main Generator Protection,
DC Circuits
00009E0GM02 #2
Sheet 1
Elementary Diagram Main Generator Protection,
DC Circuits
00009E0PB01 #2
Elementary Diagram Main Transformers & 345 KV
Line Protection
00009E0PL01 #2,
Sheet 1
Elementary Diagram 480V Load Center E2A
Incoming Breaker Bus E2A1 & E2A2
00009E0PLAA #2,
Sheet1
Single Line 480V Class-1E Center, E2A (EAB)
030-519-554-02
345KV South Shunt Reactor & RT20 Breaker AC &
DC Schematic
FSAR Figure 8.2.3
High Voltage Switchyard Single Line Diagram
Houston Lighting
&Power Company,
South Texas Project
Electric Generating
Station
Main Steam Power Operated Relief Valve Hydraulic
System 5S102Z51002
Paul-Munroe
Hydraulics Inc.
Hydraulic Schematic PD 89272
B
93812
Drawings
South Texas Project
Nuclear Operating
Main Steam Line PORVs Logic Diagram System
5S109Z40079 #2
Inspection
Procedure
Type
Designation
Description or Title
Revision
or Date
Company
South Texas Project Electric Generating Station,
Unit 1 Loss of Offsite Power/Unusual Event, July
24th, 2024, Evaluation Report
08/14/2024
7-24-24 Switchyard Event timeline
Shift Manager Checklist
ENS Communicator Checklist
Termination/Recovery Checklist
EAL Wall Charts
Industrial Control Relays
03/17/1980
23-PE-PL-Q3-Q4
System Health Report for 480 VAC Load Center
2/31/2023
Control room logs
OPS CR Log 5-12 to 5-13 Trip range
Control room logs
Unit 1 Control Room Logs for Switchyard Fire and
LOOP on July 24, 2024
Control room logs
Unit 2 Control Room Logs for Switchyard Fire and
LOOP on July 24, 2024
STPEGS On-Shift Staffing Analysis
South Texas Project Electric Generating Station
(STPEGS) Emergency Action Level Technical
Bases Manual
EPlan event
summary
ACTUAL 072424 UE Report
EPT001
Emergency Classification
EPT004
Emergency Direction
EPT011
SnC (State and County) Communicator
File No. 21805
ACTUAL 072424 UE Report
08/14/24
Lesson Plan
Emergency
Preparedness
Training EPT004
Emergency Direction
93812
Miscellaneous
Lesson Plan
Emergency
Preparedness
Training EPT001
Emergency Classification
Inspection
Procedure
Type
Designation
Description or Title
Revision
or Date
Lesson Plan
Emergency
Preparedness
Training EPT011
SnC (State and County) Communicator
N/A
PL System Performance Criteria
2/28/2024
N/A
HS Replacement Plan
N/A
N/A
Control Room Hand switch Review
N/A
N/A
Past 5 years of Crs by System 19-24
N/A
N/A
Engineering Email on GE SBM Hand Switches for
the Load Center Breakers EQ Qualified Life
Question
09/11/2024
PEP C for CR 24-
4879
Prompt Equipment Performance Checklist for
CR 2024-4879 for Steam Generator (SG) 2C Power
Operated Relief Valve (PORV) was declared
inoperable due to going full-open when switched to
manual operation
PEPC
STP7921b 24-4879
PL 480V AC 1E Load
Centers
Performance Criteria for System Plant Level 480V
AC 1E Load Centers
2/28/2024
PM Task Report
EPRI Preventive Maintenance Basis Database
(PMBD) PM Task Report (All Tasks)
RCE 24-4884
Root Cause Evaluation for the STP Unplanned
automatic trip of Unit 2 reactor
STPNOC-0025
Executed-STPNOC-NUC-001-Rqmts-Agmt
Amended Restated 08-31-2023
08/31/2023
Vendor Manual
MS PORV Safety Relief Vendor Document
Instructions for Installation and Maintenance
Consolidated Safety Valves Nuclear Type 3700
VTD-0568-0004
VTD-B455-0076
Vendor Technical Maul for Type KD-10 and KD-11
Compensator Distance Relay
Inspection
Procedure
Type
Designation
Description or Title
Revision
or Date
VTD-C568-0004
VTD-G080-0091
Instructions Control and Transfer Switch Type SBM
E
VTD-H108-0005
Bill of Materials and Nameplate Data for SO 5647A
07/06/1984
VTD-S156-0001
AMP-TRAP 2000
05/01/1995
VTD-W120-0250
Westinghouse Maintenance Program Manual for
Safety-Related Type DS
2
ERO Response
Emergency Notifications
Termination and Recovery
Shift Manager Checklist
Industry Events Analysis
Processing Industry Operating Experience
Trending Process Procedure
480 Volt DS Breaker Overhaul/Lubrication
Westinghouse 480 Volt Breaker Test
Calibration of KD-10 and KD-11 Relays
Calibration of TD-5/52 Timer Relays
Train A ESF Diesel Sequencer Remote Timing Test
480 Volt Load Center Breaker Functional Test and
Inspection
CAP-0003
Condition Report Screening
South Texas Project Electric Generating Station
EAL Technical Basis Manual South Texas Project
Electric Generating Station (STPEGS)
IP-1.03Q
Reporting 10CFR21 Deficiencies to the NRC
OPGP03-ZX-0002
Condition Reporting Process
OPGP03-ZX-0002B
Station Cause Analysis Program
OPSP 11-MS-0001
Main Steam Safety Valve lnservice Test
93812
Procedures
SLG-CPI1
Management Performance Improvement
Committee Activities
Inspection
Procedure
Type
Designation
Description or Title
Revision
or Date
93812
Work Orders
Work Authorization
Number
641718, 561211, 561218, 619255, 513444,
2532, 707849, 608745, 551718, 433953,
656943, 493588, 708068, 660978, 665415,
665416,665417, 427493, 62199, 521386, 594783,
637860, 656943, 619967, 641867, 658371, 65100,
2470, 632532
ATTACHMENT 1 - REVISED SPECIAL INSPECTION CHARTER FOR SOUTH TEXAS
PROJECT ELECTRIC GENERATING STATION, FOR THE UNIT 2 AUTOMATIC REACTOR TRIP ON MAY 12, 2024, AND UNIT 1 AUTOMATIC REACTOR TRIP ON
JULY 24, 2024
In a June 14, 2024, memorandum to you (Agencywide Documents Access and Management
System [ADAMS] No. ML24164A205), I designated you as the Special Inspection team
leader in response to the May 12, 2024, STP Unit 2 automatic reactor trip and partial loss of
offsite power (LOOP) and you were provided a charter for performing the inspection. On
July 24, 2024, there was an automatic reactor trip of STP Unit 1 with a LOOP. Based on the
evaluation of the July 24, 2024, event, a Special Inspection will be performed. I have
determined that your previously scheduled inspection will be increased in scope and team
membership to enable you to include the July 24, 2024, event. In addition to the team
members listed below, you will have remote support from regional and technical experts to
use at your discretion. The descriptive basis for the Special Inspection of the July 24, 2024,
event, and the revised scope of the Special Inspection is provided below. The following
members are assigned to your team:
James Drake, Senior Reactor Inspector - Division of Operating Reactor Safety
Nnaerika Okonkwo, Reactor Inspector - Division of Operating Reactor Safety
Leanne Flores, Resident Inspector - Division of Operating Reactor Safety
Beatrice Nwafor, Reactor Inspector - Division of Operating Reactor Safety (observer)
A.
