TSTF-13-01, Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2

ML13143A014
Person / Time
Site:	Technical Specifications Task Force
Issue date:	05/22/2013
From:	Croft W, Gustafson O, Loeffler R, Slough R Technical Specifications Task Force, B & W Nuclear Energy (B&W NE), BWR Owners Group, Combustion Engineering, PWR Owners Group, Westinghouse
To:	Office of Nuclear Reactor Regulation, Document Control Desk
References
TSTF-13-01
Download: ML13143A014 (20)

Text

TECHNICAL SPECIFICATIONS TASK FORCE TSTF A JOINT OWNERS GROUP ACTIVITY May 22, 2013 TSTF-13-01 PROJ0753 Attn: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2"

REFERENCE:

Letter from Michelle Honcharik (NRC) to Technical Specifications Task Force dated October 19, 2012, "Request for Additional Information Re:

Traveler TSTF-531, Revision 0, Revision of Specification 3.8.1, Required Action B.3.1 and B.3.2" On March 29, 2012, The TSTF submitted Traveler TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2," to the Nuclear Regulatory Commission for review (ADAMS Accession No. ML12089A317).

In the referenced letter, the NRC requested additional information to enable the NRC staff to complete the requested review. The enclosure to this letter responds to that request. The TSTF would be pleased to meet with the NRC staff to discuss the Traveler and the enclosed responses.

Should you have any questions, please do not hesitate to contact us.

Robert Slough (PWROG/W) Richard A. Loeffler (BWROG)

Otto W. Gustafson (PWROG/CE) Wendy E. Croft (PWROG/B&W)

Enclosure cc: Robert Elliott, Technical Specifications Branch, NRC Michelle Honcharik, Licensing Processes Branch, NRC 11921 Rockville Pike, Suite 100, Rockville, MD 20852 Phone: 301-984-4400, Fax: 301-984-7600 Administration by EXCEL Services Corporation

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" The NRC Request for Additional Information is repeated below in italics, followed by the TSTF response.

The Traveler TSTF-531, Revision 0, proposes to revise the Standard Technical Specification (STS) Condition B of Specification 3.8.1, "AC Sources - Operating," to clarify the requirements for performance of a common cause failure (CCF) determination for an inoperable diesel generator (DG).

Item 1 The traveler proposes to add a Note to Required Action B.3 which states:

Required Actions B.3.1 and B.3.2 are not required to be performed if the DG is inoperable due to preplanned maintenance or testing, or an inoperable support system.

STS 1.1, "Definition of OPERABLE - OPERABILITY," states:

A system, subsystem, train, component, or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified safety function(s) and when all necessary attendant instrumentation, controls, normal or emergency electrical power, cooling and seal water, lubrication, and other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its specified safety function(s) are also capable of performing their related support function(s).

Question 1a Given the above STS 1.1 definition of OPERABILITY, explain how the proposed traveler addition of Technical Specification (TS) Note will continue to ensure the Operability of the redundant DG and that no CCF exists in the redundant DG.

TSTF Response If a DG is removed from service for preplanned maintenance and testing, as indicated by NUREG-1366, "Improvements to Technical Specification Surveillance Requirements," there is no degraded or nonconforming condition to be evaluated as a potential CCF. Therefore, that portion of the proposed Note will have no effect on ensuring there is no CCF on the redundant DG.

The portion of the Note discussing an "inoperable support system" only applies if the support system is a Technical Specifications (TS) support system, since only systems that have their own TS LCO are classified as "operable" or "inoperable" (other DG support systems that do not have their own LCO are classified as "functional" or "non-functional"). This limitation is reinforced in the proposed Bases discussions of this portion of the Note. If a DG is inoperable due to an Page 1

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" inoperable Technical Specifications support system (i.e., a system required to be Operable by a TS LCO), the Required Actions of the support system provide the appropriate compensatory measures. An extent of condition review (i.e., does the condition exist on the opposite support system train) should be made of the redundant TS support system, not the redundant DG. NRC Inspection Manual, Part 9900, "Operability Determinations & Functionality Assessments for Resolution of Degraded or Nonconforming Conditions Adverse to Quality or Safety" (herein referred to as "the NRC Operability Guidance"), states that Operability determinations should include consideration of the SSCs that are affected by a degraded or nonconforming condition and the extent of condition for all similarly affected SSCs. Appendix C.9 provides additional information:

Upon discovery of a support system that is not capable of performing its related support function(s), the most important consideration is the possibility of having lost all capability to perform a specified safety function. Upon declaring a support or supported system inoperable in one train, the required actions in the [Technical Specifications] TSs should be implemented. The licensee must verify that the facility has not lost the complete capability to perform the specified safety function. (emphasis added)

Therefore, in the case of a DG declared inoperable due to an inoperable support system, an extent of condition verification of the Operable train of the inoperable support system is performed to determine if it is Operable and can support Operability of the redundant DG.

Question 1b Please refer to Regulatory Guide 1.9, Revision 3 or 4, Figure 1, "Boundary and Support Systems of Emergency Diesel Generator Systems." Identify the specific DG support systems, required for the DG to perform its specified safety function(s), that are included in the proposed Note "or an inoperable support system" [an exception to perform the TS 3.8.1 Condition B, Required Action B.3.1 or B.3.2].

