IR 05000336/2014011

IR 05000336/2014011, 05000423/2014011; 6/2/14 to 7/15/14; Millstone Power Station, Units 2/3; Electrical System Response; Event Diagnosis and Operator Performance; Special Inspection to Review the 5/25/14, Dual-Unit Reactor Trip, Loss of Of

ML14240A006
Person / Time
Site:	Millstone
Issue date:	08/28/2014
From:	James Trapp Division of Reactor Safety I
To:	Heacock D Dominion Resources
References
IR-2014-011
Download: ML14240A006 (46)

Text

ust 28, 2014

SUBJECT:

MILLSTONE POWER STATION UNITS 2 AND 3 - NRC SPECIAL INSPECTION REPORT 05000336/2014011 AND 05000423/2014011

Dear Mr. Heacock:

On July 15, 2014, the U.S. Nuclear Regulatory Commission (NRC) completed a special inspection at your Millstone Power Station, Units 2 and 3, in response to the May 25, 2014, dual-unit reactor trip and loss of offsite power (LOOP) event. The enclosed report documents the results of the inspection, which were discussed on July 15, 2014, with Mr. Matt Adams, Plant Manager, and other members of your staff.

Our analysis, as documented in Attachment 1 of the enclosed inspection report, determined that the May 25, 2014 event satisfied the criteria in NRC Inspection Manual Chapter 0309, Reactive Inspection Decision Basis for Reactors, for conducting a special inspection. As such, the special inspection team reviewed the sequence of events, equipment response and issues, operator performance, and potential consequences related to the event and examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license. The team reviewed selected procedures and records, observed activities, and interviewed personnel.

Based on the results of this inspection, one apparent violation (AV) of NRC requirements was identified and is being considered for escalated enforcement action in accordance with the NRC Enforcement Policy. The current Enforcement Policy is included on the NRC's Website at http://www.nrc.gov/about-nrc/regulatory/enforcement /enforce-pol.html. The AV involves Dominions failure to complete a Title 10 of the Code of Federal Regulations (10 CFR) 50.59 evaluation and to obtain prior NRC approval through a license amendment for a change made at Millstone. Specifically, on December 20, 2012, Dominion removed the severe line outage detection (SLOD) special protection system, a system described in the Updated Final Safety Analysis Reports (UFSAR) for both units, without completing a 10 CFR 50.59 evaluation and without submitting the proposed change to the NRC for review and approval. The circumstances surrounding this AV are described in detail in the enclosed inspection report.

In accordance with the Enforcement Policy, the NRC has not made a final determination in this matter and a Notice of Violation is not being issued at this time. The NRC acknowledges that Dominion implemented immediate compensatory measures to address the technical issue of no longer having the SLOD system in place such that the AV does not represent a current safety concern. However, to complete our final enforcement decision the NRC requires information from Dominion regarding: why it was concluded that the removal of the SLOD system did not require a 10 CFR 50.59 evaluation and prior NRC review and approval, and how future corrective actions will prevent similar situations. Before the NRC makes its enforcement decision, we are providing Dominion the opportunity to: (1) provide a written response to the apparent violation within 30 days from the date of this letter, (2) request a Predecisional Enforcement Conference (PEC), or (3) request Alternative Dispute Resolution (ADR). Your response may reference or include previously docketed correspondence, if the correspondence adequately addresses the required response.

If Dominion chooses to provide a written response, the response should be clearly marked as a Response to an Apparent Violation in NRC Inspection Report 05000336/2014011 and 05000423/2014011; EA-14-126 and send it to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-001, with a copy to the Regional Administrator, Region I, and a copy to the NRC Senior Resident Inspector at Millstone Power Station. The response should include: (1) the reason for the AV or, if contested, the basis for disputing the violation; (2) the corrective steps that have been taken and the results achieved; (3) the corrective steps that will be taken; and (4) the date when full compliance will be achieved.

If you request a PEC, the conference will afford you the opportunity to provide your perspective on these matters and any other information that you believe the NRC should take into consideration before making an enforcement decision. The decision to hold a PEC does not mean that the NRC has determined that a violation has occurred or that enforcement action will be taken. This conference would be conducted to obtain information to assist the NRC in making an enforcement decision. The topics discussed during the conference may include information to determine whether a violation occurred, information to determine the significance of a violation, information related to the identification of a violation, and information related to any corrective actions taken or planned.

In lieu of a PEC, you may also request ADR with the NRC in an attempt to resolve this issue.

ADR is a general term encompassing various techniques for resolving conflicts using a neutral third party. The technique that the NRC has decided to employ is mediation. Mediation is a voluntary, informal process in which a trained neutral mediator works with parties to help them reach resolution. If the parties agree to use ADR, they select a mutually agreeable neutral mediator who has no stake in the outcome and no power to make decisions.

Mediation gives parties an opportunity to discuss issues, clear up misunderstandings, be creative, find areas of agreement, and reach a final resolution of the issues. Additional information concerning the NRC's ADR program can be obtained at http://www.nrc.gov/about-nrc/regulatory/enforcement/adr.html. The Institute on Conflict Resolution (ICR) at Cornell University has agreed to facilitate the NRC's program as a neutral third party. Please contact ICR at 877-733-9415 within 10 days of the date of this letter if you are interested in pursuing resolution of this issue through ADR.