Basis
The basis for the Special Inspection for the May 12, 2024, event is described in my
June 14, 2024, memorandum to you and is not repeated here.
The following discussion is the basis for decision making for performing a Special
Inspection for the July 24, 2024, event.
On July 24, 2024, at 7:02 a.m., CDT, STP, Unit 1, automatically tripped from full
power. A failure of shunt reactor 2 in the switchyard, and a resulting fire, caused a
main generator lockout, loss of power from the north and south buses, lockout of
standby transformer 1, turbine trip and reactor trip. The event resulted in a loss of
offsite power to each Unit 1 ESF bus and the AutoStart and loading of its associated
EDG. All three trains of the AFW system automatically started.
The loss of the south switchyard bus also caused a loss of standby transformer 2.
Unit 2 remained online with its output limited to Hillje circuit 64 and operators reduced
power to 90 percent as requested by the grid operator. The Unit 2, unit auxiliary
transformer remained available to provide power to Unit 2 ESF buses A and C.
However, with the loss of standby transformer 2, offsite power was lost to ESF bus B,
resulting in the AutoStart and loading of its associated EDG and the AutoStart of AFW
train
- B.
The Unit 2 shift manager declared an NOUE at 7:18 a.m.Property "Contact" (as page type) with input value "B.</br></br>The Unit 2 shift manager declared an NOUE at 7:18 a.m." contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., CDT, based on EAL SU1 for
loss of all offsite power capability to emergency buses for greater than 15 minutes, due
to conditions on Unit 1, and assumed the duties of Emergency director. Offsite fire
responders arrived at the site and extinguished the fire using aqueous foam at 9:25
a.m., CDT.
Because offsite power was unavailable to operate the Unit 1 reactor coolant pumps or
use the condenser as a heat sink, operators isolated the main steam lines and
maintained natural circulation cooling in the reactor coolant system using AFW flow to
the steam generators and the steam generator power operated relief valves (SG
PORVs) as a heat sink to the atmosphere. At 9:53 a.m., CDT, after operators placed
the SG PORV controllers in manual to keep them from cycling, they noticed that the
SG 1C PORV was closed and could not be controlled in manual, nor would it operate
when placed in automatic. The licensee declared the 1C PORV inoperable at
9:53 a.m., CDT. The MSSV acoustic monitoring system was not available to indicate
whether any MSSV had lifted. However, based on local observation and measured
steam header pressure, the licensee concluded that at least one MSSV had lifted to
reduce steam line 1C pressure.
The licensee terminated the NOUE at 11:46 a.m., CDT. The licensee determined that
offsite power remained available from the 138 kV transmission line via the emergency
transformer and this offsite source could have provided power to an ESF bus during the
event.
The south switchyard bus, and standby transformer 2, were re-energized at 12:12 p.m.,
CDT. This allowed the licensee to proceed with restoring offsite power to Unit 2 ESF
bus B and all three Unit 1 ESF buses. Unit 1 also restored offsite power to non-ESF
buses and restored operation of a reactor coolant pump at 1:46 p.m., CDT. Standby
transformer 1 remained unavailable due to damage to its feeder cables from the
At 1:50 p.m.,CDT, the licensee evaluated electrical bus alignment and ESF power
availability and concluded both the north and south buses were operable and all Unit
ESF buses were powered by the unit auxiliary transformer.
The licensee performed troubleshooting of Unit 1 PORV 1C but was unable to identify
a definitive cause of its failure. However, the licensee identified abnormal indications
that plant computer signals for valve operation were being received by the valves
servo-amplifier circuit card but were not being transmitted beyond the card to the
valve actuator. As a result, the licensee replaced the servo-amplifier and some other
suspect electrical components. Following post-maintenance testing, the licensee
declared PORV 1C operable on July 28, 2024, at 2:50 p.m., CD
- T.
Regarding the cause of the shunt reactor failureProperty "Contact" (as page type) with input value "T.</br></br>Regarding the cause of the shunt reactor failure" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., the licensee believes that the stormy
weather at the time of the event induced large voltage differentials between ground and
atmosphere. The licensee noted that during the event, several chain link fences around
the protected area and switchyard were seen sparking over a period of several seconds
prior to the shunt reactor failure. The licensee believes this phenomenon may have
been the cause of the shunt reactor failure, resulting in grounding phases of the shunt
reactor and igniting the oil-filled equipment.
On July 29, 2024, the licensee provided an update to the event notification that initially
reported the NOU
- E. The update stated, After a review of station logs, it was
determined that there was not a loss of all offsite AC power to Unit 1 An offsite
power source was available through the 138 kV transmission line. This referred to the
offsite power supply which provides power to the emergency transformer offsite
source, which has capability to provide power to one ESF bus for each unit. The NRC
staff noted that some licensee internal communications issues occurred during the
event which challenged timely and accurate classification and notifications.
Unit 1 was restarted and placed online on August 1, 2024.
Management Directive (MD) 8.3, NRC Incident Investigation Program, was used to
develop a recommendation on the level of NRC response for this event. In evaluating
the deterministic criteria of MD 8.3, the staff determined that the event met one of the
deterministic criteria. Specifically, the event involved an example of repetitive failures
involving safety-related equipment. In evaluating the risk assessment criteria of
MD 8.3, the estimated conditional core damage probability was determined to be
approximately
4.1E-5.
Based on the deterministic criteria and risk insights related to this event and the May 12,
24, event; the perceived complexity of the event; and the need for inspection staff
resources with electrical engineering expertise and emergency preparedness expertise,
Region IV management determined that the appropriate level of NRC response was to
conduct a Special Inspection. This Special Inspection is chartered to identify the
circumstances surrounding this event and review the licensees actions to address the
causes of the event.
B.
Scope
The scope of the charter from my June 14, 2024, memorandum is hereby amended to
include items specific to the July 24, 2024, event. The inspection is expected to perform
data gathering and fact-finding to address the following:
1.
