Semantic search
Jump to navigation
Jump to search
| Quarter | Site | Title | Description | |
|---|---|---|---|---|
| 05000341/FIN-2018003-03 | 2018Q3 | Fermi | Failure to Identify a Condition Adverse to Quality on Division 2 Residual Heat Removal Service Water Outlet Flow Control Valve | A finding of very low safety significance and associated non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, and TS 3.7.1 Residual Heat Removal Service Water (RHRSW) System, were self-revealed for the licensees failure to identify a condition adverse to quality on the Division 2 RHRSW outlet flow control valve E1150F068B. Specifically, troubleshooting and the associated post maintenance testing failed to identify and correct a failed anti-rotation key which resulted in an inoperable Division 2 RHRSW system for longer than its TS 3.7.1 allowed outage time. |
| 05000341/FIN-2018003-02 | 2018Q3 | Fermi | Failure to Ensure Electrolytic Capacitors Installed in the Plant Did Not Have Expired Shelf Lives | A finding of very low safety significance with an associated non-cited violation of 10 CFR 50, Appendix B, Criterion VIII, Identification and Control of Materials, Parts, and Components was self-revealed when the reactor water cleanup system inlet flow square root converter failed, resulting in a failure of the reactor water cleanup (RWCU) differential flow instrument and loss of automatic isolation function of the RWCU isolation valves. Specifically, electrolytic capacitors were installed in the RWCU system logic that had expired shelf lives, resulting in failures of the automatic isolation function of the RWCU system. |
| 05000341/FIN-2018003-01 | 2018Q3 | Fermi | Failure to Apply Torque Values Described in Maintenance Procedure for Flexible Couplings on Emergency Diesel Generator 12 | A finding of very low safety significance with an associated non-cited violation of Technical Specification 5.4.1.a was self-revealed when plant operators discovered a pencil-thick lube oil leak coming from a flexible coupling on emergency diesel generator 12 during planned surveillance testing. Specifically, a lube oil leak developed when the flexible coupling located between the engine driven lube oil pump and the lube oil filter failed due to improper torque applied to the coupling On April 20, 2018, the licensee was performing a routine slow start surveillance of emergency diesel generator 12 (EDG12), when plant operators noted a pencil-thick lube oil leak from the flexible coupling fastener located between the engine driven lube oil pump and the lube oil filter with the engine running in idle. Plant operators subsequently shut down the engine, discontinued the surveillance, and EDG12 was declared inoperable. The licensee performed an investigation and found the flexible coupling fastener was torqued to 120 in/lbs. Maintenance procedure 35.307.008, Emergency Diesel Generator Engine General Maintenance, Enclosure X, Revision 44 required a torque value of 240260 in/lbs for the size of piping the fastener was on. The coupling was last disturbed in 2011, and the maintenance procedure at that time did not contain information regarding torque values for flexible couplings. A similar flexible coupling fastener failed in 2016 due to inadequate work instructions for torqueing flexible couplings (NCV 05000341/201600401, ADAMS Accession Number ML17030A328), and corrective actions were developed to use the vendor recommended values that had already been added to the maintenance procedure as Enclosure X in 2014. However, the corrective actions did not require all flexible couplings to be checked to ensure they were appropriately torqued. Opportunities existed for the licensee to ensure these flexible couplings were properly torqued according to vendor recommendations, either through scheduled maintenance online or during refueling and forced outages. Therefore, on April 20, 2018, another flexible coupling that was not checked as an extent of condition failed due to an under torqued condition. |
| 05000346/FIN-2018002-01 | 2018Q2 | Davis Besse | Failure to Follow the Makeup and Purification Procedure | A self-revealed Green finding and associated Non-Cited Violation of Technical Specification 5.4.1.a, Procedures, was identified when the licensee failed to follow station procedure DBOP06006, Makeup and Purification System. Specifically, the licensee failed to open MU177, the Make-Up Filter 1 Outlet Isolation valve, which resulted in the isolation of letdown while swapping make-up filters. |
| 05000346/FIN-2018002-02 | 2018Q2 | Davis Besse | Failure to Apply Technical Specification for Safety Features Actuation SystemInstrumentation | The NRC identified a finding of Green significance and an associated Non-Cited Violation of Technical Specification 3.3.5.b, Safety Features Actuation System (SFAS) Instrumentation, for the licensees failure to place the reactor in Mode 3 within six hours of identifying that two channels of Safety Features Actuation System Borated Water Storage Tank level instrumentation were inoperable. Specifically, the licensee inappropriately exited Technical Specification 3.3.5.b, and failed to place the reactor in Mode 3 while two Borated Water Storage Tank level instruments were inoperable for more than six hours. |
| 05000346/FIN-2018002-03 | 2018Q2 | Davis Besse | Failure to Perform a Procedure Affecting Quality | The NRC identified a finding of Green significance and an associated non-cited violation of 10 Code of Federal Regulation(CFR) Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, due to the licensees failure to implement DBOP03006, Miscellaneous Instrument Shift Checks, Specifically, the licensee declared SFAS Channel 1 operable without performing the required channel check. |
| 05000346/FIN-2018002-04 | 2018Q2 | Davis Besse | Misapplication of the Operability Determination Process | The NRC identified a finding of Green significance due to the licensees misapplication of NOPOP1009, Operability Determinations and Functionality Assessments. Specifically, the licensee failed to apply the Operability Determination process in accordance with procedures. |
| 05000346/FIN-2017004-01 | 2017Q4 | Davis Besse | Failure to Maintain Procedures Associated with Ventilation Air Monitoring Assessment Program | The inspectors identified a finding of very-low safety significance and an associated NCV of Technical Specification 5.4.1 for the failure to maintain procedures for station vent releases during planned scenarios. Specifically, the inspectors identified multiple procedures that were not updated when the station vent monitors were replaced in 2014. This issue has been entered into the licensees Corrective Action Program as CR201710817. Corrective actions taken included the issuance of a Standing Order for collecting samples during accident conditions, provided Just-In-Time training for chemistry technicians, and revision of the outdated procedures. The performance deficiency was determined to be more-than-minor in accordance with Inspection Manual Chapter 0612, Appendix B, Issue Screening. Specifically, if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern in that the failure to maintain procedures to collect station vent samples under all predicted conditions could result in the inability to measure the amount of gaseous radioactivity leaving the plant and to ensure adequate protection of public health and safety from exposure to radioactive materials released into the public domain as a result of routine civilian nuclear reactor operation. The finding was assessed using Inspection Manual Chapter 0609 Appendix D, Public Radiation Safety Significance Determination Process, and was determined to be of very-low safety significance because the issue involved radioactive effluent releases, but did not: (1) represent a substantial failure to implement the Radioactive Effluent Release Program; or (2) result in public exposure that exceeded the dose values in Appendix I to 10 CFR, Part 50, and/or 10 CFR, Part 20.1301(e) limits. The inspectors determined that the finding had a cross-cutting component in the area of Human Performance, in the aspect of Work Management: specifically, the organization did not implement a process of planning, controlling, and executing work activities such that nuclear safety is the overriding priority. (H.5) |
| 05000346/FIN-2017004-02 | 2017Q4 | Davis Besse | Interface Between New Accident Range Ventilation Monitors and the Emergency Preparedness Dose Assessment Program | During inspection activities associated with the accident range station vent monitor, the inspectors identified an unresolved item (URI) associated with the interface between the monitor and the Dose Assessment Program used to project dose to members of the public during potential accident conditions. Description: The licensee replaced the accident range station vent monitors in 2014 using ECP 040006, Replace Kaman Radiation Monitors. The replacement monitors were manufactured by a different company than the original monitors, had different detection capabilities, different system calibration, and different computer hardware to convert detector output into usable information. The licensee could not immediately provide specifics regarding the interface between the new accident range monitors and the program used during accident conditions for providing dose projections and the resulting protective action recommendations. The inspectors focus of concern was how the new accident range monitors accounted for the potentially rapidly changing mixture of radioactive gases during the early phase of a postulated accident. Consequently, this issue remains under review by the NRC awaiting for additional information from the licensee to verify the new monitor interface to determine if it represents a performance deficiency and is categorized as a URI. (URI 05000346/201700403, Interface Between New Accident Range Ventilation Monitors and the Emergency Preparedness Dose Assessment Program) |
| 05000346/FIN-2017004-03 | 2017Q4 | Davis Besse | Failure to Prescribe Appropriate Work Instructions for an Activity Affecting Quality | A self-revealed finding with an Apparent Violation (AV) of Title 10 of the Code of Federal Regulations (CFR) Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, and an associated violation of technical specification (TS) 3.7.5, Emergency Feedwater (EFW), was identified on September 13, 2017, due to the licensees apparent failure to prescribe appropriate work instructions for an activity affecting quality of the safety-related auxiliary feedwater (AFW) system. Specifically, the licensee apparently did not provide appropriate instructions to maintain an adequate amount of oil in the AFW turbine bearing oil sumps, resulting in the failure of AFW 1 on September 13, 2017. The licensee entered this issue into the CAP as CR201709443 and CR201709857, immediately replaced the damaged bearing, and updated the lubrication manual data sheets to include sight glass marking dimensions per vendor guidance. The apparent performance deficiency was determined to be more than minor because the finding was associated with the Mitigating Systems cornerstone attribute of equipment performance and potentially adversely affected the cornerstone objective of ensuring the availability, capability and reliability of equipment that respond to initiating events. Specifically, the apparent performance deficiency resulted in the failure of the AFW 1. Using IMC 0609, Attachment 4, Initial Characterization of Findings, and IMC 0609 Appendix A, The Significance Determination Process for Findings at Power, issued June 19, 2012, the finding was screened against the mitigating systems cornerstone. The inspectors determined the finding represented an apparent actual loss of function of at least a single train for greater than its technical specification allowed outage time. Therefore, a detailed risk evaluation will be performed by a regional senior reactor analyst. Because the safety characterization of this finding is not yet finalized, it is being documented with a significance of to be determined (TBD). The inspectors determined this finding affected the cross-cutting aspect of challenge the unknown in the area of Human Performance, where individuals stop when faced with uncertain conditions. Risks are evaluated and managed before proceeding. Specifically, licensee personnel apparently did not stop when faced with uncertain conditions in the preventive maintenance procedure for replacing the AFPT sight glasses. Although the replacement of the AFPT 1 inboard bearing sight glass occurred in 1997, the licensee had the opportunity to challenge the lack of detail in the work instructions in late 2014 when the AFPT 2 outboard bearing sight glass was replaced. (H.11) |
| 05000346/FIN-2017004-04 | 2017Q4 | Davis Besse | Failure to Document a Degraded Condition on the AFPT 1 Outboard Bearing | The inspectors identified a finding of very low safety significance for the licensees failure to document a degraded condition of a safety-related system in the corrective action program (CAP), as required by licensee procedure, NOPLP2001. Specifically, during planned maintenance on auxiliary feedwater pump turbine (AFPT) 1, the licensee identified scoring on the outboard turbine bearing and failed to generate a condition report detailing the issue. The licensee entered this issue into the CAP as condition report (CR) 201712487 for evaluation. The inspectors determined the performance deficiency was more than minor because if left uncorrected it had the potential to lead to a more significant safety concern. Specifically, the failure to document a degraded condition in the CAP did not allow the organization to properly assess the issue. Therefore, the underlying cause may not have been appropriately addressed. Using IMC 0609, Attachment 4, Initial Characterization of Findings, issued October 7, 2016, and Appendix G, Attachment 1, Shutdown Operations Significance Determination Process Phase 1 Initial Screening and Characterization of Findings, issued May 9, 2014, the inspectors determined the finding to be of very low safety significance (Green) because the inspectors answered no to all questions in Exhibit 3 of Appendix G, Attachment 1. The inspectors determined this finding affected the cross-cutting aspect of identification in the area of Problem Identification and Resolution, where the organization implements a corrective action program with a low threshold for identifying issues and individuals identify issues completely, accurately, and in a timely manner in accordance with the program. Specifically, the licensee failed to completely identify the degraded condition, resulting in the failure to document the issue. (P.2) |
| 05000346/FIN-2017003-05 | 2017Q3 | Davis Besse | Ultrasonic Testing Records to Support Fuel Selection Were Not Being Maintained | A Severity Level IV NCV of 10 CFR 72.174, Quality Assurance Records, was identified by the NRC inspectors for the failure of the licensee as of June 22, 2017, to maintain sufficient records to furnish evidence of activities affecting quality. Specifically, the licensee failed to maintain ultrasonic testing (UT) records which were relied upon to demonstrate that the spent fuel selected for loading in calculation CNF062.02055, Revision 0, was correctly classified as intact. The licensee documented this issue in its CAP as CR201706976 and took timely corrective actions.The inspectors determined that the violation was of more than minor significance using IMC 0612, Power Reactor Inspection Reports, Appendix E, Examples of Minor Issues. Example 9a is applicable to this issue in that the licensee failed to maintain UT records for many fuel assemblies classified as intact for loading, and this failure to maintain records was not an isolated incident of one or two instances. The violation screened as a Severity Level IV NCV. Cross-cutting aspects are not assigned to traditional enforcement violations. |