The PEC or the ADR should be held within 30 days of the date of this letter. If you request to participate in a PEC, the conference should be held in our office in King of Prussia, PA and will be open for public observation. The date and time of the PEC will be publicly announced.

However, if you request to participate in an ADR mediation session, it will be closed to public observation. In this case, the NRC would prefer that the mediation session be held in our office in King of Prussia, PA. Please contact Raymond McKinley, Chief, Projects Branch 5, Region I, Division of Reactor Projects, at 610-337-5150 within 10 days of the date of this letter to notify the NRC which of the above options you choose. If an adequate response is not received with the specified time or an extension of time has not been granted by the NRC, the NRC will either proceed with its enforcement decision or schedule a PEC.

In addition, this report documents one NRC-identified finding of very low safety significance (Green), and one NRC-identified non-cited violation (NCV) of very low safety significance (Green). However, because of the very low safety significance and because this violation is entered into your corrective action program, the NRC is treating this violation as an NCV consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest the NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator Region I; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Senior Resident Inspector at Millstone. If you disagree with the cross-cutting aspects assigned to the findings in this report, you should provide a response within 30 days of the date of the inspection report, with the basis for your disagreement, to the Regional Administrator, Region I, and the NRC Senior Resident Inspector at Millstone.

Please be advised that the number and characterization of the AV and findings described herein may change as a result of further NRC review.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosures, and your response, if you choose to provide one, will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records component of the NRCs Agencywide Document Access and Management System (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room). To the extent possible, your response should not include any personal privacy, proprietary, or safeguards information so that it can be made available to the Public without redaction.

Sincerely,

/RA/

James M. Trapp, Acting Director Division of Reactor Safety

ML14240A006 DOCUMENT NAME: G:\DRS\Operations Branch\Jackson\millstone SIT Rev FINAL Jackson.docx X Non-Sensitive X Publicly Available X SUNSI Review Sensitive Non-Publicly Available OFFICE RI/DRP RI/ORA NRR OE RI/DRS NAME McKinley via email BBickett LCasey via email CFaria via email WSchmidt DATE 8/20/14 8/27/14 8/26/14 8/27/14 8/22/14 OFFICE RI/DRS RI/DRS NAME DJackson JTrapp 8/27/14 8/28/14 Docket Nos: 50-336 and 50-423 License Nos: DPR-65 and NPF-49

Enclosure:

Inspection Report 05000336/2014011 and 05000423/2014011 w/Attachments 1, 2, 3, 4 and 5

REGION I==

Docket Nos.: 50-336 and 50-423 License Nos.: DPR-65, NPF-49 Report Nos.: 05000336/2014011 and 05000423/2014011 Licensee: Dominion Nuclear Connecticut, Inc. (Dominion)

Facility: Millstone Power Station, Units 2 and 3 Location: PO Box 128 Waterford, CT 06385 Dates: June 2, 2014 through July 15, 2014 Inspectors: P. Cataldo, Senior Resident Inspector, Division of Reactor Projects (DRP),

Team Leader E. Burket, Reactor Inspector, Division of Reactor Safety (DRS)

C. Lally, Operations Inspector, DRS J. Patel, Reactor Inspector, DRS R. Rolph, Health Physics Inspector, DRS B. Haagensen, Resident Inspector, DRP (Part Time)

P. Ott, Operations Engineer, DRS (Part Time)

C. Cahill, Senior Reactor Analyst, DRS (Part Time)

W. Cook, Senior Reactor Analyst, DRS (Part Time)

W. Schmidt, Senior Reactor Analyst, DRS (Part Time)

Approved by: Donald E. Jackson, Chief, Operations Branch Division of Reactor Safety i Enclosure

SUMMARY

IR 05000336/2014011, 05000423/2014011; 06/02/2014-07/15/2014; Millstone Power Station,

Units 2 and 3; Electrical System Response; Event Diagnosis and Operator Performance;

Special Inspection to review the May 25, 2014, Dual-Unit Reactor Trip and Loss of Off-site Power; Inspection Procedure 93812, Special Inspection.

A five-person NRC team, comprised of Region I inspectors conducted this Special Inspection, identifying one apparent violation (AV) and two findings of very low safety significance (Green).

The significance of most findings is indicated by their color (i.e., greater than Green, or Green,

White, Yellow, Red) and determined using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP), dated June 2, 2011. Cross-cutting aspects are determined using IMC 0310, Components Within Cross-Cutting Areas, dated December 19, 2013. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated July 9, 2013. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 5.