During the initial debrief to management on the first day of onsite
inspection, provide a recommendation to Region IV management as to
whether the inspection should be upgraded to an augmented inspection
team.
2.
Develop a sequence of events related to the May 12, and July 24, 2024,
events and associated equipment failures. The chronology should include
the status of plant equipment and licensee actions to respond and mitigate
the conditions. The timeline should consider any licensee actions that
served as missed opportunities to identify the equipment failures before
they occurred during the event.
3.
Review the licensees causal evaluation(s) and determine if they are being
conducted at a level of detail commensurate with the significance of the issues
that were encountered during the events. Evaluate the identification of the
failure mode and the troubleshooting approach that supports the stations
confidence in determination of the direct causes. Consider the licensees
application of relevant industry operating experience.
4.
Review the licensees extent of condition evaluation(s) to determine if the
licensee has adequately considered similar vulnerabilities with other
transformer lockout relays, similar conditions that led to the load center
breakers failure to close, and similar deficiencies in other steam generator
PORVs for both units.
5.
Review completed and proposed corrective actions to determine if the
licensee has/is taking appropriate actions to address the auxiliary
transformer lockout, load center feeder breaker, steam generator PORV
conditions, and July 24, 2024, event.
6.
Determine if the steam generator PORV degraded condition observed during
the May 12, 2024, event would likely have prevented successful operation of
the valve in both automatic and manual mode.
7.
Evaluate steam generator PORV deficiencies over the last two years,
including failures during the Unit 1 January 21, and February 29, 2024,
forced outages and the Unit 2 2024 refueling outage. Determine if past
licensee corrective actions to address failures were adequate.
8.
Review the design bases documents (USAR, calculations, etc.) and operational
procedures to determine if the licensees operational practices with respect to
offsite power source alignments and automatic/manual transfer capabilities are
consistent with these documents.
9.
For a sample of safety-related breakers, the load sequencer, and control
room hand switches, evaluate the licensees monitoring and maintenance
including review of system health reports, maintenance history, and
corrective action program effectiveness for possible trends and overall
timeliness of evaluating associated failures and deficiencies.
10.
Review the licensees implementation of the Emergency Plan during the
July 24, 2024, event and related implementing procedures, including both
equipment and staff performance.
11.
Gather information available at the time of the onsite inspection related to
probable causes of the July 24, 2024, initiating event and subsequent
switchyard equipment performance to support determination of whether the
initiating event was foreseeable and preventable by the licensee. Examples
may include site electrical grounding system capability, weather conditions,
breaker performance, or other switchyard layout or component issues.
2.
Collect data necessary to support completion of the significance
determination process, if applicable.
C.
Guidance
Inspection Procedure 93812, Special Inspection, provides guidance to be used by
the Special Inspection Team. Your duties will be as described in Inspection
Procedure 93812. The inspection should emphasize fact-finding in its review of the
circumstances surrounding the events. It is not the responsibility of the team to
examine the regulatory process. Safety concerns identified that are not directly
related to the events should be reported to the Region IV office for appropriate action.
You should notify the licensee and the team should nominally begin inspection
activities on or before September 9, 2024, based on the licensees schedule of
activities and availability of inspection team members. You should conduct an
entrance meeting with the licensee at the appropriate time when you arrive onsite at
South Texas Project. You should provide a daily briefing to Region IV management
during the course of your inspection and prior to your exit debrief. A report
documenting the results of the inspection should be issued within 45 days of the
completion of the inspection.
This Charter may be modified should you develop significant new information that
warrants review.
ATTACHMENT 2 - SPECIAL INSPECTION CHARTER FOR SOUTH TEXAS PROJECT
ELECTRIC GENERATING STATION, UNIT 2 AUTOMATIC REACTOR TRIP, ON
MAY 12, 2024
In response to a Unit 2 automatic reactor trip due to a lockout of the unit auxiliary transformer on
May 12, 2024, at South Texas Project Electric Generating Station, a Special Inspection will be
performed. You are hereby designated as the Special Inspection team leader. The following
members are assigned to your team:
James Drake, Senior Reactor Inspector, Division of Operating Reactor Safety
Nnaerika Okonkwo, Reactor Inspector - Division of Operating Reactor Safety
Beatrice Nwafor, Reactor Inspector - Division of Operating Reactor Safety (observer)
A.
Basis
On May 12, 2024, at 4:41 p.m., CDT, STP, Unit 2, automatically tripped from approximately
percent power. The trip was caused by a loss of power from the unit auxiliary transformer
due to actuation of its lockout relay, which resulted in a loss of power to the reactor coolant
pumps and a reactor protection system actuation. Instrumentation and controls technicians were
completing an unrelated work order in the same cabinet in the control room that contained the
relay at the time of the event. Earlier in the day, the unit had been starting up from a planned
refueling outage, and the turbine-generator was offline at the time of the event.
The interruption of power from the unit auxiliary transformer resulted in a loss of power to
nonsafety-related equipment including the reactor coolant pumps and the main condenser.
Consistent with the STP electrical distribution design, the loss of power from the unit auxiliary
transformer also caused an interruption of power to the A and C engineered safety features
busses. Emergency diesel generators 21 and 23 automatically started and provided power to
the A and C busses, respectively. The B engineered safeguards bus was aligned to the standby
transformer offsite power source and remained energized from offsite power throughout the
event.
The operations crew responded to the event and stabilized the unit in a safe condition using
natural circulation of the reactor coolant system. Decay heat removal was provided by the SG
Due to the reactor protection system actuation while critical, this event was reported as a four-
hour, non-emergency notification per 10 CFR 50.72(b)(2)(iv)(B). This event was also reported
per 10 CFR 50.72(b)(3)(iv)(A) as an event that resulted in a valid actuation of the emergency
diesel generators. The NRC received this report, and it is documented as EN 57124 on the
NRCs public website.
Several equipment problems occurred during the event. Control room operators noticed that
the 480 V load center E2A feeder breaker failed to automatically close on a load sequencer
signal and provide power to 480 V MCCs E2A1 and E2A3. The operators unsuccessfully
attempted to close the breaker manually from the control room, placed the breaker hand switch
in pull-to-lock, and requested electrical maintenance support. These MCCs provide power to
several A-train motor-operated valves, and essential cooling water pump 2A and emergency
diesel generators 21 essential support components. Electrical maintenance performed a visual
inspection and reported there was no obvious deficiency with the breaker. At 5:07 p.m., CDT,
the operators removed the breaker hand switch from the pull-to-lock position and the breaker
closed automatically, restoring power to the loads.