| 05000346/FIN-2017003-04 | 2017Q3 | Davis Besse | Failure to Perform 10 CFR 50.59 Evaluation | A finding of very low safety significance and an associated NCV of 10 CFR 50.59(d)(1), Changes, Tests, and Experiments, was identified by the NRC inspectors for the licensees failure to maintain a record of a change from a method described in the USAR to another method. Specifically, the licensee failed to perform a written evaluation for the change to USAR defined load factors based on the design basis American Concrete Institute (ACI) 31863 Code to less conservative load factors based on the ACI 31871 Code. The licensee entered this issue into its CAP as CR201703025. Planned corrective action includes updating the USAR to reflect the changes to the Design Criteria Manual (DCM) for the load factors incorporated in the 1971 ACI 318 Code. 3 The inspectors determined that the licensees failure to perform a written evaluation for this change was a performance deficiency. The finding was determined to be more than minor because the inspectors could not conclude that the implemented change would not result in a departure from a method of evaluation described in the USAR) used in establishing the design bases and therefore not require a license amendment. Because the inspectors could conclude that the concrete structures designed using ACI 31871 load combinations would still have sufficient structural capacity to perform their design basis safety functions during a seismic event, the finding was determined to have very low safety significance corresponding to a Severity Level IV violation per Example 6.1.d.2 of the NRC Enforcement Policy. The inspectors did not identify a cross-cutting aspect associated with the finding because the finding was not representative of current licensee performance. |
| 05000346/FIN-2017003-03 | 2017Q3 | Davis Besse | Failure to Perform Adequate Evaluation of Cask CraneComponents and Crane Support Structure | A finding of very low safety significance and an associated Non-Cited Violation (NCV) of Title 10 of the Code of Federal Regulations (CFR), Part 50, Appendix B, Criterion III, Design Control, was identified by the NRC inspectors for the failure of the licensees design control measures to provide for verifying or checking the adequacy of design of the Auxiliary Building spent fuel cask crane and crane support structure elements. Specifically, calculations involving the Auxiliary Building structure, crane runway rails, crane rail clips, and rail clip bolts had not been verified or checked to ensure the requirements of Updated Safety Analysis Report (USAR) Section 3.8.1.2 were included. The licensee documented these issues in its Corrective Action Program (CAP) as CR201705071, CR201707084, and CR201707114, and initiated actions to restore compliance.The performance deficiency was determined to be of more-than-minor significance because it was associated with the Barrier Integrity cornerstone attribute of Design Control and adversely affected the cornerstone objective of providing reasonable assurance that the physical design barriers, i.e. the Auxiliary Building, protect the public from radionuclide releases caused by accidents or events. The inspectors screened the finding through Inspection Manual Chapter (IMC) 0609, Appendix A, The Significance Determination Process for Findings At-Power, using Exhibit 3, Barrier Integrity Screening Questions. The finding screened as of very low safety significance because the finding only represented a potential degradation of the radiological barrier function provided by the Auxiliary Building. The inspectors identified a Human Performance, Design Margin (H.6) cross-cutting aspect associated with this finding. Specifically, the licensee failed to ensure the Auxiliary Building structure, cask crane runway rails, rail clips, and rail clip bolts reflected the intended design margins established based on the design and licensing basis. |
| 05000346/FIN-2017003-02 | 2017Q3 | Davis Besse | Auxiliary Feedwater Pump 1 Bearing Failure | A URI was identified by the inspectors relating to the final determination of the cause of the AFP 1 turbine inboard bearing failure. On September 13, 2017, the licensee performed the scheduled quarterlysurveillance test on AFP 1. This test requires the pump to run loaded with full flow of water, whereas the monthly test runs the pump only lightly loaded with water being 10 pumped through a minimum recirculation line. Within three minutes after the full flow adjustments were completed, the AFP 1 turbine inboard bearing high temperature alarm (>220 oF) actuated. The licensee verified the alarm was valid and manually tripped the AFP 1 turbine approximately 30 minutes after the alarm was received. Oil samples indicated bearing damage. The licensee disassembled the AFP 1 turbine bearing and observed bearing failure.Initial evaluation of the bearing by the licensee revealed that the damage was due to insufficient lubrication caused by low oil level. The oil level at the time of failure was within the indicated acceptable band of the oil sight glass, however, indicated band was significantly larger than the vendor recommended 3/8 inch and not at the correct height.The oil level in the sump was too low to sufficiently wet the oil slinger ring. This condition was determined to have existed since the previous pump quarterly test on June 21, 2017. After that test, a technician removed an oil sample, but did not replenish the oil. The oil level indicated low to mid band, but within the (incorrectly marked) acceptable range on the sight glass at the time. The licensee entered this issue into their CAP as CRs 201709443, 201709817, 201709527, and 201709857. Because the licensee had yet to complete their investigation and analysis of the event by the end of this inspection period, the issue is being treated as a URI pending the inspectors review of the licensees completed root cause evaluation. (URI 05000346/201700302, Final Cause Determination of Auxiliary Feedwater Turbine Bearing Failure) |
| 05000346/FIN-2017003-01 | 2017Q3 | Davis Besse | Pinched Wiring Causing the Failure of Fuses Y210 and Y214 | An unresolved item (URI) was identified by the inspectors relating to the significance of pinched wires and licensees understanding of the condition and the extent of cause and condition. On July 6, 2017, during a planned replacement of fuse Y204 in electrical cabinet Y2, unrelated fuse Y214 blew. Both fuses were scheduled for replacement as part of the licensees project to replace Shawmut A25X style fuses that are susceptible to premature failure. The failure of fuse Y214 was unexpected, and the licensee was not able to discern a direct cause. The licensee determined that the failure was the fuse itself being so unstable that any perturbation was enough to cause failure. This failure resulted in multiple systems being declared inoperable including AFP 2, safety features actuation system channel 2, decay heat removal system interlock, and radiation element RE8447. On August 8, 2017, the same electrical cabinet, Y2, was opened for replacement of fuse Y216. Following the replacement, fuses Y210 and Y214 blew. The licensee attempted replacement of the fuses, but the replacement fuses blew again, shortly after being repowered. Initial licensee evaluation of the condition revealed thatthe wire bundle running along the hinge side of the cabinet door was unconstrained and two of the wires had become pinched between the door and cabinet frame, which damaged the wire insulation and allowed the wires to short circuit against the cabinet frame. The failure of Y210 and Y214 resulted in multiple systems being declared inoperable including AFP 2, safety features actuation system channel 2, decay heat removal system interlock, and emergency diesel generator 2. The licensee removed and replaced the damaged portion of the wires and used wire ties to constrain the wire bundle. The licensee entered this issue into their CAP as CRs 201707196 and 201708185. Because the licensee had yet to answer NRC inspector questions pertaining to the corrective actions and extent of condition by the end of this inspection period, the issue is being treated as a URI pending completion of the inspectors review. (URI 05000346/201700301, Examination of Extent of Cause and Condition of Pinched Wires in Electrical Cabinets) |
| 05000346/FIN-2017002-01 | 2017Q2 | Davis Besse | Licensee-Identified Violation | On February 6, 2017, the licensee identified during an engineering review that a vendor recommendation for containment air cooler (CAC) motors was not incorporated into plant procedures. The CAC fan motor vendor manual (M40000002) states that the motors were designed and manufactured to meet the requirements of National Electrical Manufacturers Association (NEMA) standard MG1 for motors and generators which recommends no more than two cold starts and one hot start per hour. The CAC monthly surveillance test procedures (DBSP03294 (CAC 1 Monthly Test), DBSP03295 (CAC 2 Monthly Test), and DBSP03296 (CAC 3 Monthly Test)) did not specify 31 limitations on the number of allowable hot and cold starts per hour. As a result, the motors were routinely operated with more than one hot start per hour, and the inspectors concluded it contributed to the failure of the CAC 1 fan motor in May 2014 as discussed in section 4OA2.3. 10 CFR Part 50, Appendix B, Criterion V Instructions, Procedures, and Drawings states: Activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Instructions, procedures, or drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Contrary to these requirements, the licensee failed to incorporate appropriate vendor recommendations on the number of hot and cold starts allowed per hour for the CAC fan motors into the CAC monthly surveillance procedures and was at least a contributor to the failure of CAC 1 in May 2014. The licensee had operated these motors in this manner for several years prior to the failure of CAC 1 motor. The objective of the Mitigating System Cornerstone of Reactor Safety is to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). A key attribute of this objective involves maintaining procedure quality of maintenance and testing procedures. In accordance with NRC Inspection Manual Chapter (IMC) 0612, Power Reactor Inspection Reports, Appendix B, Issue Screening, the inspectors determined that the violation was of more than minor significance in that it had a direct impact on this cornerstone objective. Specifically, the failure to have incorporated into station procedures the limit and precaution that CAC motors should be limited to two cold starts and one hot start per hour resulted in routinely cycling the containment air coolers with more than one hot start per hour, and ultimately was a contributor to the failure of CAC 1 motor in May 2014. Using NRC IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 2, Mitigating System Screening Questions, the inspectors determined that the violation was of very low safety significance (Green), since the inspectors answered no to all of the screening questions. The licensee had entered this issue into their CAP as CR 201701306. Licensee corrective actions included, but were not limited to, updating the CAC monthly surveillance procedures to add a new limit and precaution on allowable CAC motor starts per hour. |
| 05000346/FIN-2017001-01 | 2017Q1 | Davis Besse | Failure to Establish a Test Program that Demonstrates the Emergency Core Cooling System Room Coolers Will Perform Satisfactorily in Service | Green. The inspectors identified a finding of very low safety significance (Green) and an associated Cited Violation of Title 10 of the Code of Federal Regulations, (10 CFR) Part 50, Appendix B, Criterion XI, Test Control, for the licensees failure to establish a test program that demonstrates the emergency core cooling system (ECCS) room coolers will perform satisfactorily in service. Specifically, the associated inspection procedures did not include acceptance criteria, and the inspection results were not documented and evaluated to demonstrate the ECCS room coolers thermal performance was acceptable. The licensee captured this issue in their corrective action program (CAP) as condition report (CR) 201703328 to, in part, restore compliance and assess current and past operability. The performance deficiency was determined to be more than-minor because it was associated with the Mitigating Systems cornerstone attribute of procedure quality and affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems to respond to initiating events to prevent undesirable consequences. Specifically, the failure to demonstrate the ECCS room coolers will perform satisfactorily in service does not ensure the coolers would remain available and capable of performing their mitigating function because it has the potential to allow an unacceptable condition to go undetected. The finding screened as of very-low safety significance (Green) because it did not result in the loss of operability or functionality of mitigating systems. Specifically, the licensee re-evaluated the past operability impact of the 2016 tube blockage discoveries and determined that coolers were operable by crediting actual service water temperature and flowrate conditions. The inspectors determined that the associated finding had a cross-cutting aspect in the area of problem identification and resolution because the licensee did not thoroughly evaluate issues to ensure that resolutions address causes and extent of conditions commensurate with their safety significance. |
| 05000346/FIN-2016004-02 | 2016Q4 | Davis Besse | Failure to Adequately Evaluate Degraded Turbine Building Roof Vents | A finding of very low safety significance was self-revealed on September 10, 2016, when rainwater intrusion into the automatic voltage regulator caused a generator lockout and reactor trip. Specifically, station management failed to adequately assess the identified degraded condition of the turbine building roof vents in accordance with station expectations and procedures when four roof vents were left stuck open although it was identified by operators that water intrusion was possible onto the stator water cooling skid and automatic voltage regulator on August 17th, 24 days prior to the event. No violation of regulatory requirements was identified because the turbine building roof vents and automatic voltage regulator are not safety related, and the applicable maintenance procedures were not covered under Title 10 of the Code of Federal Regulations (10 CFR) 50, Appendix B. The finding was of more than minor safety significance because it affected the Equipment Reliability attribute of the Initiating Events cornerstone. Specifically, the failure to fully evaluate the risk associated with the stuck open turbine building roof vents affected the availability and reliability of the automatic voltage regulator causing a reactor trip. The inspectors also reviewed the examples of minor issues in IMC 0612, Power Reactor Inspection Reports, Appendix E, Examples of Minor Issues, dated August 11, 2009, and found no similar examples. The finding was determined to be a licensee performance deficiency of very low safety significance because the performance deficiency did not cause a reactor trip with the loss of mitigating equipment. The inspectors determined this finding affected the cross-cutting area of problem identification and resolution and the cross-cutting aspect of evaluation. The licensee did not properly evaluate the problem and assigned an incorrect priority to the work order to address the degraded roof vents. (P.2) |
| 05000346/FIN-2016004-01 | 2016Q4 | Davis Besse | Mispositioned Instrument Air Valves Result in Plant Transient | A self-revealed finding of very low safety significance was identified for the licensees failure to appropriately follow station procedures for aligning instrument air valves that support main feedwater (MFW) regulating valve operation. Specifically, two instrument air valves were not aligned to their normal operating position following planned maintenance. As a result, the Steam Generator 2 (SG 12) MFW Regulating Valve momentarily closed during routine steam feedwater rupture control system (SFRCS) surveillance testing and caused a plant transient. Corrective actions taken by the licensee, include but are not limited to, performance of an instrument air valve line up to validate no other valves were out of position; performance of SFRCS Actuation Channel 2 testing to verify no other half trips existed on SFRCS Actuation Channel 2 components; a configuration control stand-down with the instrument and control shop; and revisions to procedural guidance to perform additional valve position verification. The finding was of more than minor significance because it was associated with cornerstone attribute of configuration control and adversely affected the cornerstone objective: To limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. The finding was determined to be of very low safety significance because the finding did not cause a reactor scram with the loss of mitigation equipment relied upon to transition the plant from the onset of the scram to a stable shutdown condition (e.g. loss of condenser, loss of feedwater). The inspectors determined that the finding had a cross-cutting aspect in the area of human performance. The inspectors assigned the cross-cutting aspect of Avoid Complacency to the finding because the procedural step to close valve IA1008A was marked as complete but was not performed correctly. Additionally, appropriate human performance error reduction tools were not adequately used to ensure valve manipulations were performed as intended. (H.12) |