NRC Information Notice 2007-27, "Recurring Events Involving Diesel Generator Operability,"

states:

One recurrent event that continues to stand out involves the vibration-induced failure of EDG [emergency DG] piping and tubing. In many cases, major piping failures occurred after minor leaks were identified and not immediately or properly repaired by the licensee.

Some licensees have put off repairing minor leaks until the next scheduled EDG outage. If this is the case and TSTF-531 is approved, Required Action B.3.1 would not be performed on the redundant EDG because the minor leak would be repaired during a scheduled EDG outage. The redundant EDG would not have to be inspected to ensure it does not have a similar leak/piping or tubing degradation.

Page 2

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" TSTF Response The question is based on an incorrect premise that the described minor leaks would have been evaluated for a CCF mechanism under the current Required Actions. If investigation of the minor leaks resulted result in the DG being declared inoperable, the DG must be restored to Operable status within the Completion Time of Condition B, or a plant shutdown is required.

Repair of the leaks could not be postponed until the next scheduled DG outage, and, with the DG declared inoperable, Required Action B would be followed and the CCF determination would be completed, since EDG piping and tubing is not a "support system with its own LCO," as detailed in the TS Bases for the Note. Therefore, it is apparent that the minor leaks discussed in the Information Notice did not result in the DG being declared inoperable, and Required Actions B.3.1 and B.3.2 were therefore not applicable. The proposed change will have no effect on the described situation.

If minor leaks in DG piping and tubing did do result in the a DG becoming inoperable, Required Actions B.3.1 and B.3.2 continue to be applicable under the proposed change. DG piping and tubing do not have a separate LCO but are included under the DG requirements.

The DG system boundary shown in the Regulatory Guide 1.9 figure is not consistent with the presentation of DG requirements in the STS. There are only a few DG support systems with their own LCO, such as TS 3.8.3, "Diesel Fuel Oil, Lube Oil, and Starting Air," and, for some plant designs, the Service Water System or equivalent cooling water system. If leaking piping or tubing in a system with its own LCO renders that system inoperable, which results in the supported DG being inoperable, the appropriate Required Actions are those for the system that is the cause of the inoperability.

Question 1c Explain how a similar leak on a redundant EDG would be identified and repaired prior to that EDGs next operation or maintenance outage.

TSTF Response As stated in the response to Question 1b, a leak in DG piping or tubing that resulted in the DG being inoperable would continue to be evaluated under Required Actions B.3.1 and B.3.2. A leak in DG piping or tubing that does not render the DG inoperable does not result in Required Action B.3.1 or B.3.2 being applicable under the current or the proposed requirements.

The Information Notice did not state that failure to repair tubing or piping leaks before the next scheduled DG outage resulted in failure of tubing or piping leaks on the redundant DG.

However, to be complete we will assume that there exists a discovered tubing or piping leak that renders one DG inoperable and an undiscovered tubing or piping leak is present on the redundant DG. 10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," states:

Measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. In the case of significant Page 3

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action taken to preclude repetition." (Emphasis added).

An inoperable Technical Specification system as a result of a degraded or nonconforming condition is a significant condition adverse to quality. In accordance with Criterion XVI, licensee processes require an evaluation of the cause of the condition adverse to quality and of the extent of condition (e.g., whether the redundant support system is Operable) in order to ensure that corrective actions will preclude repetition. The NRC routinely inspects licensee's Quality Assurance and Corrective Action Programs, including the quality, scope, and timing of extent of condition evaluations.

In practice, one of the first actions when a system is determined to be inoperable is an extent of condition review of the Operability of the redundant system, in order to determine the appropriate TS Condition to be entered. The NRC Operability Guidance states that Operability Determinations should include consideration of the SSCs that are affected by a degraded or nonconforming condition and the extent of condition for all similarly affected SSCs. Appendix C.9 provides additional information:

Upon discovery of a support system that is not capable of performing its related support function(s), the most important consideration is the possibility of having lost all capability to perform a specified safety function. Upon declaring a support or supported system inoperable in one train, the required actions in the [Technical Specifications] TSs should be implemented. The licensee must verify that the facility has not lost the complete capability to perform the specified safety function. (emphasis added)

Therefore, in the case of a DG declared inoperable due to a tubing or piping leak, the redundant DG will be examined in accordance with the Operability Determination Process to determine if there is an undiscovered tubing or piping leak on the redundant DG. This requirement is independent of existing Required Action B.3.1.

Note that under the current TS requirements, a licensee could choose to start the redundant DG in accordance with Required Action B.3.2, which may or may not result in discovery of tubing or piping leaks. However, the Corrective Action Program requires an evaluation of the redundant DG for a similar failure regardless of which Required Action is followed.

NRC Staff Comment 1 Suggested Condition B, Required Action B.3.1/B.3.2 Note:

Note 1: B.3.1 and B.3.2 are not required to be performed if the DG is inoperable solely for preplanned maintenance or testing.

