IR 05000440/2017009: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(Created page by program invented by StriderTol)
 
(4 intermediate revisions by the same user not shown)
Line 3: Line 3:
| issue date = 06/05/2017
| issue date = 06/05/2017
| title = NRC Inspection Report 05000440/2017009 and Preliminary White Finding
| title = NRC Inspection Report 05000440/2017009 and Preliminary White Finding
| author name = Louden P L
| author name = Louden P
| author affiliation = NRC/RGN-III/DRP
| author affiliation = NRC/RGN-III/DRP
| addressee name = Hamilton D
| addressee name = Hamilton D
Line 19: Line 19:


=Text=
=Text=
{{#Wiki_filter:
{{#Wiki_filter:UNITED STATES une 5, 2017
[[Issue date::June 5, 2017]]


EA-17-043
==SUBJECT:==
PERRY NUCLEAR POWER PLANTNRC INSPECTION REPORT 05000440/2017009 AND PRELIMINARY WHITE FINDING


Mr. David Hamilton Site Vice President
==Dear Mr. Hamilton:==
On April 27, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Perry Nuclear Power Plant and the inspectors discussed the results of this inspection with you and other members of your staff. The results of this inspection are documented in the enclosed report.
 
The enclosed report documents a finding with an associated apparent violation that the NRC has preliminarily determined to be White, with low-to-moderate safety significance and an associated Technical Specification (TS) violation of TS 3.8.1, AC Sources-Operating. This finding involved the licensees failure to evaluate the effects of voltage suppression diode failure on the Standby Diesel Generator (SDG) control circuit, which was a component subject to the requirements of Title 10 Code of Federal Regulations (CFR) Part 50, Appendix B. Specifically, the licensee failed to consider the effect of a shorted diode on the control circuitry of the SDG, and, as a result, failed to recognize that installation of voltage suppression diodes across control relays, with no mitigation for diode failure, was not suitable for the SDG control circuit. This introduction of new components (diodes) into the control circuitry resulted in the eventual failure of the SDG control circuit, thereby rendering the SDG inoperable and unable to start.


FirstEnergy Nuclear Operating Company Perry Nuclear Power Plant Mail Stop A-PY-A290 P.O. Box 97, 10 Center Road Perry, OH 44081-0097
We assessed the significance of the finding using the significance determination process (SDP) and readily available information. We are considering escalated enforcement for the apparent violation consistent with our Enforcement Policy, which can be found at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. Because we have not made a final determination, no notice of violation is being issued at this time. Please be aware that further NRC review may prompt us to modify the number and characterization of the apparent violation(s).


SUBJECT: PERRY NUCLEAR POWER PLANT-NRC INSPECTION REPORT 05000440/2017009 AND PRELIMINARY WHITE FINDING
We intend to issue our final significance determination and enforcement decision, in writing, within 90 days from the date of this letter. The NRCs SDP is designed to encourage an open dialogue between your staff and the NRC; however, neither the dialogue nor the written information you provide should affect the timeliness of our final determination. Before we make a final decision, you may choose to communicate your position on the facts and assumptions used to arrive at the finding and assess its significance by either:
(1) attending and presenting at a Regulatory Conference, or (2) submitting your position in writing. The focus of a Regulatory Conference is to discuss the significance of the finding.


==Dear Mr. Hamilton:==
Written responses should reference the inspection report number and enforcement action number associated with this letter in the subject line. Your written response should be sent to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Center, Washington, DC 20555-001, with a copy to Mr. Jamnes Cameron, Chief, Branch 4, Division of Reactor Projects, U.S. Nuclear Regulatory Commission, Region III, 2443 Warrenville Road, Lisle, IL 60532.
On April 27, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Perry Nuclear Power Plant and the inspectors discussed the results of this inspection with you and other members of your staff. The results of this inspection are documented in the enclosed report. The enclosed report documents a finding with an associated apparent violation that the NRC has preliminarily determined to be White, with low-to-moderate safety significance and an associated Technical Specification (TS) violation of TS 3.8.1, "AC Sources-Operating." This finding involved the licensee's failure to evaluate the effects of voltage suppression diode failure on the Standby Diesel Generator (SDG) control circuit, which was a component subject to the requirements of Title 10 Code of Federal Regulations (CFR) Part 50, Appendix B. Specifically, the licensee failed to consider the effect of a shorted diode on the control circuitry of the SDG, and, as a result, failed to recognize that installation of voltage suppression diodes across control relays, with no mitigation for diode failure, was not suitable for the SDG control circuit. This introduction of new components (diodes) into the control circuitry resulted in the eventual failure of the SDG control circuit, thereby rendering the SDG inoperable and unable to start.


We assessed the significance of the finding using the significance determination process (SDP) and readily available information. We are considering escalated enforcement for the apparent violation consistent with our Enforcement Policy, which can be found at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. Because we have not made a final determination, no notice of violation is being issued at this time. Please be aware that further NRC review may prompt us to modify the number and characterization of the apparent violation(s)
If you request a Regulatory Conference, it should be held within 40 days of your receipt of this letter. Please provide information you would like us to consider or discuss with you at least 10 days prior to any scheduled conference. If you choose to attend a Regulatory Conference, it will be open for public observation. If you decide to submit only a written response, it should be sent to the NRC within 40 days of your receipt of this letter. If you choose not to request a Regulatory Conference or to submit a written response, you will not be allowed to appeal the NRCs final significance determination.
. We intend to issue our final significance determination and enforcement decision, in writing, within 90 days from the date of this letter. The NRC's SDP is designed to encourage an open dialogue between your staff and the NRC; however, neither the dialogue nor the written information you provide should affect the timeliness of our final determination. Before we make a final decision, you may choose to communicate your position on the facts and assumptions used to arrive at the finding and assess its significance by either:
(1) attending and presenting at a Regulatory Conference, or (2) submitting your position in writing. The focus of a Regulatory Conference is to discuss the significance of the finding. Written responses should reference the inspection report number and enforcement action number associated with this letter in the subject line. Your written response should be sent to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Center, Washington, DC 20555-001, with a copy to Mr. Jamnes Cameron, Chief, Branch 4, Division of Reactor Projects, U.S. Nuclear Regulatory Commission, Region III, 2443 Warrenville Road, Lisle, IL 60532. If you request a Regulatory Conference, it should be held within 40 days of your receipt of this letter. Please provide information you would like us to consider or discuss with you at least 10 days prior to any scheduled conference. If you choose to attend a Regulatory Conference, it will be open for public observation. If you decide to submit only a written response, it should be sent to the NRC within 40 days of your receipt of this letter. If you choose not to request a Regulatory Conference or to submit a written response, you will not be allowed to appeal the NRC's final significance determination. Please contact Mr. Jamnes Cameron at 630-829-9833, and in writing, within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision. The final resolution of this matter will be conveyed in separate correspondence. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, "Public Inspections, Exemptions, Requests for Withholding" Electronic Reading Room.


Sincerely,/RA/
Please contact Mr. Jamnes Cameron at 630-829-9833, and in writing, within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision.
Patrick L. Louden, Director


Division of Reactor Projects
The final resolution of this matter will be conveyed in separate correspondence.


Docket No. 50-440 License No. NPF-58
This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding Electronic Reading Room.


===Enclosure:===
Sincerely,
/RA/
Patrick L. Louden, Director Division of Reactor Projects Docket No. 50-440 License No. NPF-58 Enclosure:
Inspection Report 05000440/2017009 cc: Distribution via LISTSERV
Inspection Report 05000440/2017009 cc: Distribution via LISTSERV


=SUMMARY=
=SUMMARY=
Inspection Report 05000440/2017009; Perry Nuclear Power Plant; Identification and Resolution of Problems. The enclosed inspection report documents a finding that has preliminarily been determined to be White, a finding with low to moderate safety significance, that may require additional  
Inspection Report 05000440/2017009; Perry Nuclear Power Plant; Identification and Resolution of Problems.
 
The enclosed inspection report documents a finding that has preliminarily been determined to be White, a finding with low to moderate safety significance, that may require additional U.S. Nuclear Regulatory Commission (NRC) inspections, regulatory actions, and oversight, with an associated violation of Technical Specification (TS) 3.8.1, AC Sources-Operating.


U.S. Nuclear Regulatory Commission (NRC) ins pections, regulatory actions, and oversight, with an associated violation of Technical Specification (TS) 3.8.1, "AC Sources-Operating."  The significance of inspection findings is indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) and determined using Inspection Manual Chapter (IMC) 0609,  
The significance of inspection findings is indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) and determined using Inspection Manual Chapter (IMC) 0609,
"Significance Determination Process," dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310, "Aspects Within the Cross-Cutting Areas," dated December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRC's Enforcement Policy, dated November 1, 2016. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," dated July 2016.
Significance Determination Process, dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310, Aspects Within the Cross-Cutting Areas, dated December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated November 1, 2016. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649,
Reactor Oversight Process, dated July 201


===NRC-Identified===
===NRC-Identified===
and Self-Revealed Findings  
and Self-Revealed Findings
 