| 05000346/FIN-2016002-01 | 2016Q2 | Davis Besse | Mispositioned Instrument Air Valves Result in Plant Transient | On May 31, 2016, at approximately 10:21 a.m., planned testing of Steam and Feedwater Rupture Control System (SFRCS) Actuation Channel No. 1 was in progress. This was the first performance of this test since the unit returned to operation following RFO 19. Unexpectedly, operators in the control room received several overhead annunciator alarms coincident with a rapid swing in plant power and indications that the SG 12 MFW Regulating Valve (SP6A) had gone closed and then reopened. In accordance with established procedures for responding to such an event, control room operators took manual control of integrated control system (ICS) stations for reactor demand, SG/reactor demand, both MFW regulating valves, both MFW startup valves, and both MFW loop demands. The control room crew was then able to arrest the transient and stabilize plant power at approximately 89 percent. Initial evaluation of the transient by the licensee revealed that two instrument air (IA) valves associated with control air for SP6A (IA1008D, SVSP6A1 Bypass; and IA1008A SVSP6A1 Maintenance Isolation) were out of their normal positions. The mispositioned valves had the effect of placing P6A in a half trip condition, such that when SFRCS Actuation Channel No. 1 was being tested SP6A unintentionally responded to the test signal. The licensee entered this issue into their CAP as CRs 201607282, 201607286, 201607337, and 201608363. Because the licensee had yet to complete their investigation and analysis of the event and the IA valve mispositioning by the end of this inspection period, the issue is being treated as an unresolved item (URI) pending the inspectors review of the licensees completed cause evaluation and proposed corrective actions. (URI 05000346/201600201) |
| 05000338/FIN-2013004-01 | 2013Q4 | North Anna | Failure to Provide Vendor Oversight Results in a Manual Reactor Trip | A Green self revealing finding was identified for the failure to properly provide oversight over supplemental (vendor) personnel during the replacement of the Unit 2 turbine and exciter rotors during the spring of 2010 in accordance with Dominion procedure MA-AA-1001, Supplemental Personnel, Revision 9. The failure to properly provide oversight over supplemental (vendor) personnel in accordance with Dominion procedure MA-AA-1001, Supplemental Personnel, section 3.8.1, during the spring 2010 replacement of the Unit 2 turbine and exciter rotors was a performance deficiency. The performance deficiency was more than minor because it adversely affected the Initiating Events cornerstone objective of reliability because the failure to properly conduct procedure MA-AA-1001 directly resulted in the upset of plant stability by tripping the unit and the challenge of critical plant safety functions. Using IMC 0609, Appendix A, The Significance Determination Process for Findings at Power, issued June 19, 2012, the finding screens to green because although a reactor trip occurred, the loss of mitigating equipment for transitioning the plant to a safe shutdown condition did not occur. There is no cross cutting aspect for this finding because the initial cause of the finding occurred more than 3 years ago following turbine and exciter rotor replacement. |
| 05000338/FIN-2013004-02 | 2013Q4 | North Anna | Failure to Establish and Implement Adequate Preventative Maintenance Causes a Reactor Trip | A Green self-revealing finding was identified for failure to establish and implement adequate preventative maintenance for the mechanism operated cell (MOC) switches. Specifically the licensee failed to recognize and recommend proper maintenance for these components on the C main feedwater pump motor circuit breakers. The inspectors determined that the licensees failure to establish and implement adequate preventive maintenance for MOC switches in accordance with industry guidance through EPRI, the vendor, ABB, and operating experience was a performance deficiency. The performance deficiency was more than minor because it was associated with the Initiating Events cornerstone attribute of equipment performance and adversely affected the associated cornerstone objective in that loss of conductivity across contacts 25 and 26 in the upper MOC switch for circuit breaker 2-EP-BKR-25C5 caused the spurious closure of the C main feed pump discharge valve (2-FW-MOV-250C) and indirectly resulted in a manual reactor trip. Using Inspection Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, issued June 19, 2012, the finding was determined to be of very low safety significance (Green) because it was a transient initiator, but did not contribute to both the likelihood of a reactor trip and the likelihood that mitigation equipment or functions would not be available. In addition, this finding involved the cross cutting area of human performance, the component of decision making, and the aspect of systematic process for decision, H.1(a), because the licensee did not make risk-significant decisions using a systematic process for preventative maintenance activities when they failed to recognize and recommend proper maintenance for the MOC switches. |
| 05000280/FIN-2012005-01 | 2012Q4 | Surry | Submerged Cables Identified in SAFETY-RELATED Manhole | The inspectors identified a Green non-cited violation of Technical Specification 6.4.A.7, which requires appropriate corrective maintenance procedures which would have an effect on the safety of the reactor. Specifically, Dominion procedure 0-MCM- 1207-01, Pumping of Security and Electrical Cable Vaults, was inadequate to prevent or detect submerged cables in a safety-related manhole, which is a performance deficiency. The inspectors determined that Dominion procedure 0-MCM-1207-01, Pumping of Security and Electrical Cable Vaults was inadequate to accomplish its intended purpose, which constitutes a performance deficiency in accordance with Technical Specification 6.4.A.7, which requires appropriate corrective maintenance procedures which would have an effect on the safety of the reactor. The inspectors determined that the finding was more than minor because it was associated with the mitigating systems cornerstone attribute of equipment performance and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, this condition could lead to cable degradation, increased likelihood of cable failure, and subsequent risk associated with the failure of safety-related equipment. The inspectors screened this finding in accordance with IMC 0609, Significance Determination Process, Attachment 4, Initial Characterization of Findings, dated June 19, 2012, and IMC 0609, Appendix A, SDP for Findings At-Power, dated June 19, 2012 and determined the finding was of very low safety significance, Green, since it was a deficiency determined not to have resulted in the loss of operability or functionality of a single train for greater than its TS allowed outage time. The finding had a cross-cutting aspect in problem identification and resolution, corrective action program, P.1(c), because the corrective actions taken to address previous NRC identified concerns in the same manhole did not thoroughly evaluate the problem such that resolutions addressed the causes. |
| 05000280/FIN-2012004-02 | 2012Q3 | Surry | Failure to Follow Operability Procedure for 1B Charging Pump | The inspectors identified a Green noncited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, when licensee personnel failed to implement operability procedure, OP-AA-102, Operability Determinations. Specifically, personnel declared the 1B charging pump on Unit 1 operable for a period of approximately 7 days without adequate supporting technical information when the speed increaser (gearbox) was observed with excessive lube oil foaming to the point where sight glass oil level was not visible and could not be determined. The licensee has entered this issue into their CAP as CR 461276. The inspectors determined that the failure to provide adequate technical information to support the immediate operability declarations of the 1B charging pump, as required by operability procedure, OP-AA-102, Operability Determinations , was a performance deficiency. The inspectors reviewed IMC 0612, Appendix B, Issue Screening and determined that the finding was more than minor because it was associated with the Mitigating Systems cornerstone attribute of Equipment Performance and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the foaming condition and the inadequate operability determinations resulted in both a degradation of pump reliability and affected pump availability. The inspectors also noted that this issue was part of a larger programmatic concern associated with the licensees implementation of its operability process and procedure. The inspectors screened this finding in accordance with IMC 0609, Significance Determination Process, Attachment 4, Initial Characterization of Findings, and IMC 0609, Appendix A, SDP for Findings At-Power , and determined the finding was of very low safety significance, Green, since it was a deficiency determined not to have resulted in the loss of operability or functionality of a single train for greater than its TS allowed outage time. The cause of this finding involved the cross-cutting area of human performance, the component of decision making, and the aspect of using conservative assumptions, H.1(b), because the multiple immediate operability determinations concluding that the 1B charging pump was operable were non-conservative in light of the lack of supporting technical information. |
| 05000338/FIN-2012003-02 | 2012Q2 | North Anna | Examination of SG safe-end weld with possible unqualified ultrasonic examination procedures | The licensee qualified the manual UT procedure in accordance with the EPRI Performance Demonstration Initiative (PDI) process utilizing the PDI procedure IR- 2009-358, for site specific qualification. This process allows for qualification that utilizes a site specific mock-up in an open demonstration process. Although this qualification is used by the industry in meeting the requirements of Appendix VIII of Section XI, there are concerns with the inconsistency with respect to the application of robust, blind demonstration approaches versus less rigorous, and open qualifications. This issue was highlighted as a result of the missed indications at North Anna. The licensee requested that EPRI review (TJ) IR-2009-358 to reassess the current validity of the information provided within this document. With respect to the open demonstration process, EPRI has determined the stated position (of using an open demonstration process) in (TJ) IR- 2009-358 to continue to be acceptable, which is inconsistent with their approach to the use of Code Case N-770, where EPRI requires that a blind demonstration test be passed. This inconsistency needs to be further discussed and a path forward defined in order to develop guidance for application during either type of performance demonstration. In addition, the inspectors and members of the NRR staff conducted on-site evaluations of the site specific UT procedure and inspection technique. This evaluation was conducted on the site specific calibration blocks and with the same UT probes that the licensee used to qualify the UT procedure and the qualification of the NDE technicians. Subsequently, the NRC staff requested Pacific Northwest National Laboratory (PNNL) to evaluate the qualification of the manual UT procedure that was used to examine the safe-end weld. The results were presented in PNNL Report PNNL-21546, Evaluation of Manual Ultrasonic Examinations Applied to Detect Flaws in Primary System Dissimilar Metal Welds at North Anna Power Station, (ML12200A216). This report determined that the site specific approach for the manual UT technique does not meet the intent of the requirements of Appendix VIII of ASME Section XI. Also identified was that the probes used to conduct the site examinations did not meet the procedure requirements of licensee procedure ER-AA-NDE-180 for UT probe angles. This issue remains unresolved until questions associated with the qualification of the UT procedure, including that the probes that did not meet the procedural requirements for UT probe angles and the adequacy of the site specific mock-ups are resolved. This issue is identified as URI 05000338/2012003-02, Examination of SG safe-end weld with possible unqualified ultrasonic examination procedures. |
| 05000281/FIN-2011002-02 | 2011Q1 | Surry | Failure to Determine the Correct Cause and Prevent Recurrence for a Significant Event | A Green, self-revealing finding was identified for the licensees failure to comply with the standards established in their corrective action program (CAP) to determine the correct cause and take corrective action to prevent recurrence (CAPR) for a significant event, specifically, an automatic reactor trip following the failure of a Unit 2 C reactor coolant loop isolation valve. The licensee entered this issue into their CAP as condition report 412345. The inspectors determined that the failure to determine the correct cause and take corrective action to prevent recurrence for a significant event was contrary to the requirements of the licensees CAP procedures and was, therefore, a performance deficiency. The inspectors reviewed IMC 0612, Appendix B, and determined the performance deficiency was more than minor because it adversely affected the equipment performance attribute of the Initiating Events cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. The inspectors reviewed IMC 0609, Attachment 4 and determined that the finding was of very low safety significance, or Green, because it did not contribute to both the likelihood of a reactor trip and the likelihood that mitigation equipment or functions will not be available. The cause of this finding involved the cross-cutting area of problem identification and resolution, the component of operating experience, and the aspect of implementing operating experience, P.2(b), because the licensee failed to implement and institutionalize operating experience. |
| 05000280/FIN-2011002-03 | 2011Q1 | Surry | Failure to Correct Mutiple Conditions Adverse to Fire Protection | A Green, self-revealing non-cited violation of Condition 3.I to the Surry Unit 1 and Unit 2 Updated Facility Operating Licenses, DPR-32 and DPR-37, was identified for the licensees failure to take corrective action for degraded conditions adverse to the fire protection program. The licensee entered this issue into their corrective action program as condition report 398628. The inspectors found that the failure to take action to correct multiple oversized breakers constituted a performance deficiency. The finding is more than minor because it adversely affected the external factors attribute (fire) of the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the Unit 2 1B RWST chiller motor and the Unit 2B hydrogen recombiner breakers were the most susceptible to fire due to their size; also a cable fault could potentially damage safety related cables routed nearby. In addition, the Unit 1 2B charging component cooling water pump is safety related and its cable was also unprotected. The inspectors reviewed IMC 0609, Appendix F, Attachment 1, and determined the category of post fire safe shutdown was affected and the finding required a phase 3 analysis. A phase 3 risk analysis was performed by a regional SRA in accordance with IMC 0609 Appendix F, NUREG/CR6850, NUREG/CR 6850 supplement 1, and utilizing the latest NRC Surry SPAR probabilistic risk analysis model and determined that the risk increase in core damage frequency was <1E-6, a finding of very low risk significance, Green. The cause of this finding involved the cross-cutting area of human performance, the component of work control, and the aspect of work planning, H.3(a), because the licensee failed to appropriately prioritize, schedule, and complete work activities consistent with risk insights and the safety significance of the equipment. |