DG failures or failure mechanisms identified during preplanned maintenance or testing are not included in this exception.

Page 4

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" TSTF Response The suggestion makes two changes to the proposed Note: 1) inadvertently results in the elimination of the exception for an inoperable support system, and 2) the addition of the sentence, "DG failures or failure mechanisms identified during preplanned maintenance or testing are not included in this exception."

The exception for an inoperable support system is justified in the Traveler and is consistent with the development philosophy of the TS, Questions regarding that change are addressed in other responses.

The proposed sentence, "DG failures or failure mechanisms identified during preplanned maintenance or testing are not included in this exception," would not change the application of the TS or result in performance of more CCF determinations or starts of the redundant DG than the industry-proposed Note. If a DG is declared inoperable for preplanned maintenance or testing, any degraded or nonconforming condition discovered during the performance of that maintenance or testing would not result in reentering Condition B. A DG cannot become "more inoperable" or "inoperable again." Under the existing requirements, the CCF determination was performed for the correct reason - the preplanned maintenance or testing, any degraded or nonconforming conditions discovered during the maintenance would be evaluated under the Corrective Action Program, as discussed in the response to Question 1c. One of the primary purposes of the revised wording of the Completion Time to read "24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from discovery of potential common cause failure mechanism" is to clarify the actions to be taken WHENEVER a potential common cause failure mechanism is identified, even if the time of identification is not the original time zero when the Action was entered. The current TS are unclear on this point, and reliance is placed on the Corrective Action Program to accomplish the required extent of condition determinations. The proposed revision to the Completion Time adds TS controls, which apply whenever a potential common cause failure is discovered, even if it is discovered during preplanned maintenance or testing.

Discovery of a degraded condition after the EDG has been declared inoperable for other reasons, in this case for maintenance or testing, is required to be corrected before a DG can be declared OPERABLE and returned to service. Therefore the suggested sentence is not required.

Item 2 The marked-up TS Bases B.3.1 and B.3.2 state:

If the DG is inoperable due to a DG component that can be tested without starting the OPERABLE DG (e.g., [cooling water, ventilation equipment, starting air pressure, diesel fuel oil or diesel lubricating oil volume or quality]), testing of the component on the OPERABLE DG may be sufficient to determine the redundant DG is not inoperable due to common cause failure, thereby meeting B.3.1.

Page 5

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" Question 2a Identify all DG components that "can be tested without starting the Operable DG" per the specific engine manufacturer (i.e., Fairbanks Morse, ALCO, EMD, SACM, etc.).

TSTF Response The proposed change is not manufacturer-specific and it is not possible to speculate what potential failures could occur. The proposed change does not eliminate the need to perform a CCF determination or start the redundant DG. The Bases change simply recognizes that in some cases, testing the affected component on the redundant DG may support the CCF determination.

The proposed change clarifies that testing parts of a redundant DG in order to inform a CCF determination may be more illuminating than starting the redundant DG. The Traveler justification used the example of measuring fuel pressure on the redundant DG when a DG is inoperable due to low fuel pressure. Starting the redundant DG may not reveal a similar problem, whereas measuring the fuel pressure on the redundant DG may be more illuminating.

The proposed Bases change does not alter the existing TS requirements, but simply points out that the CCF determination may include testing of components.

Question 2b From the list of components identified in your response to Question 2a above, identify those components that can be tested without requiring the Operable DG being in an inoperable condition for testing.

TSTF Response The proposed change is not manufacturer-specific. The proposed change does not eliminate the need to perform a CCF determination or start the redundant DG. It is possible that testing an individual component could render the redundant DG inoperable. It is also possible that starting the redundant DG may render it inoperable during all or part of the test, depending on the plant design. Therefore, either option may result in rendering the redundant DG inoperable. However, the current TS option of starting the redundant DG supports the conclusion that verifying that the redundant DG is Operable is sufficiently important to render the redundant DG inoperable for testing. The proposed change does not alter that position.

Question 2c STS 3.8.3 limiting condition for operation (LCO) Required Actions apply directly to the DG starting air, fuel oil and lube oil system volume, and fuel oil quality. The Required Actions do not require the DG to be tested or a CCF determination to be performed upon entry into the TS Actions. Explain why these systems are included in the proposed marked-up TS Bases B.3.1 and B.3.2.

Page 6

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" The Traveler states:

performing tests on independently testable components would actually be part of a common cause failure determination, which is already required to be done. Performance of such tests is not a true exception to the requirement to perform a common cause failure determination, so it is addressed by including a sentence within the Bases.

TSTF Response Condition F of STS 3.8.3, which applies if the Required Actions and associated Completion Times are not met or diesel fuel oil, lube oil, or the starting air subsystem is not within limits for a reason not addressed by another Condition, requires the associated DG to be declared inoperable immediately. The STS 3.8.3 Actions allow separate Condition entry for each DG.

If a DG is declared inoperable in accordance with STS 3.8.3, Condition F, the cause of the inoperability is known, as well as which DGs are affected. Therefore, performance of the CCF determination or starting the redundant DG is not necessary.