===Cornerstone: Mitigating Systems===


===Cornerstone: Mitigating Systems Preliminary ===
Preliminary
: '''White.'''
: '''White.'''
The inspectors identifi ed a finding preliminarily determined to be of low to moderate safety significance (White), and an associated apparent violation of Title 10 of the Code of Federal Regulations (10 CFR) 50, Criterion III, "Design Control," for the licensee's failure to implement measures for the selection and review for suitability of application of voltage suppression diodes installed in the control circuitry for the Division 2 Standby Diesel Generator, which was a component subject to the requirements of 10 CFR Part 50, Appendix B. Specifically, Engineering Change Package 04-00049 failed to consider the effects of a shorted diode on the control circuitry for the Division 2 Standby Diesel Generator, and instead, introduced new components (diodes) into the control circuitry that resulted in the eventual failure of this safety-related equipment. This rendered the standby diesel generator inoperable and unable to start for longer than its technical specification allowed outage time, which was a violation of Technical Specification 3.8.1, "AC Sources-Operating.The licensee documented the issue in CR 2016-13183, and subsequently replaced the failed component and then modified circuitry to remove the replacement diode and the remaining diodes from similar components. The inspectors determined that the licensee's failure to evaluate the effects of voltage suppression diode failure on the Standby Diesel Generator control circuit was contrary to the requirements of 10 CFR Part 50, Appendix B, Criterion III and a performance deficiency which was within the licensee's ability to foresee and prevent. The inspectors determined that the performance deficiency was of more than minor significance because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the design of the Division 2 Standby Diesel Generator control circuit resulted in the inoperability and unavailability of the Division 2 Standby Diesel Generator from April 2, 2015, to November 8, 2016, when the failed diode was replaced.
The inspectors identified a finding preliminarily determined to be of low to moderate safety significance (White), and an associated apparent violation of Title 10 of the Code of Federal Regulations (10 CFR) 50, Criterion III, Design Control, for the licensees failure to implement measures for the selection and review for suitability of application of voltage suppression diodes installed in the control circuitry for the Division 2 Standby Diesel Generator, which was a component subject to the requirements of 10 CFR Part 50, Appendix B. Specifically, Engineering Change Package 04-00049 failed to consider the effects of a shorted diode on the control circuitry for the Division 2 Standby Diesel Generator, and instead, introduced new components (diodes) into the control circuitry that resulted in the eventual failure of this safety-related equipment. This rendered the standby diesel generator inoperable and unable to start for longer than its technical specification allowed outage time, which was a violation of Technical Specification 3.8.1, AC Sources-Operating. The licensee documented the issue in CR 2016-13183, and subsequently replaced the failed component and then modified circuitry to remove the replacement diode and the remaining diodes from similar components.
 
The inspectors determined that the licensees failure to evaluate the effects of voltage suppression diode failure on the Standby Diesel Generator control circuit was contrary to the requirements of 10 CFR Part 50, Appendix B, Criterion III and a performance deficiency which was within the licensees ability to foresee and prevent. The inspectors determined that the performance deficiency was of more than minor significance because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the design of the Division 2 Standby Diesel Generator control circuit resulted in the inoperability and unavailability of the Division 2 Standby Diesel Generator from April 2, 2015, to November 8, 2016, when the failed diode was replaced.


A Significance and Enforcement Review Panel, using IMC 0609, Appendix A, "Significance Determination Process for Findings At-Power," dated June 19, 2012, preliminarily determined the finding to be of low-to-moderate safety significance. The inspectors did not identify any cross-cutting aspects associated with this finding because the condition had existed since at least 2007, when the diodes were originally installed in the DC control power circuits, and therefore, was not indicative of current plant performance. (Section 4OA2.1)
A Significance and Enforcement Review Panel, using IMC 0609, Appendix A,
Significance Determination Process for Findings At-Power, dated June 19, 2012, preliminarily determined the finding to be of low-to-moderate safety significance. The inspectors did not identify any cross-cutting aspects associated with this finding because the condition had existed since at least 2007, when the diodes were originally installed in the DC control power circuits, and therefore, was not indicative of current plant performance. (Section 4OA2.1)
Licensee Identified Finding None.
Licensee Identified Finding None.
4


=REPORT DETAILS=
=REPORT DETAILS=
Line 69: Line 77:
==OTHER ACTIVITIES==
==OTHER ACTIVITIES==


===Cornerstone:===
===Cornerstone: Mitigating Systems===
Mitigating Systems
{{a|4OA2}}
{{a|4OA2}}
==4OA2 Identification and Resolution of Problems==
==4OA2 Identification and Resolution of Problems==
{{IP sample|IP=IP 71152}}
{{IP sample|IP=IP 71152}}
===.1 Annual Follow-up of Selected Issues:===
===.1 Annual Follow-up of Selected Issues: Division 2 Diesel Generator Failure to Start due to===
Division 2 Diesel Generator Failure to Start due to a Failed Diode in the 125 VDC Control Power Circuit
 
a Failed Diode in the 125 VDC Control Power Circuit


====a. Inspection Scope====
====a. Inspection Scope====
The inspectors reviewed corrective actions and the licensee's causal analysis for condition report (CR) 2016-06450, which documented the failure of the Division 2 Standby Diesel Generator (SDG) to start during a routine surveillance test conducted on May 6, 2016. The failure to start was due to a shorted surge suppressor diode for relay R11A, a relay in the normal start portion of the 125 VDC control power circuit for the SDG. The inspectors evaluated the licensee's identified failure mechanisms and associated corrective actions for that event in light of a subsequent failure of a shorted surge suppressor diode for relay R10BB in the emergency start circuit for the same SDG that occurred on November 6, 2016. The inspectors also reviewed the licensee's corrective actions and causal analysis for the subsequent failure. As appropriate, the inspectors verified the following attributes during their review of the licensee's corrective actions for the above condition report and other related condition reports:
The inspectors reviewed corrective actions and the licensees causal analysis for condition report (CR) 2016-06450, which documented the failure of the Division 2 Standby Diesel Generator (SDG) to start during a routine surveillance test conducted on May 6, 2016. The failure to start was due to a shorted surge suppressor diode for relay R11A, a relay in the normal start portion of the 125 VDC control power circuit for the SDG. The inspectors evaluated the licensees identified failure mechanisms and associated corrective actions for that event in light of a subsequent failure of a shorted surge suppressor diode for relay R10BB in the emergency start circuit for the same SDG that occurred on November 6, 2016. The inspectors also reviewed the licensees corrective actions and causal analysis for the subsequent failure.
 
As appropriate, the inspectors verified the following attributes during their review of the licensee's corrective actions for the above condition report and other related condition reports:
* complete an accurate identification of the problem in a timely manner commensurate with its safety significance and ease of discovery;
* complete an accurate identification of the problem in a timely manner commensurate with its safety significance and ease of discovery;
* consideration of the extent of condition, generic implications, common cause, and previous occurrences;
* consideration of the extent of condition, generic implications, common cause, and previous occurrences;
Line 87: Line 97:
* completion of corrective actions in a timely manner commensurate with the safety significance of the issue;
* completion of corrective actions in a timely manner commensurate with the safety significance of the issue;
* effectiveness of corrective actions taken to preclude repetition; and
* effectiveness of corrective actions taken to preclude repetition; and
* evaluate applicability for operating experience and communicate applicable lessons learned to appropriate organizations. The inspectors discussed the corrective actions and associated evaluations with licensee personnel. This review constituted one in-depth problem identification and resolution inspection sample as defined in Inspection Procedure (IP) 71152.
* evaluate applicability for operating experience and communicate applicable lessons learned to appropriate organizations.
 
The inspectors discussed the corrective actions and associated evaluations with licensee personnel.
 
This review constituted one in-depth problem identification and resolution inspection sample as defined in Inspection Procedure (IP) 71152.


====b. Findings====
====b. Findings====


=====Introduction:=====
=====Introduction:=====
The inspectors identified a preliminary White finding associated with an Apparent Violation (AV) of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Criterion III, "Design Control," and an associated violation of TS 3.8.1, for the licensee's failure to implement measures for the selection and review for suitability of application of voltage suppression diodes installed in the control circuitry for the Division 2 SDG, which was a component subject to the requirements of 10 CFR Part 50, Appendix B.
The inspectors identified a preliminary White finding associated with an Apparent Violation (AV) of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Criterion III, Design Control, and an associated violation of TS 3.8.1, for the licensees failure to implement measures for the selection and review for suitability of application of voltage suppression diodes installed in the control circuitry for the Division 2 SDG, which was a component subject to the requirements of 10 CFR Part 50, Appendix B.


Specifically, Engineering Change Package 04-00049 failed to consider the effects of a shorted diode on the control circuitry for the Division 2 SDG, and introduced new components (diodes) into the control circuitry, resulting in the eventual failure of this safety-related equipment, rendering the SDG inoperable and unable to start via the emergency start circuit from April 2, 2015, until the failed diode was replaced on November 8, 2016.
Specifically, Engineering Change Package 04-00049 failed to consider the effects of a shorted diode on the control circuitry for the Division 2 SDG, and introduced new components (diodes) into the control circuitry, resulting in the eventual failure of this safety-related equipment, rendering the SDG inoperable and unable to start via the emergency start circuit from April 2, 2015, until the failed diode was replaced on November 8, 2016.


=====Description:=====
=====Description:=====
On May 6, 2016, while conducting a post-maintenance test of the Division 2 SDG using the normal start circuit, all control power to the SDG was lost, rendering the SDG inoperable. The licensee's investigation determined that the failure was due to a shorted surge suppressor diode for relay R11A, installed as part of a modification implemented in 2007. This diode shorted together the positive and negative sides of the control power to the circuitry and caused the125VDC supply breakers (CB-1, CB-2, CB-3, and CB-4) for the two available sources of power to open and de-energize the control circuitry thus rendering the diesel generator incapable of performing its design function. The licensee replaced the failed diode and successfully re-tested the SDG.
On May 6, 2016, while conducting a post-maintenance test of the Division 2 SDG using the normal start circuit, all control power to the SDG was lost, rendering the SDG inoperable. The licensees investigation determined that the failure was due to a shorted surge suppressor diode for relay R11A, installed as part of a modification implemented in 2007. This diode shorted together the positive and negative sides of the control power to the circuitry and caused the125VDC supply breakers (CB-1, CB-2, CB-3, and CB-4) for the two available sources of power to open and de-energize the control circuitry thus rendering the diesel generator incapable of performing its design function. The licensee replaced the failed diode and successfully re-tested the SDG.
 