| 05000280/FIN-2011002-04 | 2011Q1 | Surry | None | 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality shall be prescribed by documented procedures. Contrary to this, the licensee identified that procedure VPAP-0905, Insulation Control Program, Revision 5, was not adequately prescriptive to ensure control of insulation work to avoid critical components. Consequently, the Unit 1 Turbine Driven Auxiliary Feedwater Pump was rendered inoperable and unavailable when the trip throttle valve was inadvertently tripped during replacement of insulation on the pump. The inspectors determined the finding was more than minor because it adversely impacted the Mitigating Systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors determined that the violation was not greater than Green because it did not represent a loss of system safety function or the loss of safety function for a single train for greater than the TS allowed outage time. The inspectors determined that the licensee correctly evaluated the finding and developed appropriate corrective actions as documented in the licensees CAP as CR409949. 10 CFR Part 50.65 (a)(4) requires, in part, that, before performing maintenance activities, the licensee shall assess and manage the increase in risk that may result from the proposed maintenance activity. Contrary to this, the licensee identified that they failed to adequately assess the risk associated with leaving the common ESGR room door open for two hours. The inspectors determined that the finding was more than minor because it adversely impacted the Mitigating Systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The senior reactor analysist determined that this violation was not greater than Green because the increase in core damage frequency was <1E-6, as discussed in Section 4OA5.3. The inspectors determined that licensee correctly evaluated the finding and developed appropriate corrective action as documented in the licensees CAP as CR397720. |
| 05000280/FIN-2010005-04 | 2010Q4 | Surry | Inadequate Risk Evaluation for Leaving Common ESGR HELB Door Open | A licensee identified AV of 10CFR50.65 (a)(4), Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, was revealed after the licensee discovered that 2-BS-DR-21, common emergency switchgear room (ESGR) door was blocked open for two hours without clear communication to licensed operators. The licensee did not adequately assess the increase in operational risk that resulted in the required risk management actions of fire and environmentally qualified watches not being established. The licensee immediately corrected the condition by shutting the HELB door and having security control personnel access. The issue was entered into the licensees CAP as CR397720. The failure to adequately assess the increased risk associated with blocking open the common ESGR door and to take the required risk management actions is a performance deficiency. This finding is more than minor because it is associated with the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, both Unit 1 and Unit 2 plant risk were not evaluated and risk management activities were not put in place when the common ESGR door was blocked open for maintenance and unable to perform its function as a fire barrier, a halon suppression pressure boundary, a main control room pressure boundary, and a HELB boundary. In accordance with IMC 0609, Appendix K, Maintenance Risk Assessment and Risk Management Significance Determination Process, this finding will require a phase 3 analysis. The significance of this finding is to be determined pending completion of the phase 3 evaluation. The inspectors determined that this finding had a cross-cutting aspect in the work control component of the human performance area because the licensee did not appropriately plan work activities by incorporating risk insights (H.3(a)). (Section 1R15.b.2 |
| 05000280/FIN-2010005-01 | 2010Q4 | Surry | Failure to Correct Multiple Conditions Adverse to Fire Protection | A self-revealing apparent violation (AV) of Condition 1.B to the Surry Unit 1 and Unit 2 Updated Facility Operating Licenses, DPR-32 and DPR-37, was identified for the licensees failure to take corrective action for degraded conditions adverse to the fire protection program. Specifically, in 2003-2004, three breakers with loads including the Unit 2 1B Refueling Water Storage Tank (RWST) chiller motor, the Unit 1 2B charging component cooling water pump, and the Unit 2 B hydrogen recombiner were identified as being oversized with respect to the Surry design standard for breaker sizing and cable protection. The failure to take corrective action on the affected breakers led to a fault on the Unit 2 RWST Chiller Motor 1B on October 11, 2010, and a resulting fire which damaged the electrical cable and motor controller. The fire was promptly extinguished by the fire brigade. The licensee entered this issue into the CAP (CR 398628) and isolated the remaining breakers to prevent additional failures. The inspectors found that the failure to take action to correct multiple oversized breakers constituted a performance deficiency. The finding is more than minor because it adversely affected the external factors attribute (fire) of the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the Unit 2 1B RWST chiller motor and the Unit 2 B hydrogen recombiner breakers were the most susceptible to fire due to their size; also a cable fault could potentially damage safety related cables routed nearby. In addition, the Unit 1 2B charging component cooling water pump is safety related and was also unprotected. The inspectors reviewed IMC 0609, Appendix F, Attachment 1, and determined the category of post fire safe shutdown was affected and the finding required a phase 3 analysis. The significance of this finding is to be determined pending completion of the phase 3 evaluation. This finding has a cross cutting aspect in the work control component in the Human Performance area because the licensee did not appropriately plan work activities by incorporating risk insights. Specifically, although work orders were planned in 2006 they were neither prioritized consistent with their safety significance nor scheduled and completed in a timely manner. (H.3(a)). (Section 1R15.b.1 |
| 05000261/FIN-2010004-05 | 2010Q3 | Robinson | Failure to Correctly Implement a Systems Approach to Training for the Licensed Operator Requalification Program | (TBD) The inspectors identified an Apparent Violation (AV) of 10 CFR 55.59(c), Requalification program requirements , for the licensees failure to properly implement elements of a Commission approved program developed using a systems approach to training (SAT), that was implemented in lieu of meeting the requirements defined in 10 CFR 55.59 (c). The finding was entered into the licensees corrective action program as NCR-423232, NCR-423238, and NCR-423239. Corrective actions for this finding are still being evaluated. The licensees failure to properly implement elements of a Commission approved requalification program was a performance deficiency. The finding was determined to be more than minor because it was associated with the Initiating Events Cornerstone and affected the cornerstones objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the failure to implement training requirements for Path-1 and perform adequate retraining of operators that demonstrated areas of weakness during operating tests contributed to operators failure to identify and implement actions to mitigate a loss of seal cooling to the reactor coolant pumps (RCPs) during the events of March 28, 2010. Contrary to Augmented Inspection Team Report 05000261/2010009, further inspection revealed that RCP seal injection was not adequate coincident with a loss of cooling to the thermal barrier heat exchanger to the B RCP. Using Manual Chapter Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, the inspectors determined the finding required a Phase 2 analysis because the finding could result in reactor coolant system (RCS) leakage exceeding Technical Specification limits. The Phase 2 analysis determined that this finding was potentially greater than green; therefore, a Phase 3 analysis is required by a regional senior reactor analyst due to an increase in the likelihood of an RCP seal LOCA. The significance of this finding is designated as To Be Determined (TBD) until the safety characterization has been completed. The cause of this finding was directly related to the cross cutting aspect of Personnel Training and Qualifications in the Resources component of the Human Performance area, in that the licensee failed to ensure the adequacy of the training provided to operators to assure nuclear safety. |
| 05000261/FIN-2010004-03 | 2010Q3 | Robinson | Deficiencies in Non Safety-Related Cable Installation Result in Fire and Reactor Trip | A self-revealing Green finding was identified for the licensees failure to adequately follow guidance in a design change package for the installation of non safetyrelated 4kV cables. This resulted in cables with design features inappropriate for the application being installed and eventually led to a fire and a reactor trip. Specifically, the licensee failed to follow the cable vendor recommendations and a self-imposed administrative requirement/standard for cable installation contained in cable specification L2-E-035, Specification for 5,000 Volt Power Cable. The licensee entered this into the CAP as NCR 390095. As corrective actions, the licensee replaced the cable, conduit and other damaged equipment, including evaluation on damage to cables in overhead, and the feeder cables to station service transformer (SST) 2E and 4kV bus 5. The failure to follow the guidance in the design change package to install non safetyrelated cables between Bus 4 and Bus 5 in accordance with their design change program and vendor and cable installation specifications was a performance deficiency. This finding was determined to be more than minor because it affected the Initiating Events Cornerstone objective of limiting events that upset plant stability, and was related to the attribute of Design Control (i.e., Plant Modifications). Specifically, the inadequate cable modification was determined to be the root cause of the reactor trip that occurred on March 28, 2010. This deficiency also paralleled Inspection Manual Chapter 0612, Appendix E, Example 2.e, as the licensee did not follow their own administrative requirements and vendor recommendations for cable installation. The performance deficiency was screened using Phase 1 of Inspection Manual Chapter 0609, Significance Determination Process, which determined that because the finding increases the likelihood of a fire, a Phase 3 SDP analysis was required. A phase 3 SDP risk evaluation was performed by a regional senior reactor analyst in accordance with the guidance in IMC 0609 Appendix F utilizing the NRCs Robinson SPAR model. The Phase 3 analysis determined the finding to be of very low safety significance (Green) because the core damage frequency increase was less than 1E-6. There is not a crosscutting aspect associated with the finding because the performance deficiency involving the cable installation occurred greater than 20 years ago and does not reflect current licensee performance. |
| 05000261/FIN-2010004-04 | 2010Q3 | Robinson | Failure to Establish an Adequate PATH-1 Emergency Operating Procedure | (TBD) The inspectors identified an apparent violation (AV) of Technical Specifications (TS) 5.4.1, Procedures , for the licensees failure to establish and maintain an adequate emergency procedure that ensured reactor coolant pump (RCP) seal cooling was maintained following a reactor trip. The licensee has entered this into the CAP as nuclear condition report (NCR) 423147. Corrective actions for this finding are still being evaluated. The failure to establish and maintain an emergency procedure that would ensure adequate reactor coolant pump seal cooling, preventing seal degradation and a possible seal LOCA was a performance deficiency. The finding is more than minor because it is associated with the Initiating Events Cornerstone and affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations, specifically a loss of seal cooling to prevent the initiation of a RCP seal loss of coolant accident (LOCA). Using Manual Chapter Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, the inspectors determined the finding required a Phase 2 analysis because the finding could result in RCS leakage exceeding Technical Specification limits. The Phase 2 analysis determined that this finding was potentially greater than green; therefore, a Phase 3 analysis is required by a regional senior reactor analyst due to an increase in the likely hood of an RCP seal LOCA. The significance of this finding is designated as To Be Determined (TBD) until the safety characterization has been completed. The cause of this finding had a cross-cutting aspect of Documentation, Procedures, and Component Labeling, in the Resources component of the cross-cutting area of Human Performance, in that the licensee failed to ensure procedures for emergency operations were adequate to assure nuclear safety. |
| 05000261/FIN-2010004-02 | 2010Q3 | Robinson | Failure to Design and Implement a Simulator Model that Demonstrated Reference Plant Response | A self-revealing Green NCV of 10 CFR 55.46(c), Simulation Facilities, was identified for a plant referenced simulator used for administration of operating tests not correctly modeling the reference plant. A loss of electrical power that resulted in a loss of component cooling water (CCW) to the reactor coolant pump seals was not properly modeled in the simulator. When power to safety-related 480 volt bus E-2 was transferred to the emergency diesel generator in the reference-plant, FCV-626, thermal barrier heat exchanger outlet isolation flow control valve, closed. The simulator modeled FCV-626 to respond to CCW flow through the valve and did not model the effect of a loss of power to the valve operator and associated control circuit. Consequently, with a loss of power to bus E-2, the simulator model allowed this valve to remain open. The licensee documented the issue in Significant Adverse Condition Investigation Report, 390095. As corrective action the licensee changed the simulator modeling to match the plant configuration. The inspectors determined that the failure of the simulator to accurately demonstrate reference plant response was a performance deficiency. This finding was more than minor because it affected the human performance attribute of the initiating events cornerstone in that the unexpected closure of FCV-626 raises the likelihood of human error in response to a loss and subsequent re-energization of the E-2 Bus. This could challenge reactor coolant pump seal cooling and result in reactor coolant pump seal failure. The finding was evaluated using the Operator Requalification Human Performance SDP (MC 0609, Appendix I) because it was a requalification training issue related to simulator fidelity. The finding was of very low safety significance (Green) because the discrepancy did not have an impact on operator actions resulting in a total loss of RCP seal cooling and subsequent increase in reactor coolant system (RCS) leakage. There is not a cross-cutting aspect associated with the finding because the performance deficiency involving the simulator modeling occurred over 3 years ago and does not reflect current licensee performance. |