Additionally, when control room operators transferred steam generator PORVs from automatic
to manual control to use them for decay heat removal, the C PORV failed to the full-open
position when the operator began to manually open the valve. The operator closed the valve
using manual control and tried a second time with the same result. The operator closed the
C PORV and continued decay heat removal using the remaining three steam generator PORVs.
Main steam isolation valves were manually closed due to a loss of the condenser as an
available heat sink. Auxiliary feedwater was used to feed the steam generators.
During the event, reactor coolant pump 2B developed a high seal leakoff flow rate, indicating a
degraded seal. While one stage of the multi-stage pump seal had failed, integrity of the seal was
maintained as a result of the other intact seal stages. The licensee decided it was necessary to
continue the cooldown to cold shutdown conditions to replace the reactor coolant pump seal.
Shortly after the event occurred, the licensee worked to realign available offsite power sources
to supply the safety and non-safety electrical busses. Standby bus 2F was reenergized from the
Unit 2 standby transformer at 5:29 p.m., CDT, and the safety-related 2A bus was transferred off
the diesel generator and realigned to receive power from standby bus 2F at 11:33 p.m., CDT.
Standby bus 2H was reenergized from the Unit 1 standby transformer at 5:47 p.m., CDT, and
the safety-related 2C bus was realigned from the diesel generator to receive power from
standby bus 2H at 5:30 a.m., CDT the next morning, May 13, 2024. Normal decay heat removal
was placed in service using the residual heat removal pumps and the unit entered cold
shutdown on May 14, 2024.
Management Directive 8.3, NRC Incident Investigation Program, was used to develop a
recommendation on the level of NRC response for this event. In evaluating the deterministic
criteria of MD 8.3, the staff determined that the event met two of the deterministic criteria.
Specifically, the event led to multiple failures in systems used to mitigate an actual event and
involved an example of repetitive failures involving safety-related equipment. In evaluating the
risk assessment criteria of MD 8.3, the estimated incremental conditional core damage
probability was determined to be approximately 2.1E-5.
Based on the deterministic criteria and risk insights related to this event, the perceived
complexity of the event, and the need for inspection staff resources with electrical engineering
expertise, Region IV management determined that the appropriate level of NRC response was
to conduct a Special Inspection. This Special Inspection is chartered to identify the
circumstances surrounding this event and review the licensees actions to address the causes
of the event.
B.
Scope
The inspection is expected to perform data gathering and fact-finding to address the following:
1.
During the initial debrief to management on the first day of onsite inspection, provide a
recommendation to Region IV management as to whether the inspection should be
upgraded to an augmented inspection team.
2.
Develop a sequence of events related to the lockout of the unit auxiliary transformer,
reactor trip, and associated equipment failures. The chronology should include the status
of plant equipment and licensee actions to respond and mitigate the conditions. The
timeline should consider any licensee actions that served as missed opportunities to
identify the equipment failures before they occurred during the event.
3.
Review the licensees causal evaluation(s) and determine if they are being conducted at
a level of detail commensurate with the significance of the issues that were encountered
during the event. Evaluate the identification of the failure mode and the troubleshooting
approach that supports the stations confidence in determination of the direct causes.
Consider the licensees application of relevant industry operating experience.
4.
Review the licensees extent of condition evaluation(s) to determine if the licensee has
adequately considered similar vulnerabilities with other transformer lockout relays,
similar conditions that led to the load center breakers failure to close, and similar
deficiencies in other steam generator PORVs for both units.
5.
Review completed and proposed corrective actions to determine if the licensee has/is
taking appropriate actions to address the auxiliary transformer lockout, load center
feeder breaker, and steam generator PORV conditions.
6.
Determine if the steam generator PORV degraded condition would likely have prevented
successful operation of the valve in both automatic and manual mode.
7.
Evaluate steam generator PORV deficiencies over the last 2 years, including failures
during the Unit 1 January 21, and February 29, 2024, forced outages and the Unit 2
24 refueling outage. Determine if past licensee corrective actions to address failures
were adequate.
8.
Review the design bases documents (USAR, calculations, etc.) and operational
procedures to determine if the licensees operational practices with respect to offsite
power source alignments and automatic/manual transfer capabilities are consistent with
these documents.
9.
For a sample of safety-related breakers, the load sequencer, and control room hand
switches, evaluate the licensees monitoring and maintenance including review of
system health reports, maintenance history, and corrective action program effectiveness
for possible trends and overall timeliness of evaluating associated failures and
deficiencies.
10.
Collect data necessary to support completion of the significance determination process,
if applicable.
C.
Guidance
Inspection Procedure 93812, Special Inspection, provides guidance to be used by the SIT.
Your duties will be as described in Inspection Procedure 93812. The inspection should
emphasize fact-finding in its review of the circumstances surrounding the event. It is not the
responsibility of the team to examine the regulatory process. Safety concerns identified that are
not directly related to the event should be reported to the Region IV office for appropriate action.
You should notify the licensee and the team should nominally begin inspection activities on or
before July 8, 2024, based on the licensees schedule of activities and availability of inspection
team members. You should conduct an entrance meeting with the licensee at the appropriate
time when you arrive onsite at South Texas Project. You should provide a daily briefing to
Region IV management during the course of your inspection and prior to your exit debrief. A
report documenting the results of the inspection should be issued within 45 days of the
completion of the inspection.
This Charter may be modified should you develop significant new information that warrants
review.
MANAGEMENT DIRECTIVE 8.3
DECISION DOCUMENTATION FORM
(Deterministic and Risk Criteria Analyzed)
PLANT:
South Texas Project, Unit 2
EVENT DATE:
May 12, 2024
RESPONSIBLE
BRANCH CHIEF:
EVALUATION
DATE:
May 30, 2024
BRIEF DESCRIPTION OF THE SIGNIFICANT OPERATIONAL EVENT OR DEGRADED
CONDITION:
On May 12, 2024, at 4:41 p.m., CDT, STP, Unit 2, automatically tripped from approximately
percent power. The trip was caused by a loss of power from the unit auxiliary transformer
due to actuation of its lockout relay, which resulted in a loss of power to the reactor coolant
pumps and a reactor protection system actuation. Instrumentation and controls (I&C)
technicians were completing an unrelated work order in the same cabinet in the control room
that contained the relay at the time of the event. Earlier in the day, the unit had been starting
up from a planned refueling outage, and the turbine-generator was offline at the time of the
event.
The interruption of power from the unit auxiliary transformer resulted in a loss of power to
non-safety-related equipment including the reactor coolant pumps and the main condenser.
Consistent with the STP electrical distribution design, the loss of power from the unit auxiliary
transformer also caused an interruption of power to the A and C engineered safety features
buses. Emergency diesel generators (EDG) 21 and 23 automatically started and provided
power to the A and C buses, respectively. The B engineered safeguards bus was aligned to
the standby transformer offsite power source and remained energized from offsite power
throughout the event.