Since the licensee did not characterize the failure as a significant condition adverse to quality, a formal root cause analysis was neither required nor performed.


Since the licensee did not characterize the failure as a significant condition adverse to quality, a formal root cause analysis was neither required nor performed. During troubleshooting testing, the licensee performed continuity testing of other diodes in the normal and emergency start circuits for the Division 2 SDG, including a diode associated with relay R10BB, which was associated with the emergency start circuit of the Division 2 SDG and which was also installed as part of the 2007 modification.
During troubleshooting testing, the licensee performed continuity testing of other diodes in the normal and emergency start circuits for the Division 2 SDG, including a diode associated with relay R10BB, which was associated with the emergency start circuit of the Division 2 SDG and which was also installed as part of the 2007 modification.


However, the testing was insufficient to detect a degraded condition of that diode.
However, the testing was insufficient to detect a degraded condition of that diode.


Subsequent vendor testing determined that resistance checks are insufficient to detect failed diodes, and reverse bias leakage current testing was necessary to identify the degraded condition. On November 6, 2016, while performing PTI-R43-P0006B; Division 2 Diesel Generator Pneumatic Logic Board Functional Check; Revision 15, 125 VDC circuit breakers CB-1, CB-2, CB-3, and CB-4 opened. The licensee entered this failure of the Division 2 SDG into its Corrective Action Program (CAP) as CR 2016-13183. Subsequent troubleshooting and causal analysis revealed that a diode installed for voltage suppression across control relay R10BB failed and caused a short circuit condition on the 125VDC control circuit. The short circuit condition resulted in the 125VDC circuit breakers CB-1, CB-2, CB-3, and CB-4 opening and a subsequent loss of control power to the Division 2 SDG; the same condition that occurred during the May 16, 2016, failure of the normal start circuit. As stated above, relay R10BB is used in the diesel generator's emergency start circuity (i.e. Loss of Off-site Power (LOOP) or Loss of Coolant Accident (LOCA)). The last successful test of the SDG emergency start circuitry was on April 2, 2015. The R10BB relay is not used in the circuit for normal starts.
Subsequent vendor testing determined that resistance checks are insufficient to detect failed diodes, and reverse bias leakage current testing was necessary to identify the degraded condition.
 
On November 6, 2016, while performing PTI-R43-P0006B; Division 2 Diesel Generator Pneumatic Logic Board Functional Check; Revision 15, 125 VDC circuit breakers CB-1, CB-2, CB-3, and CB-4 opened. The licensee entered this failure of the Division 2 SDG into its Corrective Action Program (CAP) as CR 2016-13183. Subsequent troubleshooting and causal analysis revealed that a diode installed for voltage suppression across control relay R10BB failed and caused a short circuit condition on the 125VDC control circuit. The short circuit condition resulted in the 125VDC circuit breakers CB-1, CB-2, CB-3, and CB-4 opening and a subsequent loss of control power to the Division 2 SDG; the same condition that occurred during the May 16, 2016, failure of the normal start circuit. As stated above, relay R10BB is used in the diesel generators emergency start circuity (i.e. Loss of Off-site Power (LOOP) or Loss of Coolant Accident (LOCA)). The last successful test of the SDG emergency start circuitry was on April 2, 2015. The R10BB relay is not used in the circuit for normal starts.
 
The inspectors reviewed Engineering Change Package (ECP) 04-00049, Standby Diesel Generator Governor Replacement, which installed control relays R10BB and R11A and their associated voltage suppression diodes in 2007. The inspectors determined that this modification installed voltage suppression diodes across several control relays, including relays R11A and R10BB. The inspectors noted that the ECP addressed how installation of voltage suppression diodes would limit high voltages during relay coil de-energization, but failed to address the effects of a diode failure on the control circuit, specifically in a shorted condition. The inspectors reviewed drawing 206-0216-00006 Sheet 2 Revision Z, Standby Diesel Engine Control Panel 1H51-P054B, and determined that failure of the voltage suppression diode for relay R10BB would result in an effective fault condition on the 125 VDC control power circuit and a subsequent loss of control power (via opening of circuit breakers CB-1, CB-2, CB-3, and CB-4) during an emergency start of the SDG. This loss of control power would render the SDG inoperable and unavailable, even through the normal start circuit.
 
The inspectors were concerned that the licensee failed to evaluate the effects of modifying the SDG control power circuit with voltage suppression diodes and, therefore, failed to establish measures to assure the suitability of application of parts and equipment that are essential to safety-related functions of structures, systems, and components. Specifically, the installation of voltage suppression diodes, without mitigation for diode failure, was not suitable for use in the SDG control circuit because it caused an undetectable failure of the SDG. The installation of these diodes produced no apparent safety benefit to the control system to counter the additional unreliability introduced by the new components. This point was documented in the 10 CFR Part 21 notification that Engine Systems, Inc. issued for the diodes on March 27, 2017 (EN 52642). The notification stated that it was acceptable to remove the diodes from their relays and that no changes or impacts would be expected for the associated equipment. The licensee, in its root cause evaluation, similarly determined that the diodes were not required to protect components in the control power circuits and could be removed.
 
In its root cause evaluation, the licensee determined that the loss of control power to the Division 2 SDG on May 16, 2016, and on November 6, 2016, was due to a manufacturing defect in the diodes associated with relays R11A and R10BB, respectively, and thus beyond its ability to foresee and prevent. Although the inspectors do not dispute whether there was a manufacturing defect in the failed diodes, they determined that the point was not pertinent to the licensees failure to evaluate the effects of voltage suppression diode failure. In each case, the failed diodes provided an indication that the licensees modification installed in 2007, introduced new components (diodes) into the SDG control circuit design such that their failure resulted in the eventual failure of safety-related equipment (the Division 2 SDG) nine years after initial installation. The inspectors determined that following the previous testing of the circuit on April 2, 2015, the emergency start circuit diode would have either failed (shorted) the next time the circuit was energized (e.g., demand for emergency start from a loss of off-site power or loss of coolant accident) or that the diode failed when the testing was completed and the circuit was de-energized.


The inspectors reviewed Engineering Change Package (ECP) 04-00049, Standby Diesel Generator Governor Replacement, which installed control relays R10BB and R11A and their associated voltage suppression diodes in 2007. The inspectors determined that this modification installed voltage suppression diodes across several control relays, including relays R11A and R10BB. The inspectors noted that the ECP addressed how installation of voltage suppression diodes would limit high voltages during relay coil de-energization, but failed to address the effects of a diode failure on the control circuit, specifically in a shorted condition. The inspectors reviewed drawing 206-0216-00006 Sheet 2 Revision Z, Standby Diesel Engine Control Panel 1H51-P054B, and determined that failure of the voltage suppression diode for relay R10BB would result in an effective fault condition on the 125 VDC control power circuit and a subsequent loss of control power (via opening of circuit breakers CB-1, CB-2, CB-3, and CB-4) during an emergency start of the SDG. This loss of control power would render the SDG inoperable and unavailable, even through the normal start circuit. The inspectors were concerned that the licensee failed to evaluate the effects of modifying the SDG control power circuit with voltage suppression diodes and, therefore, failed to establish measures to assure the suitability of application of parts and equipment that are essential to safety-related functions of structures, systems, and components. Specifically, the installation of voltage suppression diodes, without mitigation for diode failure, was not suitable for use in the SDG control circuit because it caused an undetectable failure of the SDG. The installation of these diodes produced no apparent safety benefit to the control system to counter the additional unreliability introduced by the new components. This point was documented in the 10 CFR Part 21 notification that Engine Systems, Inc. issued for the diodes on March 27, 2017 (EN 52642). The notification stated that it was acceptable to remove the diodes from their relays and that no changes or impacts would be expected for the associated equipment. The licensee, in its root cause evaluation, similarly determined that the diodes were not required to protect components in the control power circuits and could be removed. In its root cause evaluation, the licensee determined that the loss of control power  to the Division 2 SDG on May 16, 2016, and on November 6, 2016, was due to a manufacturing defect in the diodes associated with relays R11A and R10BB, respectively, and thus beyond its ability to foresee and prevent. Although the inspectors do not dispute whether there was a manufacturing defect in the failed diodes, they determined that the point was not pertinent to the licensee's failure to evaluate the effects of voltage suppression diode failure. In each case, the failed diodes provided an indication that the licensee's modification installed in 2007, introduced new components (diodes) into the SDG control circuit design such that their failure resulted in the eventual failure of safety-related equipment (the Division 2 SDG) nine years after initial installation. The inspectors determined that following the previous testing of the circuit on April 2, 2015, the emergency start circuit diode would have either failed (shorted) the next time the circuit was energized (e.g., demand for emergency start from a loss of off-site power or loss of coolant accident) or that the diode failed when the testing was completed and the circuit was de-energized. The licensee's corrective actions included replacing the failed diode, performing PTI-R43-P0006B satisfactorily, and implementing modification ECP 16-0348, "Modify Division 1 and Division 2 Diesel Generator control circuitry for relay flyback diode failure," to remove the voltage suppression diodes from the SDG control circuitry.
The licensees corrective actions included replacing the failed diode, performing PTI-R43-P0006B satisfactorily, and implementing modification ECP 16-0348, Modify Division 1 and Division 2 Diesel Generator control circuitry for relay flyback diode failure, to remove the voltage suppression diodes from the SDG control circuitry.