Question 2d If performing tests on the Operable DG independently testable components would be part of the CCF determination and required to be performed, as stated above, why is the exception to performance of B.3.1 proposed in the Note, and in the TS Bases B.3.1 and B.3.2?

TSTF Response The question reflects a misunderstanding of the proposed change. The proposed change does not provide an exception to performance of Required Action B.3.1 or B.3.2 related to independently testable components. The proposed change revises the Bases to recognize that performing tests on independently testable components may be used to inform the CCF determination. Testing independently testable components is not required and is not an exception to Required Action B.3.1 or B.3.2.

Question 2e Identify all DG components that are independently testable per the specific engine manufacturer (i.e., Fairbanks Morse, ALCO, EMD, SACM, etc.).

TSTF Response The proposed change is not manufacturer specific and it is impossible to speculate on the gamut of potential failures that could be the subject of a common cause CCF determination and whether testing a component might be useful in determine if there is a CCF. Please see the responses to Questions 2.a and 2.b.

Page 7

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" Question 2f Given the STS 1.1 definition of Operability, explain how the proposed TS Bases exception ensures that a failure of an independently testable component does not affect the OPERABILITY of the opposite train DG if Required Action B.3.1 or B.3.2 is NOT performed.

TSTF Response The question reflects a misunderstanding of the proposed change. The proposed change to the TS Bases regarding independently testable components does not provide any exception to Required Action B.3.1 or B.3.2 and, therefore, one of the Required Actions is still required to be performed. The proposed change to the Bases simply recognizes that testing an independently testable component may be part of the CCF determination. This has no effect on the existing TS requirements. If an independently testable component is the cause of the inoperable DG, a CCF determination must be performed or the redundant DG started. A licensee may decide to test the independently testable component on the redundant DG as part of the CCF determination, but the CCF determination must still be performed. The redundant DG is either Operable or inoperable, and the manner of performing the CCF determination does not change that status.

Item 3 The traveler TSTF-531 on Page 6 states that the proposed changes would result in a "small decrease" in the number of times that licensees perform B.3.1 or B.3.2. Also, on Page 7, the traveler TSTF-531 states that a survey of licensees identified that plants enter Condition B an average of 27 times per year per unit. Based on this data, it is estimated that Condition B would have been entered approximately 14,000 times over the 5 year period examined above without a single instance of a CCF. The NRC staff understands that the proposed exemptions to TS B.3.1 and B.3.2 include: (1) pre-planned maintenance and testing, (2) components that can be tested without starting the DG, (3) independently testable components, and (4) inoperable support systems governed by its own LCO.

Question 3a Please quantify the term "small decrease" as used above.

TSTF Response The stated understanding by the NRC staff of the proposed change is incorrect. The proposed exception to Required Actions B.3.1 and B.3.2, as stated in the Required Action Note, is for preplanned maintenance or testing, or an inoperable support system. There is no exception to Required Actions B.3.1 or B.3.2 for components that can be tested without starting the DG or independently testable components. Please see the response to Question 2.f.

The survey of licensees that was used to establish the estimate of the number of times that Condition B was entered was not specific regarding whether the Condition was entered due to preplanned maintenance or testing, an inoperable support system, or some other reason. The purpose of the survey was to put in context the number of entries that resulted in discovery of a Page 8

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" common cause failure. Therefore, it is not possible to estimate the decrease in the number of times Required Action B.3.1 or B.3.2 would be applied. Countering the decrease in usage of Required Actions B.3.1 or B.3.2 due to the new Note, there may be a increase in application of Required Action B.3.1 due to the rewording of the Completion Time. The revised Completion Time will result in more TS-required CCFs (for the situations described in the TSTF where the current TS words are not clearly applicable). Given this lack of data, it may have been more accurate for the justification to state:

The proposed changes will may result in a small decrease in the number of times that licensees perform Required Action B.3.1 or B.3.2. Any This small decrease will not affect plant safety for the reasons discussed above and because of very low likelihood that the Required Actions would identify a common cause failure of two DGs.

The historical data supports a conclusion that it a very rare occurrence for Required Action B.3.1 and B.3.2 to identify a common cause failure, and it is a reasonable conclusion that the proposed change will have little effect on plant safety.

Question 3b If these exemptions are only expected to result in a small decrease in the estimated 14,000 entries into B.3.1 and B.3.2 as stated above, what specifically are the expected causes for the remaining large majority of entries into B.3.1 and B.3.2?

TSTF Response See the response to Question 3a regarding usage of Required Actions B.3.1 or B.3.2. Condition B is entered when a DG is inoperable. A DG may be inoperable due to a degraded or nonconforming condition (either in the DG or in a support system), or for preplanned maintenance or testing. Under the proposed change, Required Action B.3.1 or B.3.2 will be applicable for all entries except for preplanned maintenance or testing, or an inoperable support system.

Question 3c Of the approximately 14,000 entries into TS 3.8.1, Condition B, how many diesel starts were performed versus common-cause determinations?

TSTF Response This information is not available. However, it is not clear how this question relates to the acceptability of the proposed change.