The operations crew responded to the event and stabilized the unit in a safe condition using
natural circulation of the reactor coolant system. Decay heat removal was provided by the SG
Due to the reactor protection system actuation (RPS) while critical, this event was reported
as a 4-hour, non-emergency notification per 10 CFR 50.72(b)(2)(iv)(B). This event was also
reported per 10 CFR 50.72(b)(3)(iv)(A) as an event that resulted in a valid actuation of the
emergency diesel generators. The NRC received this report, and it is documented as
EN 57124 on the NRCs public website.
There were a couple of equipment problems that occurred during the event. Control room
operators noticed that the 480 V load center E2A feeder breaker failed to automatically close
on a load sequencer signal and provide power to 480 V MCCs E2A1 and E2A3. The
operators unsuccessfully attempted to close the breaker manually from the control room,
placed the breaker hand switch in pull-to-lock, and requested electrical maintenance support.
These MCCs provide power to several A-train motor-operated valves, and essential cooling
water pump 2A and EDG 21 essential support components. Electrical maintenance
performed a visual inspection and reported there was no obvious deficiency with the breaker.
MANAGEMENT DIRECTIVE 8.3
DECISION DOCUMENTATION FORM
(Deterministic and Risk Criteria Analyzed)
PLANT:
South Texas Project, Unit 2
EVENT DATE:
May 12, 2024
At 5:07 p.m., CDT, the operators removed the breaker hand switch from the pull-to-lock
position and the breaker closed automatically, restoring power to the loads.
Additionally, when control room operators transferred steam generator PORVs from
automatic to manual control to use them for decay heat removal, the C PORV failed to the
full-open position when the operator began to manually open the valve. The operator closed
the valve using manual control and tried a second time with the same result. The operator
closed the C PORV and continued decay heat removal using the remaining three steam
generator PORVs. Main steam isolation valves were manually closed due to a loss of the
condenser as an available heat sink. Auxiliary feedwater was used to feed the steam
generators.
During the event, reactor coolant pump 2B developed a high seal leakoff flow rate, indicating
a degraded seal. While one stage of the multi-stage seal had failed, integrity of the pump seal
was maintained as a result of the other intact seal stages. The licensee decided it was
necessary to continue the cooldown to cold shutdown conditions to replace the reactor
coolant pump seal.
Shortly after the event occurred, the licensee worked to realign available offsite power
sources to supply the safety and non-safety electrical buses. Standby bus 2F was
reenergized from the Unit 2 standby transformer at 5:29 p.m., CDT, and the safety related 2A
bus was transferred off the diesel generator and realigned to receive power from standby
bus 2F at 11:33 p.m., CDT. Standby bus 2H was reenergized from the Unit 1 standby
transformer at 5:47 p.m., CDT, and the safety related 2C bus was realigned from the diesel
generator to receive power from standby bus 2H at 5:30 a.m., CDT, the next morning,
May 13, 2024. Normal decay heat removal was placed in service using the residual heat
removal pumps and the unit entered cold shutdown on May 14, 2024.
Y/N
DETERMINISTIC CRITERIA
Involved operations that exceeded, or were not included in, the design
bases of the facility
N
Remarks: The event was within the design basis of the facility.
Involved a major deficiency in design, construction, or operation having
potential generic safety implications
N
Remarks: The event did not reveal any major deficiencies, nor did it have generic
safety implications.
Led to a significant loss of integrity of the fuel, primary coolant pressure
boundary, or primary containment boundary of a nuclear reactor
N
Remarks: There was not a loss of any barriers during this event
Led to the loss of a safety function or multiple failures in systems used to
mitigate an actual event
Y
Remarks: There were multiple failures in the systems used to mitigate an actual
event. The C steam generator PORV failed to the full-open position when the
licensee attempted to manually open it and the A-train load center output breaker
providing power to MCC E2A1 and MCC E2A3 failed to close.
Involved possible adverse generic implications
N
Remarks: The trip did not have generic safety implications
Involved significant unexpected system interactions
N
Remarks: The trip did not involve significant unexpected system interactions.
Involved repetitive failures or events involving safety-related equipment or
deficiencies in operations
Y
Remarks: Prior to this Unit 2 event involving a failed safety-related steam
generator PORV, there were three failures of steam generator PORVs in 2024 on
Unit 1 (one failure of A PORV and two failures of the C PORV). The NRC issued a
Green NCV in Inspection Report 05000498/2024001 and 05000499/2024001 for
inadequate corrective actions for the failure of the Unit 1, C PORV.
Involved questions or concerns pertaining to licensee operational
performance
N
Remarks: Operators responded appropriately to the event.
Involved circumstances sufficiently complex, unique, or not well enough
understood, or involved safeguards concerns, or involved characteristics
the investigation of which would best serve the needs and interests of the
Commission.
N
Remarks: This event did not involve circumstances sufficiently complex, unique,
or not well enough understood; nor involve safeguards concerns. This event did
not involve such unusual characteristics requiring an investigation to serve the
needs and interests of the Commission.
Y/N
DETERMINISTIC CRITERIA
Emergency Preparedness, Radiation Protection, and/or Security/Safeguards
Deterministic Criteria
N
Remarks: None of the emergency preparedness, radiation protection, and/or
security/safeguards deterministic criteria could be answered in the affirmative for
this event.
CONDITIONAL RISK ASSESSMENT
IF IT IS DETERMINED THAT A RISK ANALYSIS IS NOT REQUIRED - ENTER NA BELOW
AND CONTINUE TO THE DECISION BASIS BLOCK
RISK ANALYSIS BY:
DATE: May 30, 2024
Brief description for the basis of the assessment (may include assumptions, calculations,
references, peer review, or comparison with licensees results):
For this risk assessment, the analyst used the test and limited model STP SPAR
model TLU1, Version 8.80, run on SAPHIRE, revision 8.2.10. The following modifications
were made to the model to better model the plant conditions and failures:
1.
The success criteria for the feed and bleed strategy were adjusted to only requiring
one of the two primary PORVs to successfully implement the strategy. This change in
success criteria was made after the NRC Office of Nuclear Regulatory Research
reviewed thermal-hydraulic analyses for the STP plants and considered those
analyses consistent with those made in NUREG-2187, Confirmatory Thermal-
Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant
Risk Models - Byron Unit 1, which were used to adjust SPAR model success criteria.
The analyst complemented pertinent basic events in fault tree FAB to do this.
2.