=====Analysis:=====
=====Analysis:=====
Title 10 of the CFR, Part 50, Appendix B, Criterion III, "Design Control," requires, in part, that measures be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components. The inspectors determined that the licensee's failure to evaluate the effects of voltage suppression diode failure on the SDG control circuit was contrary to the requirements of 10 CFR Part 50, Appendix B, Criterion III, and a performance deficiency. Specifically, the licensee failed to consider the effect of a shorted diode on the control circuitry of the SDG and, as a result, failed to recognize that installation of voltage suppression diodes across control relays, with no mitigation for diode failure, was not a suitable modification of the SDG control circuit. The inspectors determined that the performance deficiency was of more than minor significance because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the design of the Division 2 SDG control circuit resulted in the inoperability and unavailability of the Division 2 SDG when diode R10BB failed in the shorted condition. The inspectors determined the finding could be evaluated using the Significance Determination Process (SDP) in accordance with IMC 0609, "Significance Determination Process," Attachment 0609.04, "Initial Characterization of Findings," dated October 7, 2016, and Appendix A, "The Significance Determination Process for Findings At-Power," Exhibit 2, "Mitigating Systems Screening Questions," dated June 19, 2012. The finding represented an actual loss of system safety function of the Division 2 diesel generator for greater than its TS 3.8.1.B4 allowed outage time of 14 days. Therefore, a detailed risk evaluation was performed in accordance with IMC 0609, Appendix A.
Title 10 of the CFR, Part 50, Appendix B, Criterion III, Design Control, requires, in part, that measures be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components. The inspectors determined that the licensees failure to evaluate the effects of voltage suppression diode failure on the SDG control circuit was contrary to the requirements of 10 CFR Part 50, Appendix B, Criterion III, and a performance deficiency. Specifically, the licensee failed to consider the effect of a shorted diode on the control circuitry of the SDG and, as a result, failed to recognize that installation of voltage suppression diodes across control relays, with no mitigation for diode failure, was not a suitable modification of the SDG control circuit.
 
The inspectors determined that the performance deficiency was of more than minor significance because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the design of the Division 2 SDG control circuit resulted in the inoperability and unavailability of the Division 2 SDG when diode R10BB failed in the shorted condition.
 
The inspectors determined the finding could be evaluated using the Significance Determination Process (SDP) in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, dated October 7, 2016, and Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated June 19, 2012.
 
The finding represented an actual loss of system safety function of the Division 2 diesel generator for greater than its TS 3.8.1.B4 allowed outage time of 14 days. Therefore, a detailed risk evaluation was performed in accordance with IMC 0609, Appendix A.
 
A Region III Senior Reactor Analyst (SRA) performed a detailed risk evaluation using the NRCs Standardized Plant Analysis Risk (SPAR) Model for Perry, Revision 8.19. The SRA determined that several changes to the SPAR model were necessary to fully capture plant-specific features affecting the dominant risk sequences for this evaluation.
 
Idaho National Laboratory staff who maintain the SPAR models for the NRC made the model changes as requested by the SRA. The changes included the ability to cross-tie direct current (DC) power, fast fire water injection, and the ability to vent containment under station blackout conditions.
 
The Perry plant has additional equipment originally intended for a second unit that includes a second set of DC batteries that can be aligned to support the operating unit.


A Region III Senior Reactor Analyst (SRA) performed a detailed risk evaluation using the NRC's Standardized Plant Analysis Risk (SPAR) Model for Perry, Revision 8.19. The SRA determined that several changes to t he SPAR model were necessary to fully capture plant-specific features affecting the dominant risk sequences for this evaluation. Idaho National Laboratory staff who maintain the SPAR models for the NRC made the model changes as requested by the SRA. The changes included the ability to cross-tie direct current (DC) power, fast fire water injection, and the ability to vent containment under station blackout conditions. The Perry plant has additional equipment originally intended for a second unit that includes a second set of DC batteries that can be aligned to support the operating unit.
This alignment under station blackout scenarios can provide adequate DC power for the full 24 hour PRA mission time. This plant specific feature can support continued high pressure core spray (HPCS) operation and containment venting in certain station black-out (SBO) scenarios such that offsite power recovery is not required for 24 hours.


This alignment under station blackout scenarios can provide adequate DC power for the full 24 hour PRA mission time. This plant specific feature can support continued high pressure core spray (HPCS) operation and containment venting in certain station  black-out (SBO) scenarios such that offsite power recovery is not required for 24 hours. The plant has a fast fire water injection capability that supports the use of a diesel fire water pump for low pressure injection to the reactor pressure vessel in certain SBO scenarios when injection using the reactor core isolation cooling (RCIC) system is initially successful. For these station blackout scenarios, offsite power recovery is required within eight hours if containment venting is not available.
The plant has a fast fire water injection capability that supports the use of a diesel fire water pump for low pressure injection to the reactor pressure vessel in certain SBO scenarios when injection using the reactor core isolation cooling (RCIC) system is initially successful. For these station blackout scenarios, offsite power recovery is required within eight hours if containment venting is not available.


The Perry SPAR model was also modified to change the common cause component group (CCCG) for the Standby Diesel Generators. A CCCG models a group of components that are similar in design, operation, and maintenance, and therefore susceptible to failure from common causes. The determination of a CCCG typically includes components within a system and does not routinely extend to like components  
The Perry SPAR model was also modified to change the common cause component group (CCCG) for the Standby Diesel Generators. A CCCG models a group of components that are similar in design, operation, and maintenance, and therefore susceptible to failure from common causes. The determination of a CCCG typically includes components within a system and does not routinely extend to like components across system boundaries. The SPAR model baseline CCCG included the Division 1, Division 2, and Division 3 diesel generators. Although there are similarities across all three diesel generators, the NRC determined that the Division 3 diesel generator should not be included in the CCCG, primarily because it is significantly different in size, manufacturer, and function. The CCCG was modified to include only the Division 1 and Division 2 Standby Diesel Generators.


across system boundaries. The SPAR model baseline CCCG included the Division 1, Division 2, and Division 3 diesel generators. Although there are similarities across all three diesel generators, the NRC determined that the Division 3 diesel generator should not be included in the CCCG, primarily because it is significantly different in size, manufacturer, and function. The CCCG was modified to include only the Division 1 and Division 2 Standby Diesel Generators. In addition to the modeling changes descri bed in the previous paragraphs, the SPAR model was updated with the most recent diesel generator failure probabilities and common cause alpha factors. The data are on the NRC's public website at http://nrcoe.inl.gov/resultsdb/. The SRA made the following assumptions about the degraded plant condition for the detailed risk evaluation:
In addition to the modeling changes described in the previous paragraphs, the SPAR model was updated with the most recent diesel generator failure probabilities and common cause alpha factors. The data are on the NRCs public website at http://nrcoe.inl.gov/resultsdb/.
* The Division 2 Standby Diesel Generator w ould not have automatically started in response to a loss of offsite power event. The basic event in the SPAR model for failure to start was set to "True".
The SRA made the following assumptions about the degraded plant condition for the detailed risk evaluation:
* The Division 2 Standby Diesel Generator would not have automatically started in response to a loss of offsite power event. The basic event in the SPAR model for failure to start was set to True.
* The Division 2 Standby Diesel Generator could not be manually started and was not recoverable.
* The Division 2 Standby Diesel Generator could not be manually started and was not recoverable.
* The exposure time for the degraded condition used in the evaluation was one year. The degraded condition existed from April 2015 until November 2016, which is greater than one year. The "T/2" method to exposure time determination, which is 1/2 the time from the last successful operation until the standby diesel generator failure was not applicable due to the failure mechanism.
* The exposure time for the degraded condition used in the evaluation was one year. The degraded condition existed from April 2015 until November 2016, which is greater than one year. The T/2 method to exposure time determination, which is 1/2 the time from the last successful operation until the standby diesel generator failure was not applicable due to the failure mechanism.
 
The standby diesel generator emergency start function was not degrading while it was in a standby mode and was not degrading during manual start operations.
 
The maximum exposure time used in the SDP is one year.
 
The change in core damage frequency (CDF) due to the degraded condition was estimated to be 7.3E-6/yr. This is the CDF for internal events. The dominant core damage sequence involved an SBO event in which the HPCS and RCIC systems fail and power is not recovered within 30 minutes. A second dominant core damage sequence involves an SBO event in which HPCS is successful, but containment venting fails and power is not recovered.
 
The SRA considered risk contributions from internal fires and seismic events and concluded that any other external event contribution would be negligible. The internal fire CDF was estimated to be 1.5E-6/yr., which is a small risk contribution to the overall significance of the finding. The risk contribution from seismic events was determined to be less than 1E-7/yr., and did not impact the results of the detailed risk evaluation.
 
For internal fires, the SRA used the Individual Plant Examination for External Events (IPEEE) to estimate the fire risk contribution. From the IPEEE, the SRA determined that internal fires in only the control room or the turbine power complex could cause a loss of offsite power and contribute to the risk significance of this finding.
 
For the control room, the SRA determined that panels designated as Group 2B and Group 4B in the control room would contribute to a change in risk because a fire in these panels could result in a loss of offsite power event. The total fire frequency for Group 2B and 4B panels was 7.8E-4/yr. For the scenarios in which the control room is not evacuated, the SRA multiplied the fire frequency by the change in conditional core damage probability calculated using the SPAR model for a plant-centered loss of offsite power with the Division 2 standby diesel generator failed. This resulted in a CDF estimate of 1.1E-7/yr. For the scenario in which the control room is evacuated, the SRA calculated a change in risk of 3.8E-7/yr., using information in the IPEEE regarding control room evacuation scenarios that involve a loss of offsite power with no Division 2 damage due to the fire (fire damage State 3 in the IPEEE). The total delta CDF estimated for control room fires due to the degraded condition was approximately 5.0E-7/yr.