| 05000261/FIN-2010004-01 | 2010Q3 | Robinson | Failure to Have Adequate Work and Post Maintenance testing Instructions for the Volume Control Tank Comparator Module | A self revealing Green finding was identified for a failure to have adequate work orders to properly configure and post maintenance test the volume control tank (VCT) level comparator module. The licensees procedure ADM-NGGC-0104, Work Implementation and Completion, required that work orders contain all work activities necessary to perform all related work activities including Post Maintenance Testing (PMT). The licensees work orders for installing a jumper on the VCT level comparator module and for post maintenance testing failed to contain adequate instructions to properly configure (place jumper in correct location) and post maintenance test the volume control tank level comparator module. This resulted in the failure of the charging pump suction to automatically transfer from the volume control tank to the refueling water storage tank (RWST) when the auto transfer VCT low level setpoint was reached. The licensees identified corrective actions included repairing the subject VCT level module, reviewing the adequacy of other replacement NUS modules that have nonsafety control functions and revising the site specific PMT procedures to provide more specific guidance for ensuring that the control loop circuit is adequately tested. The failure to have adequate work order instructions to properly configure and post maintenance test the volume control tank level comparator module is a performance deficiency. This finding is greater than minor because the failure to auto transfer from the VCT to the RWST could cause a failure of the charging pump, resulting in the loss of seal injection which is a precursor to a seal LOCA. Using IMC 0609, Significance Determination Process, (SDP) Phase 1 Worksheet, the inspectors concluded that a Phase 2 evaluation was required since the finding could have likely affected other mitigation systems resulting in a total loss of their safety function. This issue was evaluated using IMC 0609, Appendix A (SDP Phase 2) as being potentially greater than green with loss of component cooling water (LOCCW) and loss of service water (LOSW) as the dominant sequences. A phase 3 SDP risk evaluation was performed by a regional senior reactor analyst in accordance with the guidance in IMC 0609 Appendix A utilizing the NRCs Robinson Standardized Plant Analysis Risk (SPAR) model. The VCT level comparator module performance deficiency resulted in a core damage frequency increase of less than 1E-6, Green. The risk was mitigated by the availability of the letdown and normal makeup charging pump suction sources, which would be available under certain conditions reducing the likelihood of an autoswap demand. Another factor which mitigated the risk is that the fire shutdown procedures for most fire areas specify use of a manual RWST supply valve. The performance deficiency is characterized as Green, a finding of very low safety significance. This issue has a cross-cutting aspect in the resources component of the human performance area because the licensee did not provide complete, accurate, and up-to-date work packages for the configuration and testing of the VCT comparator module. |
| 05000261/FIN-2010009-05 | 2010Q2 | Robinson | Corrective Action for Operating Crew Performance Issues | To assess the extent of condition for the operator performance issues demonstrated during this event, the team reviewed a sample of simulator crew evaluation forms spanning the period of February 2008 to February 2010. The team identified multiple examples of operating crew weaknesses identified by training, relative to monitoring and control of major plant parameters. Of the six packages reviewed, four contained comments summarized as follows: February 27, 2008 unaware of steam dumps open; no attempt at RCS temperature control March 3, 2008 crew not clear if steam dumps actuated February 19, 2009 pressurizer level control post-trip was not anticipated; S/G level control needed improvement February 24, 2009 slow to identify steam dump malfunction; post- trip trends of associated parameters not provided The team noted that even though the evaluations highlighted the operators responsibility for monitoring and controlling major plant parameters, this emphasis was not effective in achieving the level of performance necessary to stabilize the plant following the uncontrolled cooldown that occurred during this event. The team concluded that additional inspection is warranted to determine if the licensees corrective action program is effective in capturing and addressing operating crew performance weaknesses. The team noted that the licensee also identified this issue regarding operating crew performance standards as part of their event investigation. This review will also determine if this issue represents a performance deficiency. An Unresolved Item will be opened pending completion of this review. The URI is identified as 05000261/2010009-05, Corrective Action for Operating Crew Performance Issues. |
| 05000261/FIN-2010009-02 | 2010Q2 | Robinson | RCS Cooldown Rate Exceeds Technical Specification 3.4.3 limit | Through a review of plant data, the team determined that the crews response to the first event was not effective in stabilizing the plant. Through interviews and review of plant data, the team determined that the crew did not recognize the magnitude of the RCS cool down caused by an on-going steam demand. The RCS cool down rate exceeded the limit of 100o/hr in any one hour period as specified in Technical Specification (TS) 3.4.3, RCS Pressure and Temperature (P/T) Limits. The fact that the RCS cooldown rate exceeded the limiting value specified in TS 3.4.3, and the requirement to evaluate the actions contained in TS 3.4.3, was not recognized by the crew at any time during or after the cooldown. Based on interviews, the Reactor Operator (RO) and Control Room Supervisor (CRS) assessed the cool down rate as being consistent with what was experienced during simulator training for an RCP trip followed by a reactor trip. The RCS cool down continued until Instrument Bus 3 was inadvertently de-energized (approximately 33 minutes after the start of the first event), which caused the MSIVs to close, isolating the steam generators from the steam header. Based on the sequence of events, a review of plant data, and operator interviews, the team concluded that the crew did not recognize that VCT level was decreasing, a low VCT level alarm had annunciated, and automatic swapover of the charging pump suction from the VCT to the RWST failed to occur, until indicated level in the VCT had decreased to approximately 2-3 inches and charging flow had degraded. Once the crew identified this condition, the RO attempted to manually align the suction of the charging pumps to the RWST but made an error when performing the alignment. The error left the suction of the charging pumps aligned to the VCT. The Shift Technical Advisor (STA) determined the alignment was incorrect and the RO corrected the error. The crew did not reference APP-003-E3, VCT HI/LO LVL, which provided direction to manually transfer the charging pump suction to the RWST. RCP seal cooling was maintained because the crew reopened FCV-626 to restore CCW cooling to the RCP thermal barrier heat exchanger approximately 6 minutes before depletion of the VCT. However, high pump bearing temperature alarms were received on all three RCPs. The high temperature alarms subsequently cleared after operators reopened FCV-626. Based on operator interviews, the team concluded that, following implementation of Emergency Operating Procedures (EOPs), the operators did not complete a satisfactory review and evaluation of alarm conditions prior to the second event. Instead, the operating crew entered GP-004, Post Trip Stabilization, and attempted to reset the generator lockout relay without using the information in the Annunciator Panel Procedures (APPs) to completely and accurately assess abnormal electric plant status. GP-004 is a normal operating procedure and is written with the assumption that the plant is in a normal (undamaged) configuration. The crew was not aware that a sudden pressure fault signal from the UAT was still applied to the generator lockout circuit logic, as indicated by a locked in UAT fault trip alarm (APP-009-B6, AUX TRANSF FAULT TRIP). The attempted reset reenergized Bus 4 and caused a fault at breaker 52/24, initiating the sequence for the second fire. The team concluded that if the crew had performed a thorough control board walkdown, additional electric plant APPs and/or AOPs could have been identified and implemented before exiting to a normal operating procedure (GP-004). Additional review by the NRC will be required to determine if the licensees programs resulted in untimely identification and investigation of abnormal plant parameters and unexpected main control room alarms. This review will also determine whether the crews monitoring of plant parameters and alarms, and use of associated procedures, represents a performance deficiency. An Unresolved Item will be opened pending completion of this review. The URI is identified as 05000261/2010009-01, Monitoring of Plant Parameters and Alarms. Additionally, further review by the NRC will be required to determine if the RCS cooldown rate exceeding the limiting value specified in TS 3.4.3 represents a performance deficiency. An Unresolved Item will be opened pending completion of this review. The URI is identified as 05000261/2010009-02, RCS Cooldown Rate Exceeds Technical Specification 3.4.3 Limit. |
| 05000261/FIN-2010009-03 | 2010Q2 | Robinson | Utilization of operators During Events Requiring Use of Concurrent Procedures | Through interviews, the team determined that the Balance of Plant (BOP) operator concurrently performed Abnormal Operating Procedure (AOP)-041, Response to Fire Event, during the first event. The team observed that AOP-041 contains numerous steps to coordinate on-site and off-site fire brigade response and notifications. The team determined that having a licensed operator perform AOP-041, concurrent with the CRS and RO performing emergency operating procedures, is a licensee expectation in accordance with OMM-022, Emergency Operating Users Guide. Through interviews, the team determined that because the BOP operator was performing AOP-041, he was unavailable to assist the control room team in recognizing and diagnosing off-normal events and conditions for approximately the first 30 minutes of the first event. During interviews, the two operators responsible for panel operation (the RO and CRS) consistently noted the unavailability of a third person (the BOP licensed operator) to perform independent panel checks. The team noted that during conditions of minimum manning, using the BOP operator to concurrently perform certain AOPs may hinder or prevent him or her from assisting the CRS and RO in stabilizing the plant during events that challenge the control room crew. Additional review by the NRC will be needed to determine if the licensees utilization of operators, during conditions of minimum control room manning, is adequate during complex events. This review will also determine if this issue represents a performance deficiency. An Unresolved Item will be opened pending completion of this review. The issue will be identified as URI 05000261/2010009-03, Utilization of Operators During Events Requiring Use of Concurrent Procedures. |
| 05000261/FIN-2010009-04 | 2010Q2 | Robinson | Fidelity of Plant-Referenced Simulator | A review of simulator performance and event data by the team confirmed one simulation deficiency which had been identified by the licensee as part of their event review. When power to safety-related 480 volt Bus E-2 was transferred to the emergency diesel generator, FCV-626 (thermal barrier heat exchanger outlet isolation flow control valve) closed unexpectedly. As discussed in more detail in the Section 4.5, Unexpected Closure of FCV-626, the as-built plant configuration resulted in the valve closing on a loss of power. This response was not obtained in the simulator because the simulator modeling of FCV-626 was based solely on CCW flow through the valve and did not take into account power to the valve operator and associated control circuit. Consequently, in simulator scenarios which included a loss of power to Instrument Bus 4, this valve remained open. Because the plant reference simulator did not demonstrate expected plant response for a loss of Instrument Bus 4, the team identified the need for additional NRC review to determine the adequacy of fidelity of the plant reference simulator for conducting loss of component cooling system control manipulations and plant evolutions. This review will also determine if this issue represents a performance deficiency. An Unresolved Item will be opened pending completion of this review. The URI is identified as 05000261/2010009-04, Fidelity of Plant-Referenced Simulator. |
| 05000261/FIN-2010009-07 | 2010Q2 | Robinson | Loss of Seal Water Results in Failure of the A Main Condeser Vacuum Pump | The team observed that procedure GP-004 Post Trip Stabilization contained a step to reset the generator lockout relays but did not contain steps, cautions, or notes that prompt operators to ensure the inputs are clear prior to attempting a reset. Although AOP-024, Loss of Instrument Buses was not used, and was not required to be used per the licensees procedure use guidelines during this event, the team noted that the procedure does not address the effect of a loss of an instrument bus on the main steam flow channels that input into the Main Steam Line Isolation Signal. Additionally, AOP-024 does not address the loss of CCW flow to the RCP thermal barrier heat exchangers (FCV-626 closure). The team reviewed the circumstances which resulted in the fire in and subsequent failure of the A Main Condenser Vacuum Pump. The pump failed because seal water to the pump, which is supplied by demineralized water, was lost for approximately three and a half hours prior to the pump failure. The loss of power following the first fire caused the loss of demineralized water. The Main Condenser Vacuum Pump establishes and maintains condenser vacuum to provide a heat sink used for decay heat removal following a reactor trip. The team observed that the licensee does not have a procedure to address loss of seal water makeup to the main condenser vacuum pumps. Use of such a procedure could have prevented the fire and associated damage to this equipment. As a result of this observation, the team identified the need for additional NRC review to determine if procedures should have been available to address a sustained loss of seal water makeup to the main condenser vacuum pumps. Additional review by the NRC will be needed to determine whether the lack of a procedure for loss of seal water to the main condenser vacuum pumps is a performance deficiency. An Unresolved Item will be opened pending completion of this review. The URI is identified as 05000261/2010009-07, Loss of Seal Water Results in Failure of the A Main Condenser Vacuum Pump. |