Question 3d If the proposed changes to B.3.1 and B.3.2 are only expected to result in a small decrease in the number of B.3.1 and B.3.2 entries, why is the change necessary?

Page 9

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" TSTF Response See the response to Question 3a regarding usage of Required Actions B.3.1 or B.3.2. As stated in Section 2 of the justification:

[S]ome activities should be exempted from the requirement to perform a common cause failure determination or to start the redundant DG, because the cause of the inoperability is already known to not affect the other diesel (such as preplanned maintenance or testing), or the appropriate actions are governed by a different Limiting Condition for Operation (LCO) for a TS support system.

Distracting the licensed operators with unnecessary TS Required Actions is detrimental to plant safety. As noted in the justification, these exceptions were developed by the NRC as a TS improvement and recommended to the industry in NUREG-1366, "Improvements to Technical Specification Surveillance Requirements," and Generic Letter 93-05, "Line-Item Technical Specifications Improvements to Reduce Surveillance Requirements for Testing During Power Operations."

Item 4 On Page 4 the Traveler states that licensees have continued to improve the quality and depth of their CCF determinations and licensee procedural requirements make it difficult to perform, review, and approve an adequate CCF determination in less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The starting [slow start with TS allowed engine pre-lube] of the redundant Operable DG reduces reliability and causes additional wear and tear.

Question 4a Please provide engine/generator manufacturer data to support this statement including the quantitative impact on DG reliability and DG wear and tear (i.e., reliability and longevity of the DG).

TSTF Response The conclusion that it is preferable to perform a CCF determination in lieu of starting the redundant DG was made by the NRC in NUREG-1366, "Improvements to Technical Specification Surveillance Requirements," and was the basis for the recommended TS changes in Generic Letter 93 05, "Line-Item Technical Specifications Improvements to Reduce Surveillance Requirements for Testing During Power Operations."

NUREG-1366 states:

The NRC staff recommends that the requirement to test the remaining diesel generator(s) when one diesel generator is inoperable due to any cause other than preplanned preventative maintenance or testing be limited to those situations where the cause for inoperability has not been conclusively demonstrated to preclude the potential for a common mode failure.

Page 10

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" A study done for EPRI (NP-4264, Vol. 2) looked specifically at failures of emergency diesel generators that result from surveillance testing. The data for this study consist of LERs from January 1979 through early 1983, a period of just over 4 years. Note that this period preceded the issuance of Generic Letter 84-15 so that, hopefully, the situation now would be somewhat better. A total of 585 failures of 136 diesel generators were found.

Of these 585 failures, 70 (12%) were determined to be related to surveillance testing.

The TSTF accepts the NRCs documented conclusion, based on engineering judgment, that starting a DG results in wear and tear.

Question 4b Provide specific plant data for the past 7 years for licensees who have performed a TS required plant shutdown (10 CFR 50.72(b)(2)(i)) due to: (1) the inability to perform B.3.1 or B.3.2 within the required [24] hours, (2) because a new or different CCF mechanism was discovered after the

[24] hour Completion Time (CT) had expired, or (3) because the initial CCF determination was discovered to be incorrect.

TSTF Response This information is not readily available, and it is not clear how this question relates to the acceptability of the proposed change. The justification of the proposed change was not based on plant shutdowns, but on a recognition that the existing TS requirements could result in an immediate plant shutdown when the redundant DG is Operable. We are confident the NRC would agree that it is preferable to resolve this problem before an unnecessary plant shutdown or Notice of Enforcement Discretion is required.

Question 4c The STS allow a licensee to perform the CCF determination as an alternative to starting the EDG. Licensees who choose to perform the CCF determination and later find that the CCF determination will take longer than anticipated, can, as an alternative, start the DG (perform a DG slow-start per surveillance requirement (SR) 3.8.1.2) prior to the expiration of the 24-hour CT to satisfy the TS Required Action. Explain why this option is causing a burden on licensees in order to demonstrate, in a timely manner, that a CCF mechanism does not exist on the Operable DG.

TSTF Response The question reflects a misunderstanding of the proposed change. The Traveler did not state that performing a CCF determination within the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time was a burden or not possible, or that starting the redundant DG within the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time was not possible. The proposed change addresses the situation in which it is determined, after the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time has already been reached, that the incorrect failure mechanism was used or a new failure identified in the CCF determination, or a second failure mechanism is identified Page 11

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" at this later point in time. At that point, performing another CCF determination or starting the redundant DG are not an option because the Completion Time has already been reached, and the default Condition is applicable, which requires an immediate plant shutdown.

Question 4d Identify the specific procedural impediments to the timely performance, review, and approval of CCF determinations and explain why these impediments cannot be directly addressed by individual licensees. Provide specific (actual) examples where the procedural requirements prevented the CCF determination from being completed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and the resultant action(s) taken.

TSTF Response The question reflects a misunderstanding of the proposed change. The Traveler did not state that performing a CCF evaluation within the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time was a burden or not possible.

See the response to Question 4e.

Question 4e For the past 7 years, please identify all licensees who have performed multiple (more than one)

CCF evaluations or re-performed the surveillance requirement (SR) test during the STS 72-hour DG CT period.