The standby diesel generator emergency start function was not degrading while it was in a standby mode and was not degrading during manual start operations. The maximum exposure time used in the SDP is one year. The change in core damage frequency (CDF) due to the degraded condition was estimated to be 7.3E-6/yr. This is the CDF for internal events. The dominant core damage sequence involved an SBO event in wh ich the HPCS and RCIC systems fail and power is not recovered within 30 minutes. A second dominant core damage sequence involves an SBO event in which HPCS is successful, but containment venting fails and power is not recovered. The SRA considered risk contributions from internal fires and seismic events and concluded that any other external event contribution would be negligible. The internal
For the Turbine Power Complex, the SRA used the same approach, combining the IPEEE fire frequency with the delta conditional core damage probability calculated using the SPAR model. The delta CDF for turbine power complex fires due to the degraded condition was estimated to be 1E-6/yr.


fire CDF was estimated to be 1.5E-6/yr., which is a small risk contribution to the overall significance of the finding. The risk contribution from seismic events was determined to be less than 1E-7/yr., and did not impact the results of the detailed risk evaluation. For internal fires, the SRA used the Individual Plant Examination for External Events (IPEEE) to estimate the fire risk contribution. From the IPEEE, the SRA determined that internal fires in only the control room or the turbine power complex could cause a loss of offsite power and contribute to the risk significance of this finding.
The SRA reviewed the potential for risk contribution due to large early release frequency (LERF) using the guidance of IMC 0609 Appendix H, Containment Integrity Significance Determination Process. The SRA applied the Appendix H LERF factor of 0.2 for BWR Mark III Containment Plants to a subset of core damage sequences that represent early core damage sequences. Using this approach, the SRA determined that the LERF contribution to the overall significance of the finding was no greater than the CDF estimate and that CDF was the appropriate metric to use in evaluating the significance of the finding.


For the control room, the SRA determined that panels designated as Group 2B and Group 4B in the control room would contribute to a change in risk because a fire in these panels could result in a loss of offsite power event. The total fire frequency for Group 2B and 4B panels was 7.8E-4/yr. For the scenarios in which the control room is not evacuated, the SRA multiplied the fire frequency by the change in conditional core damage probability calculated using the SPAR model for a plant-centered loss of offsite power with the Division 2 standby diesel generator failed. This resulted in a CDF estimate of 1.1E-7/yr. For the scenario in which the control room is evacuated, the SRA
The total CDF estimate for internal events and internal fire risk was 8.8E-6/yr., which represents a finding of low to moderate safety significance (White).


calculated a change in risk of 3.8E-7/yr., using information in the IPEEE regarding control room evacuation scenarios that involve a loss of offsite power with no Division 2 damage due to the fire (fire damage State 3 in the IPEEE). The total delta CDF estimated for control room fires due to the degraded condition was approximately 5.0E-7/yr. For the Turbine Power Complex, the SRA used the same approach, combining the IPEEE fire frequency with the delta conditional core damage probability calculated using the SPAR model. The delta CDF for turbine power complex fires due to the degraded condition was estimated to be 1E-6/yr. The SRA reviewed the potential for risk contribution due to large early release frequency (LERF) using the guidance of IMC 0609 Appendix H, "Containment Integrity Significance Determination Process."  The SRA applied the Appendix H LERF "factor" of 0.2 for BWR Mark III Containment Plants to a subset of core damage sequences that represent "early" core damage sequences. Using this approach, the SRA determined that the LERF contribution to the overall significance of the finding was no greater than the CDF estimate and that CDF was the appropriate metric to use in evaluating the significance of the finding.
The inspectors identified no cross-cutting issues associated with this finding because the condition had existed since at least 2007, when the diodes were originally installed in the DC control power circuits, and therefore, was not indicative of current plant performance.


The total CDF estimate for internal events and internal fire risk was 8.8E-6/yr., which represents a finding of low to moderate safety significance (White). The inspectors identified no cross-cutting issues associated with this finding because the condition had existed since at least 2007, when the diodes were originally installed in the DC control power circuits, and therefore, was not indicative of current plant performance.
Enforcement Title 10 of the CFR, Part 50, Appendix B, Criterion III, Design Control, requires, in part, that measures be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components. Technical Specification 3.8.1 AC Sources-Operating condition B.4 states, in part, that the required inoperable diesel generator be restored to operable status within 14 days.


Enforcement Title 10 of the CFR, Part 50, Appendix B, Criterion III, "Design Control," requires, in part, that measures be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components. Technical Specification 3.8.1 "AC Sources-Operating" condition B.4 states, in part, that the required inoperable diesel generator be restored to operable status within 14 days. From April 24, 2007, until November 8, 2016, the licensee failed to review for suitability of application of parts essential to the safety-related functions of the Division 2 Standby Diesel Generator, a safety-related system. Specifically, Engineering Change Package 04-00049 failed to consider the effects of shorted voltage suppression diodes installed on the control circuitry for the Division 2 Standby Diesel Generator, and instead, introduced new components (diodes) into the control circuitry that resulted in the eventual failure of this safety-related equipment. Consequently, on November 6, 2016, the Division 2 Standby Diesel Generator emergency start circuit diode associated with relay RR10BB was found failed after an unsuccessful attempt to test the emergency start function. The Division 2 Standby Diesel Generator was inoperable and unable to perform its emergency start function from April 2, 2015, until the emergency start diode was replaced and the Division 2 Standby Diesel Generator was returned to service on November 8, 2016, which was longer than the Technical Specification allowed outage time of 14 days. The failure to consider the effects of shorted voltage suppression diodes installed in the SDG and resultant inoperability of the Division 2 SDG are apparent violations of 10 CFR 50 Appendix B Criterion III, "Design Control" and TS 3.8.1. Immediate corrective actions included replacing the failed diode and declaring the Division 2 Standby Diesel Generator operable following post-maintenance testing. (AV05000440/2017009-01, Unsuitable Application of Surge Suppression Diodes in Standby Diesel Generator Control Power Circuitry)
From April 24, 2007, until November 8, 2016, the licensee failed to review for suitability of application of parts essential to the safety-related functions of the Division 2 Standby Diesel Generator, a safety-related system. Specifically, Engineering Change Package 04-00049 failed to consider the effects of shorted voltage suppression diodes installed on the control circuitry for the Division 2 Standby Diesel Generator, and instead, introduced new components (diodes) into the control circuitry that resulted in the eventual failure of this safety-related equipment. Consequently, on November 6, 2016, the Division 2 Standby Diesel Generator emergency start circuit diode associated with relay RR10BB was found failed after an unsuccessful attempt to test the emergency start function. The Division 2 Standby Diesel Generator was inoperable and unable to perform its emergency start function from April 2, 2015, until the emergency start diode was replaced and the Division 2 Standby Diesel Generator was returned to service on November 8, 2016, which was longer than the Technical Specification allowed outage time of 14 days. The failure to consider the effects of shorted voltage suppression diodes installed in the SDG and resultant inoperability of the Division 2 SDG are apparent violations of 10 CFR 50 Appendix B Criterion III, Design Control and TS 3.8.1. Immediate corrective actions included replacing the failed diode and declaring the Division 2 Standby Diesel Generator operable following post-maintenance testing.


    (AV05000440/2017009-01, Unsuitable Application of Surge Suppression Diodes in Standby Diesel Generator Control Power Circuitry)
{{a|4OA6}}
{{a|4OA6}}
==4OA6 Management Meeting==
==4OA6 Management Meeting==


===.1 Exit Meeting Summary On April 27, 2017, the inspectors presented the inspection results to Mr. D. Hamilton and other members of the licensee staff.===
===.1 Exit Meeting Summary===
The licensee acknowledged the issues presented.
 
On April 27, 2017, the inspectors presented the inspection results to Mr. D. Hamilton and other members of the licensee staff. The licensee acknowledged the issues presented.


The inspectors confirmed that none of the potential report input discussed was considered proprietary.
The inspectors confirmed that none of the potential report input discussed was considered proprietary.
Line 145: Line 196:
==KEY POINTS OF CONTACT==
==KEY POINTS OF CONTACT==


Licensee  
Licensee
: [[contact::D. Hamilton]], Site Vice President
: [[contact::D. Hamilton]], Site Vice President
: [[contact::F. Payne]], General Plant Manager  
: [[contact::F. Payne]], General Plant Manager
: [[contact::D. Reeves]], Director, Site Engineering  
: [[contact::D. Reeves]], Director, Site Engineering
: [[contact::D. Saltz]], Director, Site Performance Improvement  
: [[contact::D. Saltz]], Director, Site Performance Improvement
: [[contact::N. Conicella]], Manager, Site Regulatory Compliance  
: [[contact::N. Conicella]], Manager, Site Regulatory Compliance
: [[contact::L. Zerr]], Supervisor, Regulatory Compliance  
: [[contact::L. Zerr]], Supervisor, Regulatory Compliance
: [[contact::K. Nelson]], Manager, Plant Engineering  
: [[contact::K. Nelson]], Manager, Plant Engineering
: [[contact::P. Roney]], Supervisor, Nuclear Supply System Engineering  
: [[contact::P. Roney]], Supervisor, Nuclear Supply System Engineering
: [[contact::J. Caine]], Supervisor, Nuclear Electrical System Engineering  
: [[contact::J. Caine]], Supervisor, Nuclear Electrical System Engineering
: [[contact::R. Boyles]], Nuclear Engineering Specialist  
: [[contact::R. Boyles]], Nuclear Engineering Specialist
: [[contact::U.S. Nuclear Regulatory Commission J. Cameron]], Chief, Reactor Projects Branch 4  
U.S. Nuclear Regulatory Commission
: [[contact::J. Cameron]], Chief, Reactor Projects Branch 4


==LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED==
==LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED==


===Opened===
===Opened===
: 05000440/2017009-01 AV Unsuitable Application of Surge Suppression Diodes in Standby Diesel Generator Control Power Circuitry  
: 05000440/2017009-01           AV     Unsuitable Application of Surge Suppression Diodes in Standby Diesel Generator Control Power Circuitry (Section 4OA2.1)
(Section 4OA2.1)  


===Closed===
===Closed===
: None.  
 