| 05000261/FIN-2010009-08 | 2010Q2 | Robinson | Deficiencies in Non Safety-Related Cable Installation | To determine the circumstances surrounding the fault in the cable that led to the first electrical disturbance and subsequent reactor trip, the team performed the following activities: Determined details of the cable construction including conductor size, insulation thickness and material, and type of shielding using the manufacturers data sheet Compared the cable construction to system requirements and standard industry practice Reviewed relevant portions of the plant modification that installed the cable Viewed the site of the cable fault Reviewed cable records to determine where other similar cables are installed in the plant Interviewed engineering staff involved with the electrical distribution systems and components Reviewed the licensees causal analysis for the cable fault Evaluated the licensees proposed corrective actions The cable that faulted did not meet many of the specifications for the design change that installed the cable. This contributed to the cable failure. The cable, manufactured by the Rome Cable Corporation (Rome), was installed in 1986 when 4 kV Bus 5 was installed as an extension of Bus 4 per Plant Design Change Number DCN-851. The cable, identified as C21344A, served as the interconnection between 4 kV Buses 4 and 5 and was comprised of two conductors for each of three phases. The cable was installed in two steel conduits, with each conduit containing all three phases. As noted in Section 2.1, all 4 kV buses at Robinson are non safety-related. The Bill of Materials for DCN-851 indicated that the cable should be in accordance with Standard Specification L2-E-035 for 5,000 Volt Power Cable. However, the Bill of Materials did not indicate a purchase order number for the cable that faulted, as it did for other cables installed by the modification, such as 3/c No. 12 AWG cable. Records reviewed by the team indicated that the cable came from reel number HBR-13505. Differences between Standard Specification L2-E-035 and the actual installed Rome cable are listed below: L2-E-035 called for coated copper conductors. The installed cable had uncoated conductors. L2-E-035 called for all cables to be provided with an outer jacket. The installed cable did not have a jacket. L2-E-035 called for cable insulation and jacketing that was self-extinguishing and non-propagating with regard to fire as described in IEEE 383-1974, Type Test of Class 1E Electric Cables, Field Splices, and Connections for Nuclear Power Generating Stations. The Rome catalogue data made no claim as to fire propagation properties. The event demonstrated that the cable lacked fire propagation properties because 1) the cable ignited following the fault, 2) the cable did not self extinguish after the fault was denergized, and 3) flame was propagated along the cable. L2-E-035 called for 133 percent insulation level and insulation shielding if specified in the purchase order. The installed cable did not have either of these features. The cable consisted of single conductor 500 MCM uncoated copper with 130 mils of cross-linked polyethylene insulation rated for continuous operation at 5 kV and 90 degree Celsius. The insulation thickness was determined from the overall cable diameter and from the licensees measurement of conductor diameter. The manufacturers catalogue information (SPEC 7155 dated January 1, 1991) stated that an insulation thickness of 120 mils is suitable for applications requiring 100 percent insulation levels. However, due to the high-resistance grounding scheme used on the Robinson 4 kV electrical system, an insulation level of 133 percent or 173 percent was required, depending on how long a ground fault could remain on the system. The significance of not having adequate insulation thickness was that, should a single line to ground fault occur the voltage on the two un-faulted phases would exceed the rating of the insulation. The cable did not have a jacket. The significance of not having a jacket was that the cable insulation was more vulnerable to damage during installation. Also, the jacket, if installed, would have provided a buffer between the insulation and grounded metal parts, such as the conduit or bus enclosure. The cable did not have an insulation shield. When an insulation shield is not installed, the electric field will be partly in the insulation and partly in whatever lies between the insulation and ground. This situation could be conducive to corona if a thin layer of air lies between the insulator surface and ground, which can lead to insulation deterioration. IEEE 666-1991, Design Guide for Electric Power Service Systems for Generating Stations, Section 12.3.6 states: Power cables rated 5 kV and over should be equipped with insulation shield. The significance of not having a grounded insulation shield was that voltage stress on the insulation was not symmetrical and uniform around the circumference, but rather greater at points where the insulation contacted a grounded surface, such as a metal conduit, than at other points around the circumference. The following information indicated that shielded cable was originally intended for this cable: 1) Design Change Notice No. 6 to DCN-851 changed the termination detail from one depicting the grounding of shield wires to one with no shield wires, and 2) installation instruction 4.35 directed installation of a stress cone for cable C21344A, which would be needed only for a shielded cable. Cognizant licensee engineers stated that the Rome cable installed as part of the Bus 5 modification was different than other 4 kV cable installed at Robinson and was used only for the Bus 4 to Bus 5 connection and the feeder from Bus 5 to station service transformer 2E. During the inspection, the licensee did not present any documentation explaining or justifying why the installed cable for the Bus 5 modification was different than Standard Specification L2-E-035 and the typical cables installed in the plant. The team reviewed the 4 kV cables connected to Buses 1 through 5, and found this statement to be correct. All the 4 kV cables connected to Buses 1 through 5, except for the two cables mentioned above, met or exceeded standard specification L2-E-035, with at least 133 percent insulation and insulation shield. In addition to construction details of the faulted cable, the team reviewed various design considerations related to the cable. The ampacity of two 500 MCM, 90 degree Celsius, cables installed in conduit in free air is 954 amperes. The team estimated the maximum continuous load on Bus 5 as 493 amperes; 216 amperes for the 1750 HP Circulating Water Pump and 277 amperes for the 2000 kV station service transformer. The overcurrent relays were set at 1000 amperes. Therefore, the cables were not overloaded during normal operation. The conduits were the correct size for the cables installed within them. The number of bends in the conduits did not exceed the recommended maximum number of bends. Therefore, pulling tension limits should not have been exceeded during installation. This did not preclude the possibility that the three single conductors became twisted as the cable was pulled through three 90 degree bends. The licensees Event Review Team (ERT) visually examined the faulted cable and the station service transformer 2E feeder cable and determined the three single conductors were twisted. Twisting of one conductor around the other two conductors could result in jamming of the cables in the conduit since the combined diameter of the twisted cables would be greater than the inside diameter of the conduit. The twisting would have led to excessive pulling force being applied during cable installation. The required pulling force is proportional to the side wall pressure exerted on the cable at a bend. Because of the extensive damage resulting from the length of time the fault was energized, the failure mechanism could not be determined with absolute certainty. The licensees causal analysis determined with a fair degree of certainty that the initial fault occurred at a point where the conduits terminate at the top of Bus 5 switchgear. After consideration of the above facts and review of the licensees causal analysis, the team concluded that the failure mechanism probably involved one or more of the following factors: Degradation of the insulation at the surface of the cable due to corona Damage to the insulation due to inadvertent twisting of the three conductors during the pulling-in process resulting in excessive side-wall pressure at one or more of the three 90 degree bends in the conduit Rubbing of the cable against the conduit or switchgear top plate due to turbine building vibration A secondary fault at the Bus 4 cable compartment for circuit breaker 52/24 was caused by plasma gas migrating inside the conduit and through a hole in the conduit seal, along with terminations that were not taped. The ERT postulated that the hole was caused by pressure built up in the conduit as a result of the fault. The ERT further postulated that this secondary fault at circuit breaker 52/24 created permanent degradation of the insulation at that location. All of the cable within the compartment was completed destroyed when Bus 4 was reenergized about four hours after the initial fault was cleared. The licensee stated that corrective actions related to the cable failure would be to replace the Rome cable feeding station service transformer 2E before plant startup. The licensees Significant Adverse Condition Investigation Report for the event states that a search, using catalog identification numbers, was made across the Progress Energy fleet for this type of cable or similar cable and none was found. The licensee did not believe revisions were needed to the design control process because the process had been changed earlier to preclude the problems described herein, i.e. lack of proper control over purchasing and field changes. The team concluded that the apparent root cause of the initial cable failure and subsequent associated short-circuits was poor quality control over the non-safety-related modification process for installing the cable. A cable of lesser quality than other 5 kV cables installed throughout the plant was installed as a substitute during this modification. The cable terminations were not taped and the cable was not restrained to prevent rubbing. The consequence of the cable fault was a reactor trip. Because of the magnitude of the electrical fault, the reactor trip would have occurred regardless of whether bus tie circuit breaker 52/24 was fully functional. The resultant voltage transient decreased RCP speed which lowed RCS flow and initiated a reactor trip. This occurred faster than the time delay overcurrent protective relays associated with circuit breaker 52/24. Additional review by the NRC will be needed to determine whether the cable installation represents a performance deficiency. An Unresolved Item will be opened pending completion of this review. The issue will be identified as URI 05000261/2010009-08, Deficiencies in Non Safety-Related Cable Installation. |
| 05000261/FIN-2010009-09 | 2010Q2 | Robinson | Failure to Repair Circuit Breaker 52/24 Resulting in Breaker Being Unable to Operate | Circuit breaker 52/24 is the non safety-related tie circuit breaker between 4 kV Bus 4 and Bus 5. Following an electrical fault on cabling between this breaker and Bus 5 as described in Section 4.1, the breaker failed to open to clear the fault due to a lack of control power. The team reviewed equipment records related to circuit breaker 52/24 and determined that Work Request 357740 was written in November 2008 to repair the closed position indicating light located on the front of the circuit breaker. Because the closed position light would not illuminate after the light bulb was replaced, licensee personnel assumed the problem involved the socket for the bulb. Although the licensee had subsequently developed a work order to repair the socket, the licensee had not performed any additional repairs up to the time of the event. A number of opportunities existed to identify the source of the problem, including additional work requests and walkdowns by the system engineer. The additional work requests were canceled to the work order and the system engineer failed to recognize the potential impact of the failed indicating light regarding breaker operation. Following the event, the licensee determined that one of the control power fuses in the breaker trip circuit was failed. Laboratory examination by the licensee revealed that the fuse had a cracked internal element. The licensees ERT found that the overcurrent relays and the circuit breaker were fully functional. The failed fuse caused the breaker trip circuit to be deenergized, resulting in the indicating lamp being off and preventing the circuit breaker from tripping. Operations, Maintenance, and Engineering personnel did not fully understand the significance of the deenergized breaker indicating light. Operations personnel did not request an engineering assessment when they reviewed the work order. However, because station engineering was independently aware of the condition, it is not evident that a request for an engineering assessment would have resulted in a different outcome. The broken fuse, style LPN-RK-30SP, was manufactured by Bussman Division of Cooper Industries. As part of their corrective actions for this problem, the licensee checked the resistance of 16 fuses of the same style to determine whether any incipient degradation was taking place. The tested group included in-service fuses of various sizes as well as three new fuses. The licensee determined all the fuses had acceptable resistance readings. The licensee stated they would also provide training to appropriate plant personnel regarding this event and expectations for response to circuit breaker indicating lamps being off when they should be on. (Note: On April 14, 2010, the NRC issued Information Notice 2010-09, Importance of Understanding Circuit Breaker Control Power Indications, which described the problem with circuit breaker 52/24 control power). Section 4.1 states that, because of the high magnitude of the fault current, a reactor trip would have occurred as a result of the March 28 event, regardless of whether circuit breaker 52/24 was fully functional. However, for potential faults resulting in smaller currents, proper operation of circuit breaker 52/24 would prevent a reactor trip. The team concluded the licensee failed to understand the possible implications of circuit breaker 52/24 indicating light being off and should have pursued the issue in a timely manner. The problem existed for approximately 17 months until this event revealed the circuit breaker was unable to isolate a fault condition. Additional review by the NRC will be needed to determine whether the failure to correct, in a timely manner, a problem with the indicating light for circuit breaker 52/24 and the underlying problem with the control power fuse represents a performance deficiency. An Unresolved Item will be opened pending completion of this review. The issue will be identified as URI 05000261/2010009-09, Failure to Repair Circuit Breaker 52/24 Resulting in Breaker Being Unable to Operate. |
| 05000261/FIN-2010009-06 | 2010Q2 | Robinson | Adequacy of Emergency Operating Procedure Background Documents | From interviews, the team determined that the control room operators, in responding to the event, relied exclusively on actions and guidance explicitly described in EOPs. The operators did not consider mitigating actions that would have stabilized the plant that were not explicitly contained in these procedures, such as shutting the MSIVs. The emergency procedures being implemented centered on the Path-1 EOP. From a review of the plant procedures used by operators to respond to this event, the team determined that certain Path-1 procedure steps required operators to rely on their knowledge because these steps did not contain detailed (rule-based) guidance. The team observed that Path-1 is a flow diagram that assists with diagnostics but does not consistently provide acceptance criteria and alternate actions. The team determined that, in general, implementation of the Path-1 EOP relies more heavily on operator knowledge-based behavior versus the rule-based behavior emphasized in WOG Emergency Response Guidelines. The team noted that common industry practice among Westinghouse technology plants is to utilize a two-column page format for EOPs and to also provide more explicit detail regarding specific parameters to be checked and specific components to manipulate within each step. The team observed that EOPs did not contain explicit guidance to fully isolate ongoing steam flow in all cases. For example, End Path Procedure (EPP) Foldout A Step 6 MSR Isolation Criteria does not contain additional contingency actions in the event the specified action cannot be taken or is not effective (i.e. loss of power to MSR steam supply valves). During interviews, operators stated that they had been trained in the simulator to send local operators to close MSR valves as a contingency action. However, this action is not listed in the Foldout A procedure and no additional or alternate action that could be performed from the control boards, such as closing the MSIVs, is specified. Additionally, Path-1 Turbine Tripped does not contain additional steps that operators might be reasonably expected to take in order to accomplish the intent of the step, such as closing the MSIVs, in the event that the specified contingency actions of manually tripping the turbine and running back the turbine are not successful. The team also identified an inconsistency between the Path-1 Basis Document and the licensees emergency operating procedure users guide regarding the immediate operator action of SI Initiation. Path-1 EOP does not explicitly list parameters or conditions to be checked in order to determine if a safety injection is required (requiring both the operator performing the immediate action and the CRS who is reading the procedure to rely on their knowledge). However, the Path-1 Basis Document provides an interpretation of this step that states, in part, that a safety injection is required if RCS inventory is decreasing in an uncontrolled manner and exceeding all available makeup flow. OMM-022, Emergency Operating Procedures Users Guide Section 8.3.1, Item 10, lists parameters and values that operators are expected to check when performing this immediate action step. The team noted that this step in OMM-022 does not specify checking RCS parameters directly related to RCS inventory, such as pressurizer level, as described in the Path-1 basis document. The team reviewed plant data from the first event and determined that pressurizer level decreased off-scale. Based on interviews, the team also determined that operators did not recognize the magnitude and rate of the pressurizer level decrease caused by the ongoing RCS cool down. Consequently, the team identified the need for additional NRC review to determine the adequacy of OMM-022 with respect to the immediate operator action of checking whether a safety injection is required. This review will determine whether the inconsistency between the Emergency Operating Procedures Users Guide and the Path-1 Basis Document is a performance deficiency. An Unresolved Item will be opened pending completion of this review. The URI is identified as 05000216/2010009- 06, Adequacy of Emergency Operating Procedure Background Documents. |