TSTF Response This information is not available. It is not clear how this question relates to the acceptability of the proposed change. The justification of the proposed change was based on a recognition that the existing TS requirements could result in an immediate plant shutdown when the redundant DG is actually still Operable. See the response to Question 4b.

Item 5 On Page 6 the Traveler states:

A review of Licensee Event Reports (LERs) from 2005 thru August 2010 was performed to identify common cause failures of two or more trains of DGs. This resulted in the identification of 31 LERs that documented the simultaneous inoperability of two or more DGs. Each LER was then reviewed to determine if the simultaneous inoperability of the DGs was due to a common cause failure and, if so, if the common cause failure was identified by performance of Required Action B.3.1 (common cause failure determination) or Required Action B.3.2 (slow start of the Operable DG). There are no instances in which the other DG was found to be inoperable due to a common cause failure. There was only one instance in which the redundant DG was found to be Page 12

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" inoperable by Required Action B.3.2 (Slow Start Test). In this instance, there was no common cause failure.

An NRC staff review of licensee 10 CFR 50.72(b)(2)(i) (shutdown required by TS) event notifications (ENs) made to the NRC Operations Center for plant shutdowns due to DG inoperability for the period March 2005 through August 2012 conflicts with the above statement.

Of the 29 total ENs, 14 ENs identified multiple (2 or more) DG inoperable, requiring a plant shutdown. Of those 14 ENs, one licensee identified that all (4) DGs were inoperable through performance of the CCF determination (EN#41895, Brunswick). Two other licensees identified the redundant DG to be inoperable during the performance of the surveillance test (EN#42820, Seabrook and EN#48186, Prairie Island). Additionally, the redundant DG was found to be inoperable at one other licensee facility due to an unrelated failure mechanism (not CCF) during the performance of the surveillance test (EN#45564, SONGS).

Question 5a Explain how the prohibited and unsafe operating conditions (i.e., loss of emergency power safety function - EN#42820, EN#48186, EN#41895, and EN#45564) would otherwise be identified in a timely manner if B.3.2 had not been not performed as required by TS.

On Page 5, the Traveler proposes that if a CCF mechanism is identified after the initial entry into Condition B and Required Action B.3.2 is performed (SR is performed), no action is required because " those starts suffice to provide assurance of continued OPERABILITY of those DG(s)."

TSTF Response As described in the response to Question 1c, an inoperable Technical Specification system as a result of a degraded or nonconforming condition is a significant condition adverse to quality. In accordance with 10 CFR 50, Appendix B, Criterion XVI, licensee processes require an evaluation of the cause of the condition adverse to quality and of the extent of condition (e.g.,

whether the redundant support system is Operable) in order to ensure that corrective actions will preclude repetition. Therefore, even if a licensee chooses to perform Required Action B.3.2 (the DG start), an extent of condition review is still performed for the degraded or nonconforming condition, but under the Operability Determination Process instead of the TS.

In the circumstances described in the referenced Event Notifications, the proposed change would not have altered the requirement to perform Required Actions B.3.1 and B.3.2. With the exception of EN#48186, the failures that were identified were for reasons different than the initial failure evaluated in the CCF determination.

• EN#41895 resulted in Licensee Event Report (LER) 1-2005-006. A review of the LER was performed and determined that the initial failure of EDG No. 4 resulted in the plant performing a common cause failure (CCF) determination. That CCF determination resulted in declaring EDG No. 3 inoperable, however, EDG No. 4 was declared operable shortly thereafter. Subsequently, the corrective actions associated with the event identified concerns Page 13

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" with the 87DP relay setpoint and a conservative decision made by the plant to declare four EDGs inoperable (all DGs on both units). Based on this review, with the proposed Note, a common cause failure determination would still have been required. The decision to declare four DGs was based on results from a root cause investigation team.

• EN#42820 resulted in LER 2006-006-00. A review of the LER determined that the while the

'A' DG was inoperable for planned maintenance, a voltage regulator diode failure light was received during a test run. During subsequent testing to confirm Operability of the remaining DG per TSs, the 'B' DG displayed a diode failure light with an over-voltage condition.

Subsequent investigation determined that the failures were for different reasons. It should also be noted that the Seabrook TSs have a footnote to the ACTION stating:

• The OPERABILITY of the remaining diesel generator need not be verified if it has been successfully operated within the last 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, or if currently operating, or if the diesel generator became inoperable due to:

1. Preplanned preventive maintenance or testing,

2. An inoperable support system with no potential common mode failure for the remaining diesel generator, or

3. An independently testable component with no potential common mode failure for the remaining diesel generator.

The Seabrook TS provisions above are analogous to those requested in the proposed change discussed herein. The Seabrook TS still required verifying if a common cause failure existed and reflect the staff improvements provided as guidance in NUREG-1366 and Generic Letter 93-05

• EN#48186 resulted in LER 2012-005-00. It should be noted that this event notification and subsequent LER were not within the time frame of the review performed by the industry. A review of the LER determined that the D1 DG was declared inoperable during testing when a sustained flame was observed on the control side of the turbocharger exhaust extension. The D2 DG was run to determine if a common cause failure was present. The D2 DG was declared inoperable when an exhaust leak with a visible flame was observed in the same location as the D1 DG exhaust leak. The proposed change would not altered the requirement to either perform a common cause failure determination or perform SR 3.8.2.1 in this case, since the failure was not on a support system and there was no different type of potential CCF.