None.
 
===Discussed===
===Discussed===


None.
None.


==LIST OF DOCUMENTS REVIEWED==
==LIST OF DOCUMENTS REVIEWED==
The following is a partial list of documents reviewed during the inspection.
 
: Inclusion on this list does not imply that the NRC inspectors reviewed the documents in their entirety, but rather that selected sections or portions of the documents were evaluated as part of the overall inspection effort.
: Inclusion of a document on this list does not imply NRC acceptance of the document or any part of it, unless this is stated in the body of the inspection report. 4OA2 Identification and Resolution of Problems -
: CR 2016-06450; Division 2 DG Abnormal Indications on Start; dated May 6, 2016 -
: CR 2016-13183; During Performance of
: PTI-R43-P0006B
: CB-1,
: CB-2,
: CB-3,
: CB-4 DC Breakers Trip when Loaded; dated November 6, 2016 - CR G202-2008-49196; Division 2 Relay Contacts Failed during Routine Maintenance; dated November 8, 2008 -
: CR 2016-14251;
: CR 2016-13183 Identified the Need to Eliminate All Remaining Surge Suppression Diodes Installed Under
: ECP-04-049 on the Division 1 and Division 2 Diesel Generators; dated December 13, 2016 -
: CR 2016-14456; PRA Evaluation Associated with the Division 2 EDG MSPI Failure  (CR 2016-13183) Indicates a Preliminary Level of Significance that Warrants a Root Cause Evaluation; December 19, 2016 -
: PRS-1916; Diesel Generator Governor Controls; Revision 3 -
: ECP 04-0049-01; 10
: CFR 50.59 Evaluation No. 06-00228; Revision 2 -
: ECP 04-0049-02 & 03; 10
: CFR 50.59 Evaluation No. 06-01428; Revision 0
-
: ECP 04-0049-02 & 03; Engineering Change Package Design Report; Revision 0
- eSOMs Plant Narrative Logs; dated November 7, 2016
-
: NOP-LP-2001; Corrective Action Program; Revision 38
-
: NORM-LP-2003; Analytical Methods Guidebook; Revision 7 -
: NOBP-LP-2008; FENOC Corrective Action Review Board; Revision 18 -
: NOBP-LP-2011; FENOC Cause Analysis; Revision 18 for
: CR 2016-06450
- Engine Systems, Inc.; Environmental Qualification Report for Governor Modification Components Woodward
: EGB-35P Governor, MPU & Connector, Accumulator & Mounting Brackets, Selector Switch & Isolation Barrier, Governor Panel / Components - First Energy Perry Nuclear Power Plant PO #
: 45200506 / ESI
: IWO 8000748 - Document Number
: 8000748-EQR-1; Revision 1; dated January 24, 2007 -
: WO 200682028; Simple Troubleshooting Plan for Division 2 Diesel Generator Failure to Start; dated May 6, 2016 - Drawing 208-0216-00006; Standby Diesel Engine Control Panel 1H51-P054B - Division 2
: 1R43-C001B; Revision AA - Drawing 208-0216-00008; Standby Diesel Engine Control Panel 1H51-P054B - Division 2
: 1R43-C001B; Revision U - Drawing 208-0216-00016; Standby Diesel Generator - Generator Control Panel 
(1H51-P055B) Division 2 1R43-S001B; Revision X - Engine Systems Inc., Part 21 Letter, Report No. 10CFR21-0116, Revision 0; dated March 27, 2017
==LIST OF ACRONYMS==
: [[USED]] [[]]
: [[AV]] [[Apparent Violation]]
: [[CAP]] [[Corrective Action Program]]
: [[CCCG]] [[Common Cause Component Group]]
: [[CDF]] [[Core Damage Frequency]]
: [[CFR]] [[Code of Federal Regulations]]
: [[DC]] [[Direct Current]]
: [[ECP]] [[Engineering Change Package]]
: [[FENOC]] [[FirstEnergy Nuclear Operating Company]]
: [[HPCS]] [[High Pressure Core Spray]]
: [[IMC]] [[Inspection Manual Chapter]]
: [[IPEEE]] [[Individual Plant Examination for External Events]]
: [[LERF]] [[Large Early Release Frequency]]
: [[LOCA]] [[Loss of Coolant Accident]]
: [[LOOP]] [[Loss of Off-site Power]]
: [[NRC]] [[]]
: [[U.S.]] [[Nuclear Regulatory Commission]]
: [[IP]] [[Inspection Procedure]]
: [[RCIC]] [[Reactor Core Isolation Cooling]]
: [[SBO]] [[Station Black-Out]]
: [[SDG]] [[Standby Diesel Generator]]
: [[SDP]] [[Significance Determination Process]]
: [[SPAR]] [[Standardized Plant Analysis Risk]]
: [[SRA]] [[Senior Reactor Analyst TS Technical Specification]]
}}
}}

Latest revision as of 06:41, 3 November 2019

NRC Inspection Report 05000440/2017009 and Preliminary White Finding
ML17156A750
Person / Time
Site: Perry FirstEnergy icon.png
Issue date: 06/05/2017
From: Louden P
Division Reactor Projects III
To: Hamilton D
FirstEnergy Nuclear Operating Co
References
EA-17-043 IR 2017009
Download: ML17156A750 (16)


Text

UNITED STATES une 5, 2017

SUBJECT:

PERRY NUCLEAR POWER PLANTNRC INSPECTION REPORT 05000440/2017009 AND PRELIMINARY WHITE FINDING

Dear Mr. Hamilton:

On April 27, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Perry Nuclear Power Plant and the inspectors discussed the results of this inspection with you and other members of your staff. The results of this inspection are documented in the enclosed report.

The enclosed report documents a finding with an associated apparent violation that the NRC has preliminarily determined to be White, with low-to-moderate safety significance and an associated Technical Specification (TS) violation of TS 3.8.1, AC Sources-Operating. This finding involved the licensees failure to evaluate the effects of voltage suppression diode failure on the Standby Diesel Generator (SDG) control circuit, which was a component subject to the requirements of Title 10 Code of Federal Regulations (CFR) Part 50, Appendix B. Specifically, the licensee failed to consider the effect of a shorted diode on the control circuitry of the SDG, and, as a result, failed to recognize that installation of voltage suppression diodes across control relays, with no mitigation for diode failure, was not suitable for the SDG control circuit. This introduction of new components (diodes) into the control circuitry resulted in the eventual failure of the SDG control circuit, thereby rendering the SDG inoperable and unable to start.

We assessed the significance of the finding using the significance determination process (SDP) and readily available information. We are considering escalated enforcement for the apparent violation consistent with our Enforcement Policy, which can be found at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. Because we have not made a final determination, no notice of violation is being issued at this time. Please be aware that further NRC review may prompt us to modify the number and characterization of the apparent violation(s).

We intend to issue our final significance determination and enforcement decision, in writing, within 90 days from the date of this letter. The NRCs SDP is designed to encourage an open dialogue between your staff and the NRC; however, neither the dialogue nor the written information you provide should affect the timeliness of our final determination. Before we make a final decision, you may choose to communicate your position on the facts and assumptions used to arrive at the finding and assess its significance by either:

(1) attending and presenting at a Regulatory Conference, or (2) submitting your position in writing. The focus of a Regulatory Conference is to discuss the significance of the finding.

Written responses should reference the inspection report number and enforcement action number associated with this letter in the subject line. Your written response should be sent to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Center, Washington, DC 20555-001, with a copy to Mr. Jamnes Cameron, Chief, Branch 4, Division of Reactor Projects, U.S. Nuclear Regulatory Commission, Region III, 2443 Warrenville Road, Lisle, IL 60532.

If you request a Regulatory Conference, it should be held within 40 days of your receipt of this letter. Please provide information you would like us to consider or discuss with you at least 10 days prior to any scheduled conference. If you choose to attend a Regulatory Conference, it will be open for public observation. If you decide to submit only a written response, it should be sent to the NRC within 40 days of your receipt of this letter. If you choose not to request a Regulatory Conference or to submit a written response, you will not be allowed to appeal the NRCs final significance determination.

Please contact Mr. Jamnes Cameron at 630-829-9833, and in writing, within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision.

The final resolution of this matter will be conveyed in separate correspondence.

This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding Electronic Reading Room.

Sincerely,

/RA/

Patrick L. Louden, Director Division of Reactor Projects Docket No. 50-440 License No. NPF-58 Enclosure:

Inspection Report 05000440/2017009 cc: Distribution via LISTSERV

SUMMARY

Inspection Report 05000440/2017009; Perry Nuclear Power Plant; Identification and Resolution of Problems.

The enclosed inspection report documents a finding that has preliminarily been determined to be White, a finding with low to moderate safety significance, that may require additional U.S. Nuclear Regulatory Commission (NRC) inspections, regulatory actions, and oversight, with an associated violation of Technical Specification (TS) 3.8.1, AC Sources-Operating.

The significance of inspection findings is indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) and determined using Inspection Manual Chapter (IMC) 0609,

Significance Determination Process, dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310, Aspects Within the Cross-Cutting Areas, dated December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated November 1, 2016. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649,

Reactor Oversight Process, dated July 201

NRC-Identified

and Self-Revealed Findings

Cornerstone: Mitigating Systems

Preliminary

White.