Because of the low decay heat load at the time of the event resulting from the units
recent refueling outage, the analyst adjusted basic event HPI-XHE-XM-FAB, Operator
Fails to Initiate Feed and Bleed Cooling. The performance shaping factor for available
time was changed from barely adequate time to nominal time, resulting in a change of
the failure probability of the basic event from 2.0E-2 to 2.0E-3.
3.
The reactor coolant system pressure relief success criteria were adjusted to requiring
two primary PORV or primary safety valve failures vice zero failures to fail the ATWS
pressure relief strategy. Analysts noted that this change in success criteria to the
current revision of the SPAR model was needed after reviewing plant-specific
calculations detailing the pressure relief valve capabilities for the STP units during
ATWS events. This change appropriately eliminated conservatisms in the estimate of
the conditional core damage probability by reducing the overestimation of the
probabilities from core damage sequences containing ATWS events. The analyst
complemented pertinent basic events in fault tree RCSPRESS to do this.
4.
The failure probability of basic event FLX-XHE-XM-ELAP, Operators Fail to Declare
ELAP when Beneficial, was adjusted from 1.0 to 1.0E-2 to give credit for use of
mitigating strategies using FLEX equipment.
5.
At the time of the event, safety buses E1A and E1C were supplied by the unit
auxiliary transformer. The analyst added basic event ACP-TFM-FC-UT002A, Failure
CONDITIONAL RISK ASSESSMENT
of Unit Aux Transformer UT002A, and removed basic event ACP-TFM-FC-ST001A,
Failure of Standby Transformer ST001A, under fault trees ACP-E1A1-SB1F and
ACP-E1C-1H, to reflect this alignment.
6.
The analyst created new basic event ACP-CRB-OO-LCE1A1, Feeder Breaker for
Load Center E1A1 Fails to Close after Load Shed, to fault tree ACP-E1A-480V, to
account for the observed failure of the breaker during the event. This basic event was
ANDed with a new basic event ACP-XHE-XM-E1A1RESTORE, Operators Fail to
Restore Load Center after Load Shed, to allow for recovery from the failure of the
breaker to close. Inclusion of this recovery basic event recognized a range of
possibilities of operators being able to reclose the breaker, including the actual time it
took during the event. The basic event was created by using nominal ratings for all
performance shaping factors except for time available for which extra time was
credited.
The event was run as an initiating events analysis using the Events and Conditions
Assessment module of SAPHIR
following assumptions were made:
1.
The event was run as a loss of condenser heat sink event since functionality of the
main condenser as a heat sink was lost for event mitigation. The initiating event
frequency for a loss of condenser heat sink was set to 1.0 and the initiating event
frequency for all other initiating events was set to 0.0.
2.
Basic event ACP-TFM-FC-UT002A, Failure of Unit Aux Transformer UT002A, was set
to TRUE to model the loss of offsite power to safety buses E1A and E1C.
3.
Basic Event ACP-CRB-OO-LCE1A1, Feeder Breaker for Load Center E1A1 Fails to
Close after Load Shed, was set to TRUE to reflect the initial failure of the breaker to
close.
4.
The failure probability of the PORV steam generator C was doubled from 1.61E-2
to 3.22E-2, to reflect the possibility that the internal malfunction the licensee
discovered in troubleshooting the PORV could have prevented its functioning under
some conditions. The SPAR model made automatic adjustments to account for the
possibility of the other PORVs experiencing similar failures to common cause.
5.
To account for the increased reactor coolant pump seal leakage in reactor coolant
pump 2B, the analyst set basic event RCS-MDP-LKBP2, RCP Seal Stage 2 Integrity
(Binding/Popping Open) Fails, to TRUE. This adjustment made little impact on the
estimate of conditional core damage probability because the risk increase from a
reactor coolant pump seal LOCA was diminished by the licensees past plant
modification which installed low leakage seals.
6.
Per NRC practice for performing MD 8.3 risk assessments, the analyst set all test and
maintenance failure probabilities to 0.0.
Applying these assumptions and model modifications led to an estimate for the conditional
core damage probability of 2.1E-5. The dominant accident sequence leading to core damage
was a loss of condenser heat sink event where the steam generator PORVs fail to function
and the feed and bleed strategy for decay heat removal fails.
CONDITIONAL RISK ASSESSMENT
The analyst discussed these results with the licensee in a phone call on May 23, 2024. The
licensee performed a risk assessment after adjusting their base PRA model to credit
successful recovery of the closing function of the feeder breaker for load center E2A1 and
estimated a conditional core damage probability of 8.0E-7 for the event. Some modeling
differences were noted which contributed to differences in the NRCs and licensees
estimates of conditional core damage probability. Notably, the licensee modeled the event as
a plant-centered loss of offsite power in their PRA model which is not consistent with how
NRC risk assessment methodologies would model the actual plant event. Treatment of the
event as a loss of offsite power in the NRC SPAR model would also inappropriately invoke
full credit for recovery from loss of offsite power events when offsite power was not
considered lost. Also, the licensee used lower failure rates in their PRA model for
establishing alternate room cooling for sequences which involve probabilistic loss of room
cooling.
This analysis was reviewed and concurred on by a senior reactor analyst from the Office of
Nuclear Reactor Regulation/Division of Risk Assessment.
THE ESTIMATED INCREMENTAL CONDITIONAL
CORE DAMAGE PROBABILITY (CCDP) IS:
2.1 x 10-5
WHICH PLACES THE RISK IN THE RANGE OF:
SIT/AIT Overlap
RESPONSE DECISION
USING THE ABOVE INFORMATION AND OTHER KEY ELEMENTS OF CONSIDERATION
AS APPROPRIATE, DOCUMENT THE RESPONSE DECISION TO THE EVENT OR
CONDITION, AND THE BASIS FOR THAT DECISION
DECISION AND DETAILS OF THE BASIS FOR THE DECISION:
Region IV staff concluded that two of the deterministic criteria were met and the estimated
incremental conditional core damage probability was in the range of 2.1 x 10-5, and as a
result, a reactive inspection should be considered. Considering the risk result, the types of
equipment failures experienced, the perceived complexity of the event, and the need for
inspection staff resources with electrical engineering expertise, the Region IV staff
determined that a reactive inspection was recommended. In consultation with headquarters
staff, Region IV determined that a Special Inspection Team rather than an Augmented
Inspection Team is the appropriate response due to the limited number of inspection items
requiring NRC follow-up, the uncertainty in the NRC risk model and its assumptions, and the
lack of generic implications associated with this event.