• EN#45564 resulted in LER 2009-002-00. A review of the LER determined that the 'B' EDG was declared inoperable when a technician performing maintenance grounded a wire (with a pre-existing ground) causing annunciator relays to actuate. The TS Required Actions included completing a common cause evaluation or testing the operable Train 'A' EDG. The

'A' EDG failed to start due to a failed open capacitor in a power supply for the local panel annunciator. The proposed change would not altered the requirement to either perform a common cause failure determination or perform SR 3.8.2.1 in this case, since the failure was not on a support system and there was no different type of potential CCF.

Page 14

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" The proposed addition of the Note to Required Action B.3 would not eliminate the performance of Required Action B.3.1 or B.3.2 in the described circumstance.

Question 5b Explain and provide specific examples (include examples of human error discoveries, e.g.,

improper maintenance) and how the above proposed exception to perform either B.3.1 or B.3.2 (if Required Action B.3.2 was performed on initial entry into Condition B), provides continued assurance that the Operable DG is not affected by any new or different CCF mechanism and remains Operable in all cases.

TSTF Response See the response to Question 5a.

Staff Comment 2 Consider the following Condition B, Required Action B.3.1/B.3.2 Note:

Note 2: Separate one-time performance of the Required Action NOT performed for the initial entry into Condition B is required if a new or different common cause failure mechanism is identified subsequent to initial entry into Condition B.

TSTF Response The proposed Note is dissimilar to any other Note within the TS, creating the need for additional training and interpretation of a new feature. In particular, it's unclear how the term "separate one-time performance," relates to the usage rules in Chapter 1 and Section 3.0 of the TS, and the term could be confused with "separate condition entry" Notes. The staff suggestion states that a new CCF evaluation may be performed if a new CCF mechanism is discovered, but does not specify a Completion Time. That concept is more precisely described by the proposed Completion Time of "24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from discovery of potential common cause failure mechanism."

Note that the proposed Completion Time is very similar to the Completion Times of TS 3.8.1, Required Action A.2, "24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from discovery of no offsite power to one train concurrent with inoperability of redundant required feature(s)," Required Action B.2, "4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from discovery of Condition B concurrent with inoperability of redundant required feature(s)," and Required Action C.2, "12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from discovery of Condition C concurrent with inoperability of redundant required feature(s)."

Item 6 The proposed Bases for the Required Action B.3.1 CT states:

Should a new or different potential common cause failure mechanism be discovered, the licensee is provided an additional Page 15

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to perform a revised common cause failure determination.

The Traveler states:

As evidenced by the NRC proposed Actions in GL 84-15, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was considered to be a reasonable amount of time to confirm that the Operable DG was not affected by the same problem as the inoperable DG.

Question 6a As proposed, the Traveler could allow unlimited "revisions" to the original CCF determination without performance of B.3.1 or B.3.2 by resetting the original 24-hour CT before the initial CT has expired. TS LCO 3.8.1, Condition B (One [required DG] inoperable, has a 72-hour CT).

Explain how the proposed allowance to perform multiple revisions (24-hour CT resets) without performance of B.3.1 or B.3.2 would provide assurance of continued OPERABILITY of the Operable DG(s) during the 72-hour CT period.

TSTF Response The referenced change has no effect on Required Action B.3.2. If the licensee chooses to follow Required Action B.3.2, it must be completed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. If Required Action B.3.1 is performed, it must be completed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of entering the Condition as the DG inoperability is a potential common cause failure mechanism. There is no "reset" of the Completion Time allowed. Should a new or different CCF mechanism be discovered before the first CCF determination is completed, the CCF must be completed within the initial 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> under the proposed change. Should a new or different CCF mechanism be discovered after the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time has expired, the proposed change provides 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to perform a required CCF determination.

Question 6b Explain why the proposed CCF determination would not be required to be completed within the LCOs Required Action Completion Time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (i.e., within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of declaring the DG inoperable). As proposed, it could be interpreted that the 24-hour CT would start from the time after reaching a conclusion that the failure mechanism of the first inoperable DG is due to a CCF mechanism (i.e., the failure mechanism is first evaluated for potential for a common cause) and if determined to be a CCF mechanism, then the 24-hour CT would start to determine if the other Operable DG(s) is affected and is Operable.

TSTF Response See the response to Question 6a. Should a licensee choose to perform Required Action B.3.1, the CCF determination must be completed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of entering the Condition as the DG inoperability is a potential common cause failure mechanism. The Completion Time states, "potential common cause failure mechanism." The CCF determination is performed when there is a potential CCF mechanism, not when a CCF mechanism has been confirmed.