| 05000261/FIN-2010009-10 | 2010Q2 | Robinson | Failure of Charging Pump Suction Valves to Automatically Transfer Due to Errors in Implementing a Instrumentation Component Upgrade | Following the cable fault and resultant reactor trip, VCT level decreased and reached a low level set point that should have automatically transferred the suction source for the running charging pump to the RWST. The transfer did not take place as designed. The control circuitry which implements this transfer utilizes two VCT level transmitters. When each transmitter senses a low level, it energizes a relay via a comparator. When both relays are energized, and their contacts are closed, the circuit for opening the charging pump suction from RWST valve (LCV-115B) should be made up and the valve should open. Then, when LCV-115B opens, a signal is generated to close the VCT suction valve (LCV-115C.) One of the relays in the LCV-115B circuit was driven by an older style Hagan level comparator, and the other relay was driven by a newer style NUS comparator. Different NUS comparator configuration options, such as electromechanical relay or solid state output, can be made by placing plug-type jumpers at different locations on the circuit board. The licensees post-event troubleshooting revealed that the NUS comparator was not properly configured when it was installed in 2008. The NUS comparator should have been configured to have its output function operate in the solid state mode and energize the control relay when a low level was sensed. When the comparator was configured in 2008, the placement of jumpers resulted in an electromechanical relay output, which was only capable of de-energizing the control relay upon low level. As a result, the control relay driven by the NUS comparator was in the energized state when level in the VCT was normal. When level in the VCT decreased below the level at which the suction to the charging pumps should have transferred, the associated valves did not reposition because the relay driven by the NUS comparator was de-energized and the valve open circuit was not made up. The licensee did not detect the incorrect configuration of the NUS comparator after installation because of the limited scope of the post-installation testing. When the new comparator module was calibrated the bistable trip light responded as intended, satisfying the test acceptance criterion. The output contacts were not checked during the calibration and the licensee did not perform an integrated test, such as simulating a low VCT level, to confirm the two valves repositioned. The licensee replaced the VCT level Hagan comparator with an NUS comparator as part of a larger project to provide a replacement for obsolete Hagan comparators. Licensee engineers stated that about 80 percent of the Hagan comparators had been replaced with NUS comparators at the time of the AIT inspection. The team questioned the extent of condition for potential similar errors in replacement comparators, i.e. incorrect placement of jumpers and inadequate testing for detecting errors. The licensee noted that comparators used to perform reactor protection system functions, safety injection functions and certain other functions were subject to Technical Specification surveillance testing, which provided a check of the comparator output contacts. The licensee also pointed out that the circuit in question may have been unique in that only one of the comparators used in the two-out-of-two logic had been changed to the new NUS module. If two NUS modules had been installed, both containing the incorrect configuration for the jumpers, the transfer from VCT to RWST suction would have taken place with a normal VCT level and the problem would have been self revealing. The licensee stated that many control functions using the new NUS modules would alarm when the bistable actuates, making a similar problem self revealing. The licensee controlled the substitution of NUS comparators for Hagan comparators under the plant modification process using Engineering Evaluation EE-92-144. The licensee controlled component removal and installation within the maintenance process. The installation of the comparator for the charging pump suction transfer control circuit was accomplished under Work Order 011162348 in September 2008. Work order instructions directed an I&C technician to refer to the calibration procedure to determine the desired comparator configuration and refer to NUS instruction book EIP-M-DAM800 to determine the placement of jumpers necessary to implement that configuration. The placement and removal of jumpers was translated to work instructions which were reviewed and verified by an I&C system engineer. The licensee stated their planned corrective actions would include a review of all control circuits incorporating NUS comparators to confirm these circuits will operate properly. In cases where a review indicates proper operation cannot be assured, the licensee stated that appropriate testing will be performed. In addition, the process for implementing any future NUS comparator installations will be strengthened to preclude the problems described above. The team determined the failure of the suction for the charging pumps to automatically transfer from the VCT to the RWST upon low level in the VCT was caused by an error in the work instructions describing the placement of jumpers when a VCT level comparator was replaced. Additionally, the licensees post-maintenance testing was not adequate to detect the problem. Additional review by the NRC will be needed to determine whether these problems represent a performance deficiency. An Unresolved Item will be opened pending completion of this review. The issue is identified as URI 05000261/2010009-10, Failure of Charging Pump Suction Valves to Automatically Transfer Due to Errors in Implementing an Instrumentation Component Upgrade. |
| 05000261/FIN-2010009-11 | 2010Q2 | Robinson | FCV 626, RCP Thermal Barrier Outlet Isolations CCW Valve, Unexpected Closure | Valve FCV-626 is located in the combined CCW return from the three RCP thermal barrier heat exchangers. In its normal open position it allows CCW flow to pass through the thermal barrier heat exchangers, providing backup cooling to the RCP seals in the event of a loss of the primary cooling flow (seal injection) from the charging pumps. There are two close functions for FCV-626: 1) closes on high flow in the return line which is indicative of a rupture of a thermal barrier heat exchanger (RCS to CCW system leak) and 2) closes in response to a Phase B containment isolation signal. The valve has no automatic opening functions. The valve closed when power to safety-related 480 volt Bus E-2 was transferred to the emergency diesel generator. The valve remained closed for approximately 39 minutes before the operators recognized the condition, reopened FCV-626, and restored CCW cooling to the RCP thermal barrier heat exchangers. Plant staff knew that FCV-626, a motor operated valve, was powered from Bus E-2 via MCC 6. However, plant staff, including operators, was unaware that FCV-626 would close on a momentary loss of power. Additionally, the simulator was modeled such that FCV-626 remained open when power to Bus E-2 was momentarily interrupted. The high flow closure function of FCV-626 is accomplished using flow orifice FE-626, which is located in the thermal barrier return line, and provides flow switch FIC-626 with a hydraulic input to operate high and low flow contacts. When the high flow contact opens, relay FIC-626X is de-energized and closes a contact in the closing circuit for the motor operator of FCV-626, thereby closing FCV-626. Plant procedure EDP-008, Instrument Buses, incorrectly indicated that the power source for the flow switch FIC-626 control circuit was from Instrument Bus 1. The power for the FIC-626 control circuit is from Instrument Bus 4. Instrument Bus 4 is fed from MCC-6, which also feeds motor operated valve FCV-626. When Bus E-2 transferred to the EDG, both valve FCV-626 and relay FIC-626X lost power for approximately 10 seconds. During this time interval, relay FIC-626X repositioned to its de-energized state, which closed a contact in the close circuit of valve FCV-626. When Bus E-2 reenergized, valve FCV-626 immediately began to close, which sealed in contacts to completely close the valve. The close circuit was sealed in before relay FIC-626X reset to its energized state. The team concluded that the most likely cause of the time delay for the relay to reset was a constant voltage transformer located between the relay and MCC-6. The safety significance of inadvertent shutoff of RCP thermal barrier cooling water is discussed in Section 1.1 of this report. The team reviewed historical data associated with the control circuit for valve FCV-626 and determined the licensee had at least two potential opportunities to discover the behavior of FCV-626 on a loss of power. The first opportunity was in 2005 while implementing Engineering Change (EC) 59456. While performing the EC, workers encountered wiring issues as documented in NCR168221. The licensee subsequently determined that flow switch FIC-626, which was previously thought to be powered from Instrument Bus 1, required no power to operate. As part of that investigation, it was noted that relay FIC-626X was powered from Instrument Bus 4. Wiring discrepancies existed in some of the associated drawings, but were either not noted or not pursued. 27 Enclosure 1 Additionally, the licensee did not update EDP-008, which continued to show Instrument Bus 1 Breaker 16 as the power source for the flow switch FIC-626 control circuit. The licensee has written NCR 391995 to correct these deficiencies. The second opportunity occurred in 2008 during the performance of OST-163, Safety Injection Test and Emergency Diesel Generator Auto Start on Loss of Power and Safety Injection (refueling). As part of the test, 480V safety-related Bus E-2 was transferred to the B EDG. Data recovered by the licensee indicated that FCV-626 closed at approximately the same time the B EDG re-energized Bus E-2. However, during the test, CCW system flow, which was being provided by the opposite train of power, was stable and RCPs were not running. Thus sufficient information was available to recognize that flow perturbations were not the cause for FCV-626 closing. About two hours later, the valve was reopened. The licensee either did not identify or did not pursue the unexpected behavior of FCV-626. The ERT entered the problems described in this section into the corrective action system. One corrective action will clarify the drawings associated with the control circuitry of FCV-626 and make some minor corrections to current drawings. Another corrective action will implement a modification to prevent inadvertent closure of valve FCV-626 for a momentary loss of power. The licensee stated the modification would be implemented prior to restart of the plant from the refueling outage. Additional review by the NRC will be needed to determine whether the design of FCV- 626, which caused the valve to close during a momentary loss of power, represents a performance deficiency. An Unresolved Item will be opened pending completion of this review. This issue is identified as URI 05000261/2010009-11, FCV 626, RCP Thermal Barrier Outlet Isolation CCW Valve, Unexpected Closure. In order to better understand the reason FCV-626 closed during a momentary loss of power, the team reviewed the licensing bases for the CCW system, including FCV-626. The team reviewed correspondence between the licensee and the NRC regarding NUREG 0737, Clarification of TMI Action Plan Requirements, Item II.K.3.25, Power on Pump Seals. This TMI item required the licensee to determine the consequences of a loss of RCP cooling due to a loss of offsite power lasting two hours. In their correspondence, the licensee stated that no modifications were necessary because the CCW system is still operable during a loss of offsite power (powered from the emergency buses) and provides flow to the RCP thermal barrier heat exchangers. They also stated that the B and C CCW pumps are automatically (requiring no operator action) started by a station blackout signal during a loss of offsite power event. Additional review by the NRC will be needed to determine if the behavior of RCP seal cooling following a loss of offsite power event is consistent with the description provided by the licensee in NUREG 0737 correspondence and if any differences represent a violation. An Unresolved Item will be opened pending completion of this review. The issue is identified as URI 05000261/2010009-12, NUREG 0737 Response From Licensee to the NRC Describing the Behavior of RCP Seal Cooling Following a Loss of Offsite Power Event. |