The inspectors identified a finding preliminarily determined to be of low to moderate safety significance (White), and an associated apparent violation of Title 10 of the Code of Federal Regulations (10 CFR) 50, Criterion III, Design Control, for the licensees failure to implement measures for the selection and review for suitability of application of voltage suppression diodes installed in the control circuitry for the Division 2 Standby Diesel Generator, which was a component subject to the requirements of 10 CFR Part 50, Appendix B. Specifically, Engineering Change Package 04-00049 failed to consider the effects of a shorted diode on the control circuitry for the Division 2 Standby Diesel Generator, and instead, introduced new components (diodes) into the control circuitry that resulted in the eventual failure of this safety-related equipment. This rendered the standby diesel generator inoperable and unable to start for longer than its technical specification allowed outage time, which was a violation of Technical Specification 3.8.1, AC Sources-Operating. The licensee documented the issue in CR 2016-13183, and subsequently replaced the failed component and then modified circuitry to remove the replacement diode and the remaining diodes from similar components.

The inspectors determined that the licensees failure to evaluate the effects of voltage suppression diode failure on the Standby Diesel Generator control circuit was contrary to the requirements of 10 CFR Part 50, Appendix B, Criterion III and a performance deficiency which was within the licensees ability to foresee and prevent. The inspectors determined that the performance deficiency was of more than minor significance because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the design of the Division 2 Standby Diesel Generator control circuit resulted in the inoperability and unavailability of the Division 2 Standby Diesel Generator from April 2, 2015, to November 8, 2016, when the failed diode was replaced.

A Significance and Enforcement Review Panel, using IMC 0609, Appendix A,

Significance Determination Process for Findings At-Power, dated June 19, 2012, preliminarily determined the finding to be of low-to-moderate safety significance. The inspectors did not identify any cross-cutting aspects associated with this finding because the condition had existed since at least 2007, when the diodes were originally installed in the DC control power circuits, and therefore, was not indicative of current plant performance. (Section 4OA2.1)

Licensee Identified Finding None.

REPORT DETAILS

OTHER ACTIVITIES

Cornerstone: Mitigating Systems

4OA2 Identification and Resolution of Problems

.1 Annual Follow-up of Selected Issues: Division 2 Diesel Generator Failure to Start due to

a Failed Diode in the 125 VDC Control Power Circuit

a. Inspection Scope

The inspectors reviewed corrective actions and the licensees causal analysis for condition report (CR) 2016-06450, which documented the failure of the Division 2 Standby Diesel Generator (SDG) to start during a routine surveillance test conducted on May 6, 2016. The failure to start was due to a shorted surge suppressor diode for relay R11A, a relay in the normal start portion of the 125 VDC control power circuit for the SDG. The inspectors evaluated the licensees identified failure mechanisms and associated corrective actions for that event in light of a subsequent failure of a shorted surge suppressor diode for relay R10BB in the emergency start circuit for the same SDG that occurred on November 6, 2016. The inspectors also reviewed the licensees corrective actions and causal analysis for the subsequent failure.

As appropriate, the inspectors verified the following attributes during their review of the licensee's corrective actions for the above condition report and other related condition reports:

  • complete an accurate identification of the problem in a timely manner commensurate with its safety significance and ease of discovery;
  • consideration of the extent of condition, generic implications, common cause, and previous occurrences;
  • evaluation and disposition of operability/functionality/reportability issues;
  • classification and prioritization of the resolution of the problem commensurate with safety significance;
  • identification of the contributing causes of the problem;
  • identification of corrective actions, which were appropriately focused to correct the problem;
  • completion of corrective actions in a timely manner commensurate with the safety significance of the issue;
  • effectiveness of corrective actions taken to preclude repetition; and
  • evaluate applicability for operating experience and communicate applicable lessons learned to appropriate organizations.

The inspectors discussed the corrective actions and associated evaluations with licensee personnel.

This review constituted one in-depth problem identification and resolution inspection sample as defined in Inspection Procedure (IP) 71152.

b. Findings

Introduction:

The inspectors identified a preliminary White finding associated with an Apparent Violation (AV) of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Criterion III, Design Control, and an associated violation of TS 3.8.1, for the licensees failure to implement measures for the selection and review for suitability of application of voltage suppression diodes installed in the control circuitry for the Division 2 SDG, which was a component subject to the requirements of 10 CFR Part 50, Appendix B.

Specifically, Engineering Change Package 04-00049 failed to consider the effects of a shorted diode on the control circuitry for the Division 2 SDG, and introduced new components (diodes) into the control circuitry, resulting in the eventual failure of this safety-related equipment, rendering the SDG inoperable and unable to start via the emergency start circuit from April 2, 2015, until the failed diode was replaced on November 8, 2016.

Description:

On May 6, 2016, while conducting a post-maintenance test of the Division 2 SDG using the normal start circuit, all control power to the SDG was lost, rendering the SDG inoperable. The licensees investigation determined that the failure was due to a shorted surge suppressor diode for relay R11A, installed as part of a modification implemented in 2007. This diode shorted together the positive and negative sides of the control power to the circuitry and caused the125VDC supply breakers (CB-1, CB-2, CB-3, and CB-4) for the two available sources of power to open and de-energize the control circuitry thus rendering the diesel generator incapable of performing its design function. The licensee replaced the failed diode and successfully re-tested the SDG.

Since the licensee did not characterize the failure as a significant condition adverse to quality, a formal root cause analysis was neither required nor performed.

During troubleshooting testing, the licensee performed continuity testing of other diodes in the normal and emergency start circuits for the Division 2 SDG, including a diode associated with relay R10BB, which was associated with the emergency start circuit of the Division 2 SDG and which was also installed as part of the 2007 modification.

However, the testing was insufficient to detect a degraded condition of that diode.

Subsequent vendor testing determined that resistance checks are insufficient to detect failed diodes, and reverse bias leakage current testing was necessary to identify the degraded condition.

On November 6, 2016, while performing PTI-R43-P0006B; Division 2 Diesel Generator Pneumatic Logic Board Functional Check; Revision 15, 125 VDC circuit breakers CB-1, CB-2, CB-3, and CB-4 opened. The licensee entered this failure of the Division 2 SDG into its Corrective Action Program (CAP) as CR 2016-13183. Subsequent troubleshooting and causal analysis revealed that a diode installed for voltage suppression across control relay R10BB failed and caused a short circuit condition on the 125VDC control circuit. The short circuit condition resulted in the 125VDC circuit breakers CB-1, CB-2, CB-3, and CB-4 opening and a subsequent loss of control power to the Division 2 SDG; the same condition that occurred during the May 16, 2016, failure of the normal start circuit. As stated above, relay R10BB is used in the diesel generators emergency start circuity (i.e. Loss of Off-site Power (LOOP) or Loss of Coolant Accident (LOCA)). The last successful test of the SDG emergency start circuitry was on April 2, 2015. The R10BB relay is not used in the circuit for normal starts.

The inspectors reviewed Engineering Change Package (ECP) 04-00049, Standby Diesel Generator Governor Replacement, which installed control relays R10BB and R11A and their associated voltage suppression diodes in 2007. The inspectors determined that this modification installed voltage suppression diodes across several control relays, including relays R11A and R10BB. The inspectors noted that the ECP addressed how installation of voltage suppression diodes would limit high voltages during relay coil de-energization, but failed to address the effects of a diode failure on the control circuit, specifically in a shorted condition. The inspectors reviewed drawing 206-0216-00006 Sheet 2 Revision Z, Standby Diesel Engine Control Panel 1H51-P054B, and determined that failure of the voltage suppression diode for relay R10BB would result in an effective fault condition on the 125 VDC control power circuit and a subsequent loss of control power (via opening of circuit breakers CB-1, CB-2, CB-3, and CB-4) during an emergency start of the SDG. This loss of control power would render the SDG inoperable and unavailable, even through the normal start circuit.

The inspectors were concerned that the licensee failed to evaluate the effects of modifying the SDG control power circuit with voltage suppression diodes and, therefore, failed to establish measures to assure the suitability of application of parts and equipment that are essential to safety-related functions of structures, systems, and components. Specifically, the installation of voltage suppression diodes, without mitigation for diode failure, was not suitable for use in the SDG control circuit because it caused an undetectable failure of the SDG. The installation of these diodes produced no apparent safety benefit to the control system to counter the additional unreliability introduced by the new components. This point was documented in the 10 CFR Part 21 notification that Engine Systems, Inc. issued for the diodes on March 27, 2017 (EN 52642). The notification stated that it was acceptable to remove the diodes from their relays and that no changes or impacts would be expected for the associated equipment. The licensee, in its root cause evaluation, similarly determined that the diodes were not required to protect components in the control power circuits and could be removed.

In its root cause evaluation, the licensee determined that the loss of control power to the Division 2 SDG on May 16, 2016, and on November 6, 2016, was due to a manufacturing defect in the diodes associated with relays R11A and R10BB, respectively, and thus beyond its ability to foresee and prevent. Although the inspectors do not dispute whether there was a manufacturing defect in the failed diodes, they determined that the point was not pertinent to the licensees failure to evaluate the effects of voltage suppression diode failure. In each case, the failed diodes provided an indication that the licensees modification installed in 2007, introduced new components (diodes) into the SDG control circuit design such that their failure resulted in the eventual failure of safety-related equipment (the Division 2 SDG) nine years after initial installation. The inspectors determined that following the previous testing of the circuit on April 2, 2015, the emergency start circuit diode would have either failed (shorted) the next time the circuit was energized (e.g., demand for emergency start from a loss of off-site power or loss of coolant accident) or that the diode failed when the testing was completed and the circuit was de-energized.