Page 16

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" The Completion Time is applied in the same manner as the Completion Times of TS 3.8.1, Required Action A.2, "24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from discovery of no offsite power to one train concurrent with inoperability of redundant required feature(s)," Required Action B.2, "4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from discovery of Condition B concurrent with inoperability of redundant required feature(s)," and Required Action C.2, "12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from discovery of Condition C concurrent with inoperability of redundant required feature(s)."

Item 7 On Page 5, the Traveler states:

The other exception being added is when an inoperable support system governed by its own Technical Specification renders a supported DG inoperable. (Note: if the support system was not governed by its own LCO it would be "not functional" instead of "inoperable," as Operability only applies to Technical Specification systems.) Under the ISTS usage rules, inoperability of a Technical Specification supported system would usually be addressed in the actions of the inoperable support system through application of LCO 3.0.6. In those cases, the Required Action to perform a common cause failure determination would not apply.

However, in some cases the support system LCOs (such as cooling water) direct that the Conditions and Required Actions of LCO 3.8.1 be followed. In these cases the cause of the inoperability is known (the inoperable support system) and the Conditions and Required Actions of the inoperable support system contain the appropriate compensatory measures. This exception for inoperable support systems was accepted by the NRC in the past as detailed in Section 3.2 "Development of the Existing Requirements.

As stated above, STS 3.7.8, Service Water System (SWS), contains a Note (1) which states:

Enter applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources - Operating," for emergency diesel generator made inoperable by SWS.

Additionally, STS SR 3.7.8.1, is also modified by a Note which states:

Isolation of SWS flow to individual components does not render the SWS inoperable.

Question 7a Identify all DG support components, which have their own (system) TS LCO that cannot be exited once the DG support component is isolated/deenergized or would result in the support system being TS inoperable.

Page 17

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" TSTF Response As discussed in the response to Question 1b, there are few DG support systems with their own LCO, such as TS 3.8.3, "Diesel Fuel Oil, Lube Oil, and Starting Air," and, for some plant designs, the Service Water System or equivalent cooling water system. If a DG support system is inoperable, the DG is also inoperable. Both the support system and DG system LCOs are not met while the support system is inoperable (i.e., no actions are "exited" as asked in the question).

In the case of the SWS SR 3.7.8.1 Note, isolation of SWS flow to a DG would render the DG inoperable but SWS would continue to be Operable. The proposed exception to performance of Required Action B.3.1 and B.3.2 would not apply.

Question 7b Explain why a support system having its own LCO provides assurance that a CCF mechanism does not affect Operability of the Operable DG(s) in all situations.

TSTF Response See the response to Question 1c. TS 3.8.1 is the only specification which explicitly requires a CCF determination. However, when any LCO is not met the extent of condition must be determined to know which Action to enter (e.g., how many trains/divisions are inoperable).

Therefore, whenever an degraded or nonconforming condition is discovered that renders a TS system inoperable, an extent of condition review must be performed to determine if the degraded or nonconforming condition affects other redundant components.

10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," states:

Measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. In the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action taken to preclude repetition." (Emphasis added).

An inoperable Technical Specification system is a significant condition adverse to quality. In accordance with Criterion XVI, licensee processes require an evaluation of the cause of the condition adverse to quality and of the extent of condition (e.g., whether the redundant support system is Operable) in order to ensure that corrective actions will preclude repetition. The NRC routinely inspects licensee's Quality Assurance and Corrective Action Programs, including the quality, scope, and timing of extent of condition evaluations.

In practice, one of the first actions when a system is determined to be inoperable is an extent of condition review of the redundant system, in order to determine the appropriate TS Condition to be entered. The NRC Operability Guidance states that Operability Determinations should include consideration of the SSCs that are affected by a degraded or nonconforming condition and the extent of condition for all similarly affected SSCs. Appendix C.9 provides additional information:

Page 18

Response to NRC Request for Additional Information Regarding TSTF-531, Revision 0, "Revision of Specification 3.8.1, Required Actions B.3.1 and B.3.2" Upon discovery of a support system that is not capable of performing its related support function(s), the most important consideration is the possibility of having lost all capability to perform a specified safety function. Upon declaring a support or supported system inoperable in one train, the required actions in the [Technical Specifications] TSs should be implemented. The licensee must verify that the facility has not lost the complete capability to perform the specified safety function. (emphasis added)

Therefore, the Operability Determination Process and the inoperable support system TS requirements provide assurance that a CCF mechanism does not affect Operability of the redundant support system, and the DG(s) supported by that system. In fact, the TS and Operability Determination Process provide assurance that the Operability of a redundant component is determined in all situations, regardless of whether it supports a DG or any other TS system.

Question 7c Identify all DG systems for which this proposed exception would apply and the specific actions in the system LCO that provide assurance of continued Operability of the Operable DG(s) in situations where the LCO does not specifically require the DG to be declared inoperable.

TSTF Response The question reflects a misunderstanding of how TS are applied. If a support system is inoperable, the supported systems are inoperable. LCO 3.0.6 provides an allowance to not follow the Required Actions of the inoperable supported system. See the Bases of LCO 3.0.6 for examples of support/supported relationships. Therefore, there are no instances in which a DG support system LCO is not met and the DG is Operable.

Page 19