| 05000261/FIN-2010009-12 | 2010Q2 | Robinson | NUREG 0737 Response From Licensee to the NRC Describing the Behavior of RCP Seal Cooling Following a Loss of Offsite Power Event | Valve FCV-626 is located in the combined CCW return from the three RCP thermal barrier heat exchangers. In its normal open position it allows CCW flow to pass through the thermal barrier heat exchangers, providing backup cooling to the RCP seals in the event of a loss of the primary cooling flow (seal injection) from the charging pumps. There are two close functions for FCV-626: 1) closes on high flow in the return line which is indicative of a rupture of a thermal barrier heat exchanger (RCS to CCW system leak) and 2) closes in response to a Phase B containment isolation signal. The valve has no automatic opening functions. The valve closed when power to safety-related 480 volt Bus E-2 was transferred to the emergency diesel generator. The valve remained closed for approximately 39 minutes before the operators recognized the condition, reopened FCV-626, and restored CCW cooling to the RCP thermal barrier heat exchangers. Plant staff knew that FCV-626, a motor operated valve, was powered from Bus E-2 via MCC 6. However, plant staff, including operators, was unaware that FCV-626 would close on a momentary loss of power. Additionally, the simulator was modeled such that FCV-626 remained open when power to Bus E-2 was momentarily interrupted. The high flow closure function of FCV-626 is accomplished using flow orifice FE-626, which is located in the thermal barrier return line, and provides flow switch FIC-626 with a hydraulic input to operate high and low flow contacts. When the high flow contact opens, relay FIC-626X is de-energized and closes a contact in the closing circuit for the motor operator of FCV-626, thereby closing FCV-626. Plant procedure EDP-008, Instrument Buses, incorrectly indicated that the power source for the flow switch FIC-626 control circuit was from Instrument Bus 1. The power for the FIC-626 control circuit is from Instrument Bus 4. Instrument Bus 4 is fed from MCC-6, which also feeds motor operated valve FCV-626. When Bus E-2 transferred to the EDG, both valve FCV-626 and relay FIC-626X lost power for approximately 10 seconds. During this time interval, relay FIC-626X repositioned to its de-energized state, which closed a contact in the close circuit of valve FCV-626. When Bus E-2 reenergized, valve FCV-626 immediately began to close, which sealed in contacts to completely close the valve. The close circuit was sealed in before relay FIC-626X reset to its energized state. The team concluded that the most likely cause of the time delay for the relay to reset was a constant voltage transformer located between the relay and MCC-6. The safety significance of inadvertent shutoff of RCP thermal barrier cooling water is discussed in Section 1.1 of this report. The team reviewed historical data associated with the control circuit for valve FCV-626 and determined the licensee had at least two potential opportunities to discover the behavior of FCV-626 on a loss of power. The first opportunity was in 2005 while implementing Engineering Change (EC) 59456. While performing the EC, workers encountered wiring issues as documented in NCR168221. The licensee subsequently determined that flow switch FIC-626, which was previously thought to be powered from Instrument Bus 1, required no power to operate. As part of that investigation, it was noted that relay FIC-626X was powered from Instrument Bus 4. Wiring discrepancies existed in some of the associated drawings, but were either not noted or not pursued. 27 Enclosure 1 Additionally, the licensee did not update EDP-008, which continued to show Instrument Bus 1 Breaker 16 as the power source for the flow switch FIC-626 control circuit. The licensee has written NCR 391995 to correct these deficiencies. The second opportunity occurred in 2008 during the performance of OST-163, Safety Injection Test and Emergency Diesel Generator Auto Start on Loss of Power and Safety Injection (refueling). As part of the test, 480V safety-related Bus E-2 was transferred to the B EDG. Data recovered by the licensee indicated that FCV-626 closed at approximately the same time the B EDG re-energized Bus E-2. However, during the test, CCW system flow, which was being provided by the opposite train of power, was stable and RCPs were not running. Thus sufficient information was available to recognize that flow perturbations were not the cause for FCV-626 closing. About two hours later, the valve was reopened. The licensee either did not identify or did not pursue the unexpected behavior of FCV-626. The ERT entered the problems described in this section into the corrective action system. One corrective action will clarify the drawings associated with the control circuitry of FCV-626 and make some minor corrections to current drawings. Another corrective action will implement a modification to prevent inadvertent closure of valve FCV-626 for a momentary loss of power. The licensee stated the modification would be implemented prior to restart of the plant from the refueling outage. Additional review by the NRC will be needed to determine whether the design of FCV- 626, which caused the valve to close during a momentary loss of power, represents a performance deficiency. An Unresolved Item will be opened pending completion of this review. This issue is identified as URI 05000261/2010009-11, FCV 626, RCP Thermal Barrier Outlet Isolation CCW Valve, Unexpected Closure. In order to better understand the reason FCV-626 closed during a momentary loss of power, the team reviewed the licensing bases for the CCW system, including FCV-626. The team reviewed correspondence between the licensee and the NRC regarding NUREG 0737, Clarification of TMI Action Plan Requirements, Item II.K.3.25, Power on Pump Seals. This TMI item required the licensee to determine the consequences of a loss of RCP cooling due to a loss of offsite power lasting two hours. In their correspondence, the licensee stated that no modifications were necessary because the CCW system is still operable during a loss of offsite power (powered from the emergency buses) and provides flow to the RCP thermal barrier heat exchangers. They also stated that the B and C CCW pumps are automatically (requiring no operator action) started by a station blackout signal during a loss of offsite power event. Additional review by the NRC will be needed to determine if the behavior of RCP seal cooling following a loss of offsite power event is consistent with the description provided by the licensee in NUREG 0737 correspondence and if any differences represent a violation. An Unresolved Item will be opened pending completion of this review. The issue is identified as URI 05000261/2010009-12, NUREG 0737 Response From Licensee to the NRC Describing the Behavior of RCP Seal Cooling Following a Loss of Offsite Power Event. |
| 05000261/FIN-2010009-13 | 2010Q2 | Robinson | Dedicated Shutdown Diesel Generator Failed to Start Due to Low Starting Air Pressure | The team reviewed the circumstances which resulted in a failure of the DSDG to start. The team reviewed completed procedures, log entries, system drawings and performed a system walkdown. At 18:52 on March 28, the DS bus was automatically de-energized, as designed, due to undervoltage on 4 kV Bus 3. As a result, the DSDG support equipment, such as the starting air system compressor and battery charger, lost power. Based in part on adequate starting air pressure, the licensee considered the DSDG available for the purpose of assessing on-line risk. The log reading normal minimum value for starting air pressure is 165 psig and operators were monitoring this parameter twice per day. At 14:41 on March 31 the licensee attempted to start the DSDG and re-energize the DS bus to maintain adequate DSDG support parameters such as starting air pressure and battery voltage. Starting air pressure had decreased to 100 psig and the DSDG did not start. The licensee successfully started the DSDG on April 1 at 13:40 by pressurizing the DSDG starting air receiver tank using high pressure air bottles. Both the E-1 and E-2 safety buses were energized during this time with Bus E-1 powered from off-site power and Bus E-2 supplied from EDG B. The licensee entered Condition Reports 390954 and 390958 into their corrective action program. Additional review by the NRC will be required to determine if the DSDG was available when credited in the licensees risk assessment during the plant cooldown to Mode 4. This review will also determine whether this issue represents a performance deficiency. An Unresolved Item will be opened pending completion of this review. The issue will be identified as URI 05000261/2010009-13, Dedicated Shutdown Diesel Generator Failed to Start Due to Low Starting Air Pressure. |
| 05000261/FIN-2010009-14 | 2010Q2 | Robinson | Unexpected Loss of Instrument Bus 3 for Two Minutes | The team reviewed the circumstances which resulted in an inadvertent de-energization of Instrument Bus 3. The team reviewed completed procedures, log entries, and system drawings. The team also interviewed personnel and performed a system walkdown. At 18:52 on March 28 the B battery charger de-energized due to loss of power to Bus E-2. Per Path-1, control room operators subsequently dispatched an Auxiliary Operator (AO) to restore the B battery charger. As the AO entered the battery room he made inadvertent contact with the handle for the B Inverter Supply Breaker 72/MCC-B (1K). The contact resulted in breaking the handle off of the breaker. Based on the timeframe when the AO entered the battery room and the time when Instrument Bus 3 was unexpectedly loss, the licensees ERT concluded the contact with the breaker caused the loss of Instrument Bus 3. The Auxiliary Operator recognized the damage to the breaker handle and continued to complete the restoration the B battery charger. The B battery charger was restored at 19:31. Upon exiting the battery room the AO verified the B inverter was operating correctly and reported the damage to the breaker handle. A review of plant data indicated Instrument Bus 3 was de-energized at 19:25 and reenergized at 19:27. The loss of Instrument Bus 3 power deenergized the High Steam Flow bistables in the Engineered Safety Features system. This condition, coincident with an RCS Low Tavg signal due to the RCS cooldown, generated a Main Steam Line Isolation signal, automatically closing all MSIVs and terminating the RCS cooldown. Based on interviews with the AO, no actions were performed to reset or reclose the B Inverter Supply Breaker. The licensee generated Work Order 01735191 to repair the broken breaker handle. The licensee performed troubleshooting activities to determine the cause of the two-minute interruption in instrument bus power, but was unable to detect any problems. The licensee was continuing to perform troubleshooting at the time this report was written. The licensee entered Condition Report 390070 into their corrective action program. Additional review by the NRC will be needed to assess the adequacy of the licensee troubleshooting efforts and evaluate any problems that may be identified. This review will also determine whether any performance deficiencies exist. An Unresolved Item will be opened pending completion of this review. The issue will be identified as URI 05000261/2010009-14, Unexpected Loss of Instrument Bus 3 for Two Minutes. |
| 05000261/FIN-2010009-01 | 2010Q2 | Robinson | Monitoring of Plant Parameters and Alarms | The team conducted an independent review of control room activities to determine if licensee staff responded properly during the events. With respect to operator awareness and decision making, the team was specifically focused on the effectiveness of control board monitoring, communications, technical decision making, and work practices of the operating crew. With respect to command and control, the team was specifically focused on actions taken by the control room leadership in managing the operating crews response to the event. The team performed the following activities in order to understand and/or confirm the control room operating teams actions to diagnose the event and implement corrective actions: Conducted interviews with control room operations personnel on shift during the event. Reviewed procedures, narrative logs, event recorder data, system drawings, and plant computer data. Observed a simulated plant response to this event as demonstrated on the plant reference simulator. Reviewed the crews implementation of emergency, abnormal, and alarm procedures as well as Technical Specifications. Reviewed Operations administrative procedures concerning shift manning and procedure use and coordination. Reviewed Operations procedures in use at the time of the second fire. The team determined that operators exhibited weaknesses in fundamental operator competencies when responding to the event. Specifically, the team determined that the operating crew did not identify important off-normal parameters and alarms in a timely manner, resulting in a failure to recognize an uncontrolled RCS cooldown and a potential challenge to RCP seal cooling. Additionally, the team determined that crew supervision did not exercise effective oversight of plant status, crew performance, or site resources. Through a review of plant data, the team determined that the crews response to the first event was not effective in stabilizing the plant. Through interviews and review of plant data, the team determined that the crew did not recognize the magnitude of the RCS cool down caused by an on-going steam demand. The RCS cool down rate exceeded the limit of 100o/hr in any one hour period as specified in Technical Specification (TS) 3.4.3, RCS Pressure and Temperature (P/T) Limits. The fact that the RCS cooldown rate exceeded the limiting value specified in TS 3.4.3, and the requirement to evaluate the actions contained in TS 3.4.3, was not recognized by the crew at any time during or after the cooldown. Based on interviews, the Reactor Operator (RO) and Control Room Supervisor (CRS) assessed the cool down rate as being consistent with what was experienced during simulator training for an RCP trip followed by a reactor trip. The RCS cool down continued until Instrument Bus 3 was inadvertently de-energized (approximately 33 minutes after the start of the first event), which caused the MSIVs to close, isolating the steam generators from the steam header. Based on the sequence of events, a review of plant data, and operator interviews, the team concluded that the crew did not recognize that VCT level was decreasing, a low VCT level alarm had annunciated, and automatic swapover of the charging pump suction from the VCT to the RWST failed to occur, until indicated level in the VCT had decreased to approximately 2-3 inches and charging flow had degraded. Once the crew identified this condition, the RO attempted to manually align the suction of the charging pumps to the RWST but made an error when performing the alignment. The error left the suction of the charging pumps aligned to the VCT. The Shift Technical Advisor (STA) determined the alignment was incorrect and the RO corrected the error. The crew did not reference APP-003-E3, VCT HI/LO LVL, which provided direction to manually transfer the charging pump suction to the RWST. RCP seal cooling was maintained because the crew reopened FCV-626 to restore CCW cooling to the RCP thermal barrier heat exchanger approximately 6 minutes before depletion of the VCT. However, high pump bearing temperature alarms were received on all three RCPs. The high temperature alarms subsequently cleared after operators reopened FCV-626. Based on operator interviews, the team concluded that, following implementation of Emergency Operating Procedures (EOPs), the operators did not complete a satisfactory review and evaluation of alarm conditions prior to the second event. Instead, the operating crew entered GP-004, Post Trip Stabilization, and attempted to reset the generator lockout relay without using the information in the Annunciator Panel Procedures (APPs) to completely and accurately assess abnormal electric plant status. GP-004 is a normal operating procedure and is written with the assumption that the plant is in a normal (undamaged) configuration. The crew was not aware that a sudden pressure fault signal from the UAT was still applied to the generator lockout circuit logic, as indicated by a locked in UAT fault trip alarm (APP-009-B6, AUX TRANSF FAULT TRIP). The attempted reset reenergized Bus 4 and caused a fault at breaker 52/24, initiating the sequence for the second fire. The team concluded that if the crew had performed a thorough control board walkdown, additional electric plant APPs and/or AOPs could have been identified and implemented before exiting to a normal operating procedure (GP-004). Additional review by the NRC will be required to determine if the licensees programs resulted in untimely identification and investigation of abnormal plant parameters and unexpected main control room alarms. This review will also determine whether the crews monitoring of plant parameters and alarms, and use of associated procedures, represents a performance deficiency. An Unresolved Item will be opened pending completion of this review. The URI is identified as 05000261/2010009-01, Monitoring of Plant Parameters and Alarms. Additionally, further review by the NRC will be required to determine if the RCS cooldown rate exceeding the limiting value specified in TS 3.4.3 represents a performance deficiency. An Unresolved Item will be opened pending completion of this review. The URI is identified as 05000261/2010009-02, RCS Cooldown Rate Exceeds Technical Specification 3.4.3 Limit. |