BRANCH CHIEF REVIEW:
DATE: May 30, 2024
DIVISION DIRECTOR REVIEW:
DATE: May 30, 2024
ADAMS ACCESSION NUMBER:
EVENT NOTIFICATION REPORT NUMBER (as applicable): 57124
E-mail to NRR_Reactive_Inspection@nrc.gov
MANAGEMENT DIRECTIVE 8.3
DECISION DOCUMENTATION FORM
(Deterministic and Risk Criteria Analyzed)
PLANT:
South Texas Project, Unit 1
EVENT DATE:
July 24, 2024
RESPONSIBLE
BRANCH CHIEF:
EVALUATION
DATE:
August 6, 2024
BRIEF DESCRIPTION OF THE SIGNIFICANT OPERATIONAL EVENT OR DEGRADED
CONDITION:
On July 24, 2024, at 7:02 a.m., CDT, STP, Unit 1, automatically tripped from full power. A
failure of shunt reactor 2 in the switchyard, and a resulting fire, caused a main generator
lockout, loss of power from the north and south buses, lockout of standby transformer 1,
turbine trip and reactor trip. The event resulted in a loss of offsite power to each Unit 1 ESF
bus and the autostart and loading of its associated EDG. All three trains of the AFW system
automatically started.
The loss of the south switchyard bus also caused a loss of standby transformer 2. Unit 2
remained online with its output limited to Hillje circuit 64 and operators reduced power to
percent as requested by the grid operator. The Unit 2, unit auxiliary transformer remained
available to provide power to Unit 2 ESF buses A and
- C. However, with the loss of standby
transformer 2, offsite power was lost to ESF bus B, resulting in the autostart and loading of its
associated EDG and the autostart of AFW train
- B.
The Unit 2 shift manager declared an NOUE at 7:18 a.m.Property "Contact" (as page type) with input value "B.</br></br>The Unit 2 shift manager declared an NOUE at 7:18 a.m." contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., CDT, based on EAL SU1 for loss
of all offsite power capability to emergency buses for greater than 15 minutes, due to
conditions on Unit 1, and assumed the duties of Emergency director. Offsite fire responders
arrived at the site and extinguished the fire using aqueous foam at 9:25 a.m., CDT.
Because offsite power was unavailable to operate the Unit 1 reactor coolant pumps or use
the condenser as a heat sink, operators isolated the main steam lines and maintained natural
circulation cooling in the reactor coolant system using AFW flow to the steam generators and
the steam generator power operated relief valves (SG PORVs) as a heat sink to the
atmosphere. At 9:53 a.m., after operators placed the SG PORV controllers in manual to keep
them from cycling, they noticed that the SG 1C PORV was closed and could not be controlled
in manual, nor would it operate when placed in automatic. The licensee declared the 1C
PORV inoperable at 9:53 a.m., CDT. The MSSV acoustic monitoring system was not
available to indicate whether any MSSV had lifted. However, based on local observation and
measured steam header pressure, the licensee concluded that at least one MSSV had lifted
to reduce steam line 1C pressure.
The licensee terminated the NOUE at 11:46 a.m., CDT. The licensee determined that offsite
power remained available from the 138 kV transmission line via the emergency transformer
and this offsite source could have provided power to an ESF bus during the event.
The south switchyard bus and standby transformer 2 were re-energized at 12:12 p.m., CDT.
This allowed the licensee to proceed with restoring offsite power to Unit 2 ESF bus B and all
MANAGEMENT DIRECTIVE 8.3
DECISION DOCUMENTATION FORM
(Deterministic and Risk Criteria Analyzed)
PLANT:
South Texas Project, Unit 1
EVENT DATE:
July 24, 2024
three Unit 1 ESF buses. Unit 1 also restored offsite power to non-ESF buses and restored
operation of a reactor coolant pump at 1:46 p.m., CDT, Standby transformer 1 remained
unavailable due to damage to its feeder cables from the switchyard.
At 1:50 p.m., CDT, the licensee evaluated electrical bus alignment and ESF power availability
and concluded both the north and south buses were operable and all Unit 2 ESF buses were
powered by the unit auxiliary transformer.
The licensee performed troubleshooting of Unit 1 PORV 1C but was unable to identify a
definitive cause of its failure. However, the licensee identified abnormal indications that plant
computer signals for valve operation were being received by the valves servo-amplifier
circuit card but were not being transmitted beyond the card to the valve actuator. As a result,
the licensee replaced the servo-amplifier and some other suspect electrical components.
Following post-maintenance testing, the licensee declared PORV 1C operable on July 28,
24, at 2:50 p.m., CD
- T.P
Regarding the cause of the shunt reactor failureProperty "Contact" (as page type) with input value "T.P</br></br>Regarding the cause of the shunt reactor failure" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., the licensee believes that the stormy
weather at the time of the event induced large voltage differentials between ground and
atmosphere. The licensee noted that during the event, several chain link fences around the
protected area and switchyard were seen sparking over a period of several seconds prior to
the shunt reactor failure. The licensee believes this phenomenon may have been the cause
of the shunt reactor failure, resulting in grounding phases of the shunt reactor and igniting the
oil-filled equipment.
On July 29, 2024, the licensee provided an update to the event notification that initially
reported the NOU
- E. The update stated, After a review of station logs, it was determined that
there was not a loss of all offsite AC power to Unit 1 An offsite power source was available
through the 138 kV transmission line. This referred to the offsite power supply which
provides power to the emergency transformer offsite source, which has capability to provide
power to one ESF bus for each unit. The NRC staff noted that some licensee internal
communications issues occurred during the event which challenged timely and accurate
classification and notifications.
Unit 1 was restarted and placed online on August 1, 2024.
Y/N
DETERMINISTIC CRITERIA
Involved operations that exceeded, or were not included in, the design
bases of the facility.
N
Remarks: The event was within the design basis of the facility.
Involved a major deficiency in design, construction, or operation having
potential generic safety implications.
N
Remarks: The event did not reveal any major deficiencies, nor did it have generic
safety implications.
Led to a significant loss of integrity of the fuel, primary coolant pressure
boundary, or primary containment boundary of a nuclear reactor.
N
Remarks: There was not a loss of any barriers during this event.
Led to the loss of a safety function or multiple failures in systems used to
mitigate an actual event.
N
Remarks: There was only one failure in a system used to mitigate an actual event.
Steam generator PORV 1C failed in the closed position when its controller was
placed in manual. The valve would not open using manual control and the valve
would not open when the controller was placed in automatic. This caused
increasing pressure in the C main steam line and at least one main steam safety
valve lifted. This criterion was marked No since there were not multiple equipment
failures or loss of the decay heat removal safety function provided by the
remaining steam generator PORVs.
Involved possible adverse generic implications
N
Remarks: The trip did not have generic safety implications.
Involved significant unexpected system interactions
N
Remarks: The trip did not involve significant unexpected system interactions.