The licensees corrective actions included replacing the failed diode, performing PTI-R43-P0006B satisfactorily, and implementing modification ECP 16-0348, Modify Division 1 and Division 2 Diesel Generator control circuitry for relay flyback diode failure, to remove the voltage suppression diodes from the SDG control circuitry.

Analysis:

Title 10 of the CFR, Part 50, Appendix B, Criterion III, Design Control, requires, in part, that measures be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components. The inspectors determined that the licensees failure to evaluate the effects of voltage suppression diode failure on the SDG control circuit was contrary to the requirements of 10 CFR Part 50, Appendix B, Criterion III, and a performance deficiency. Specifically, the licensee failed to consider the effect of a shorted diode on the control circuitry of the SDG and, as a result, failed to recognize that installation of voltage suppression diodes across control relays, with no mitigation for diode failure, was not a suitable modification of the SDG control circuit.

The inspectors determined that the performance deficiency was of more than minor significance because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the design of the Division 2 SDG control circuit resulted in the inoperability and unavailability of the Division 2 SDG when diode R10BB failed in the shorted condition.

The inspectors determined the finding could be evaluated using the Significance Determination Process (SDP) in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, dated October 7, 2016, and Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated June 19, 2012.

The finding represented an actual loss of system safety function of the Division 2 diesel generator for greater than its TS 3.8.1.B4 allowed outage time of 14 days. Therefore, a detailed risk evaluation was performed in accordance with IMC 0609, Appendix A.

A Region III Senior Reactor Analyst (SRA) performed a detailed risk evaluation using the NRCs Standardized Plant Analysis Risk (SPAR) Model for Perry, Revision 8.19. The SRA determined that several changes to the SPAR model were necessary to fully capture plant-specific features affecting the dominant risk sequences for this evaluation.

Idaho National Laboratory staff who maintain the SPAR models for the NRC made the model changes as requested by the SRA. The changes included the ability to cross-tie direct current (DC) power, fast fire water injection, and the ability to vent containment under station blackout conditions.

The Perry plant has additional equipment originally intended for a second unit that includes a second set of DC batteries that can be aligned to support the operating unit.

This alignment under station blackout scenarios can provide adequate DC power for the full 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> PRA mission time. This plant specific feature can support continued high pressure core spray (HPCS) operation and containment venting in certain station black-out (SBO) scenarios such that offsite power recovery is not required for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The plant has a fast fire water injection capability that supports the use of a diesel fire water pump for low pressure injection to the reactor pressure vessel in certain SBO scenarios when injection using the reactor core isolation cooling (RCIC) system is initially successful. For these station blackout scenarios, offsite power recovery is required within eight hours if containment venting is not available.

The Perry SPAR model was also modified to change the common cause component group (CCCG) for the Standby Diesel Generators. A CCCG models a group of components that are similar in design, operation, and maintenance, and therefore susceptible to failure from common causes. The determination of a CCCG typically includes components within a system and does not routinely extend to like components across system boundaries. The SPAR model baseline CCCG included the Division 1, Division 2, and Division 3 diesel generators. Although there are similarities across all three diesel generators, the NRC determined that the Division 3 diesel generator should not be included in the CCCG, primarily because it is significantly different in size, manufacturer, and function. The CCCG was modified to include only the Division 1 and Division 2 Standby Diesel Generators.

In addition to the modeling changes described in the previous paragraphs, the SPAR model was updated with the most recent diesel generator failure probabilities and common cause alpha factors. The data are on the NRCs public website at http://nrcoe.inl.gov/resultsdb/.

The SRA made the following assumptions about the degraded plant condition for the detailed risk evaluation:

  • The Division 2 Standby Diesel Generator would not have automatically started in response to a loss of offsite power event. The basic event in the SPAR model for failure to start was set to True.
  • The Division 2 Standby Diesel Generator could not be manually started and was not recoverable.
  • The exposure time for the degraded condition used in the evaluation was one year. The degraded condition existed from April 2015 until November 2016, which is greater than one year. The T/2 method to exposure time determination, which is 1/2 the time from the last successful operation until the standby diesel generator failure was not applicable due to the failure mechanism.

The standby diesel generator emergency start function was not degrading while it was in a standby mode and was not degrading during manual start operations.

The maximum exposure time used in the SDP is one year.

The change in core damage frequency (CDF) due to the degraded condition was estimated to be 7.3E-6/yr. This is the CDF for internal events. The dominant core damage sequence involved an SBO event in which the HPCS and RCIC systems fail and power is not recovered within 30 minutes. A second dominant core damage sequence involves an SBO event in which HPCS is successful, but containment venting fails and power is not recovered.

The SRA considered risk contributions from internal fires and seismic events and concluded that any other external event contribution would be negligible. The internal fire CDF was estimated to be 1.5E-6/yr., which is a small risk contribution to the overall significance of the finding. The risk contribution from seismic events was determined to be less than 1E-7/yr., and did not impact the results of the detailed risk evaluation.

For internal fires, the SRA used the Individual Plant Examination for External Events (IPEEE) to estimate the fire risk contribution. From the IPEEE, the SRA determined that internal fires in only the control room or the turbine power complex could cause a loss of offsite power and contribute to the risk significance of this finding.

For the control room, the SRA determined that panels designated as Group 2B and Group 4B in the control room would contribute to a change in risk because a fire in these panels could result in a loss of offsite power event. The total fire frequency for Group 2B and 4B panels was 7.8E-4/yr. For the scenarios in which the control room is not evacuated, the SRA multiplied the fire frequency by the change in conditional core damage probability calculated using the SPAR model for a plant-centered loss of offsite power with the Division 2 standby diesel generator failed. This resulted in a CDF estimate of 1.1E-7/yr. For the scenario in which the control room is evacuated, the SRA calculated a change in risk of 3.8E-7/yr., using information in the IPEEE regarding control room evacuation scenarios that involve a loss of offsite power with no Division 2 damage due to the fire (fire damage State 3 in the IPEEE). The total delta CDF estimated for control room fires due to the degraded condition was approximately 5.0E-7/yr.

For the Turbine Power Complex, the SRA used the same approach, combining the IPEEE fire frequency with the delta conditional core damage probability calculated using the SPAR model. The delta CDF for turbine power complex fires due to the degraded condition was estimated to be 1E-6/yr.

The SRA reviewed the potential for risk contribution due to large early release frequency (LERF) using the guidance of IMC 0609 Appendix H, Containment Integrity Significance Determination Process. The SRA applied the Appendix H LERF factor of 0.2 for BWR Mark III Containment Plants to a subset of core damage sequences that represent early core damage sequences. Using this approach, the SRA determined that the LERF contribution to the overall significance of the finding was no greater than the CDF estimate and that CDF was the appropriate metric to use in evaluating the significance of the finding.

The total CDF estimate for internal events and internal fire risk was 8.8E-6/yr., which represents a finding of low to moderate safety significance (White).

The inspectors identified no cross-cutting issues associated with this finding because the condition had existed since at least 2007, when the diodes were originally installed in the DC control power circuits, and therefore, was not indicative of current plant performance.

Enforcement Title 10 of the CFR, Part 50, Appendix B, Criterion III, Design Control, requires, in part, that measures be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components. Technical Specification 3.8.1 AC Sources-Operating condition B.4 states, in part, that the required inoperable diesel generator be restored to operable status within 14 days.

From April 24, 2007, until November 8, 2016, the licensee failed to review for suitability of application of parts essential to the safety-related functions of the Division 2 Standby Diesel Generator, a safety-related system. Specifically, Engineering Change Package 04-00049 failed to consider the effects of shorted voltage suppression diodes installed on the control circuitry for the Division 2 Standby Diesel Generator, and instead, introduced new components (diodes) into the control circuitry that resulted in the eventual failure of this safety-related equipment. Consequently, on November 6, 2016, the Division 2 Standby Diesel Generator emergency start circuit diode associated with relay RR10BB was found failed after an unsuccessful attempt to test the emergency start function. The Division 2 Standby Diesel Generator was inoperable and unable to perform its emergency start function from April 2, 2015, until the emergency start diode was replaced and the Division 2 Standby Diesel Generator was returned to service on November 8, 2016, which was longer than the Technical Specification allowed outage time of 14 days. The failure to consider the effects of shorted voltage suppression diodes installed in the SDG and resultant inoperability of the Division 2 SDG are apparent violations of 10 CFR 50 Appendix B Criterion III, Design Control and TS 3.8.1. Immediate corrective actions included replacing the failed diode and declaring the Division 2 Standby Diesel Generator operable following post-maintenance testing.

(AV05000440/2017009-01, Unsuitable Application of Surge Suppression Diodes in Standby Diesel Generator Control Power Circuitry)

4OA6 Management Meeting

.1 Exit Meeting Summary

On April 27, 2017, the inspectors presented the inspection results to Mr. D. Hamilton and other members of the licensee staff. The licensee acknowledged the issues presented.

The inspectors confirmed that none of the potential report input discussed was considered proprietary.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

D. Hamilton, Site Vice President
F. Payne, General Plant Manager
D. Reeves, Director, Site Engineering
D. Saltz, Director, Site Performance Improvement
N. Conicella, Manager, Site Regulatory Compliance
L. Zerr, Supervisor, Regulatory Compliance
K. Nelson, Manager, Plant Engineering
P. Roney, Supervisor, Nuclear Supply System Engineering
J. Caine, Supervisor, Nuclear Electrical System Engineering
R. Boyles, Nuclear Engineering Specialist

U.S. Nuclear Regulatory Commission

J. Cameron, Chief, Reactor Projects Branch 4

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000440/2017009-01 AV Unsuitable Application of Surge Suppression Diodes in Standby Diesel Generator Control Power Circuitry (Section 4OA2.1)

Closed

None.

Discussed

None.

LIST OF DOCUMENTS REVIEWED