Involved repetitive failures or events involving safety-related equipment or
deficiencies in operations.
Y
Remarks: Prior to this Unit 1 event involving a failed safety-related steam
generator PORV, there were three failures of steam generator PORVs in 2024 on
Unit 1 (one failure of PORV 1A and two failures of PORV 1C). There was also a
failure of the Unit 2 PORV 2C during the May 12, 2024, Unit 2 event. The NRC
issued a Green NCV in Inspection Report 05000498/2024001 and
05000499/2024001 for inadequate corrective actions for the repetitive failure of
the Unit 1, PORV 1C.
Involved questions or concerns pertaining to licensee operational
performance.
N
Remarks: There are no known concerns regarding the operational performance of
the licensee during the event. There were some communications issues involving
emergency preparedness and these are addressed below.
Y/N
DETERMINISTIC CRITERIA
Involved circumstances sufficiently complex, unique, or not well enough
understood, or involved safeguards concerns, or involved characteristics
the investigation of which would best serve the needs and interests of the
Commission.
N
Remarks: This event did not involve circumstances sufficiently complex, unique,
or not well enough understood; nor involve safeguards concerns. This event did
not involve such unusual characteristics requiring an investigation to serve the
needs and interests of the Commission.
Emergency Preparedness Deterministic Criterion - Significant failures to
implement the emergency preparedness program during an actual event,
including the failure to classify, notify, or augment onsite personnel.
N
Remarks: There were apparent inadequacies in the implementation of the
emergency preparedness program during an actual event as described below, but
they did not involve the failure to classify, notify, or augment onsite personnel.
The licensee notified all appropriate State and local agencies but failed to notify
them within 15 minutes and the NRC within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of the NOUE declaration.
Later, the licensee determined and reported to the NRC that it had overclassified
the event because the 138 kV transmission line and the associated emergency
transformer remained available to provide a source of offsite power during the
event.
Radiation Safety, and/or Security/Safeguards Deterministic Criteria
N
Remarks: None of the radiation safety, and/or security/safeguards deterministic
criteria could be answered in the affirmative for this event.
CONDITIONAL RISK ASSESSMENT
IF IT IS DETERMINED THAT A RISK ANALYSIS IS NOT REQUIRED - ENTER NA BELOW
AND CONTINUE TO THE DECISION BASIS BLOCK
RISK ANALYSIS BY: Rick Deese
DATE: August 2, 2024
Brief description for the basis of the assessment (may include assumptions, calculations,
references, peer review, or comparison with licensees results):
For this risk assessment, the analyst used the test/limited use STP SPAR model
STP-EQK-HWD-FLEX-TLU2, Version 8.80, run on SAPHIRE, revision 8.2.10. The following
modifications were made to the model to better model the plant conditions and failures:
1.
The success criteria for the feed and bleed strategy were adjusted to only requiring
one of the two primary pilot operated relief valves (PORVs) to successfully implement
the strategy. The analyst complemented pertinent basic events in fault tree FAB to do
this.
2.
The failure probability of basic event FLX-XHE-XM-ELAP, Operators Fail to Declare
ELAP when Beneficial, was adjusted from 1.0 to 1.0E-2 to give credit for use of
mitigating strategies using FLEX equipment.
3.
The failure probabilities of the sites FLEX equipment were changed to reflect the
failure rates based on industry data obtained by the PWR Owners Group and
approved for use by the Office of Nuclear Reactor Regulation.
The event was run as an initiating events analysis using the Events and Conditions
Assessment module of SAPHIR
following assumptions were made:
1.
The event was run as a switchyard-centered loss of offsite power event since offsite
power to all three engineered safety features buses was lost. The initiating event
frequency for a switchyard-centered loss of offsite power was set to 1.0 and the
initiating event frequency for all other initiating events was set to 0.0.
2.
The failure probability of steam generator PORV C was set top TRUE, to reflect the
valves failure to operate during the event.
3.
Per NRC practice for performing MD 8.3 risk assessments, any out-of-service
equipment must be reflected in the risk assessment. Since the licensee had all
risk-significant equipment available at the time of the event, the analyst set all test
and maintenance failure probabilities to 0.0.
4.
Offsite power was not restored to Unit 1 until 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and 10 minutes after the event
began. Basic events OEP-XHE-XL-NR01HSC, Operator Fails to Recover Offsite
Power in 1 Hour (Switchyard), and OE-XHE-XL-NR04HSC, Operator Fails to Recover
Offsite Power in 4 Hours (Switchyard), were set to TRUE to reflect the time taken to
restore offsite power to the safety buses.
Applying these assumptions and model modifications led to an estimate for the conditional
core damage probability of 4.1E-5. The dominant accident sequences leading to core
damage were loss of offsite power events where the stations diesel generators failed leading
to station blackout events characterized by failures to recover offsite power.
The analyst discussed these results with the licensee in a phone call on August 5, 2024.
This analysis was reviewed and concurred on by a risk and reliability analyst from the
Division of Risk Assessment in the Office of Nuclear Reactor Regulation.
THE ESTIMATED CONDITIONAL CORE DAMAGE
PROBABILITY (CCDP) IS:
4.1 x 10-5
WHICH PLACES THE RISK IN THE RANGE OF:
Special Inspection / AIT Overlap
RESPONSE DECISION
USING THE ABOVE INFORMATION AND OTHER KEY ELEMENTS OF CONSIDERATION
AS APPROPRIATE, DOCUMENT THE RESPONSE DECISION TO THE EVENT OR
CONDITION, AND THE BASIS FOR THAT DECISION
DECISION AND DETAILS OF THE BASIS FOR THE DECISION:
Region IV staff concluded that one of the deterministic criteria was met and the estimated
conditional core damage probability was 4.1 x 10-5, and as a result, a reactive inspection
should be considered. Considering the risk result, the repetitive equipment failure
experienced, the perceived complexity of the event, and the need for inspection staff
resources with electrical engineering and emergency preparedness expertise, the Region IV
staff determined that a reactive inspection was recommended. In consultation with
headquarters staff, Region IV determined that a Special Inspection Team is the appropriate
response due to the limited number of inspection items requiring NRC follow-up, the nature of
the initiating event, and the lack of a need for onsite headquarters personnel augmentation.
The staff recommended this special inspection be accomplished by adding scope and team
members to a special inspection that is already planned to occur at the facility for a similar
type of event the week of September 9, 2024.
BRANCH CHIEF REVIEW:
DATE: August 6, 2024
DIVISION DIRECTOR REVIEW:
DATE: August 8, 2024
ADAMS ACCESSION NUMBER:
EVENT NOTIFICATION REPORT NUMBER (as applicable): 57237
E-mail to NRR_Reactive_Inspection@nrc.gov