Cornerstone: Initiating Events

• Severity Level III. The NRC identified a Severity Level III AV of Title 10 of the Code of Federal Regulations (10 CFR) 50.59, Changes, Tests, and Experiments, for Dominions failure to complete a 10 CFR 50.59 evaluation and obtain a license amendment for a change made to the facility as described in the Updated Final Safety Analysis Report (UFSAR). Specifically, Dominion removed a special protection system (SPS), known as severe line outage detection (SLOD), which was described in the UFSAR. Dominion concluded in the 10 CFR 50.59 screening that a full 10 CFR 50.59 evaluation was not required and, therefore, prior NRC approval was not needed to implement this change. The team concluded that prior NRC approval likely was required because the removal of SLOD may have resulted in more than a minimal increase in the likelihood of occurrence of a malfunction of the offsite power system as described in the UFSAR. Dominion has documented condition reports CR 553967 and CR 551068, and participated in a root cause evaluation with Northeast Utilities to determine whether the relay operations that initiated the events of May 25, 2014, were appropriate for the circumstances. Dominion also implemented a compensatory measure by issuing an Operations Standing Order for interim guidance on offsite line outages and plant generation output.

The team determined that the failure of Dominion to complete a 10 CFR 50.59 evaluation of the modification for the removal of the SLOD system involved traditional enforcement because it impacted the NRCs ability to perform its regulatory function. This AV was determined to be more than minor because the team determined that the change to the facility required a full 10 CFR 50.59 evaluation and it likely would have required Commission review and approval prior to implementation. The severity level of this AV was determined, in part, using SDP risk significance in accordance with the NRC Enforcement Policy. A Region I Senior Risk Analyst conducted a conditional core damage probability estimate and determined that it was most properly characterized at a Severity Level III.

Cross-cutting aspects are not assigned to traditional enforcement violations (Section 2.1).

iii

Green.

The NRC identified a finding of very low safety significance (Green), in that Dominion did not ensure correct implementation of their design change process procedure when establishing licensing basis requirements for removal of the SPS. Specifically,

Dominion did not correctly evaluate the impact of removing the system on the requirements of General Design Criterion (GDC) 17 and did not address the failure mechanism of this new design in the design change documents, as required by their design change procedure. Dominion entered this issue into the corrective action program for resolution (CR 553967 and CR 551068).

The team determined that Dominions failure to implement their design change process procedure was a performance deficiency. This performance deficiency was more than minor because it was associated with the design control attribute of the Initiating Events Cornerstone and affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown and power operations. The team performed a risk screening in accordance with IMC 0609,

Appendix A, Significance Determination Process for Findings At-Power, using Exhibit 1,

Initiating Events Screening Questions, Section C, Support System Initiators. The answer to the question in Section C would be NO, because the finding did not increase the likelihood of a loss of two transmission lines with one line out of service (OOS), and affect mitigation equipment. The team determined that this finding had a cross-cutting aspect in the area of Human Performance, Procedure Adherence, because the design change process procedure was not adequately followed, in that the impact of the change on the current design basis and licensing bases was not evaluated correctly [H.8] (Section 2.2).

Cornerstone: Mitigating Systems

Green.

The NRC identified a Green non-cited violation (NCV) of Technical Specification (TS) 6.8.1 Procedures, because the Millstone Unit 3 control room personnel did not implement Emergency Operating Procedures (EOP) in a timely manner and in accordance with EOP usage guidelines. Specifically, from approximately 0845 to 1438 on May 25, 2014, the licensed control room operators were effectively stopped on a transition step in ES-0.1, Reactor Trip Response, Step 14, which is a decision step requesting the verification of offsite power availability. However, EOP rules of usage would have required a transition into ES-0.2, Natural Circulation Cooldown. Dominion entered this issue into the corrective action program under CR 551059 and CR 553970, and initiated an apparent cause evaluation.

The team determined there was a performance deficiency, in that Millstone Unit 3 control room personnel did not properly implement and execute procedurally-required actions of the EOPs in a timely manner and in accordance with the EOP usage rules, during a loss of offsite power and plant trip event. The performance deficiency was determined to be more than minor because it is associated with the Human Performance attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage).

iv

Additionally, the performance deficiency, if left uncorrected, would have the potential to lead to a more significant safety concern. The inspectors evaluated the finding using the Phase 1, Initial Screening and Characterization of Findings, worksheet in Attachment 4 to IMC 0609, Significance Determination Process and determined the finding to be of very low safety significance (Green). The finding was of very low safety significance (Green)because it did not result in an actual loss of function, only delayed additional cooldown and boration activities that would have assisted in event mitigation given the plant conditions at the time. The team determined that this finding had a cross-cutting aspect in the Human Performance cross-cutting area, Procedure Adherence component, because Millstone Unit 3 licensed personnel did not implement EOPs in a timely manner and in accordance with the EOPUG [H.8] (Section 3).

v

REPORT DETAILS

1. Description and Chronology of Events

In accordance with the Special Inspection Team (SIT) Charter (Attachment 1), the team conducted a detailed review of the events leading up to, and following the May 25, 2014, dual-unit reactor trip and loss of all offsite power (LOOP) event at Dominion Resources (Dominion) Millstone Nuclear Power Station (Millstone) Units 2 and 3. The team reviewed and gathered information from multiple sources, which included: The plant process computer (PPC), post-trip sequence of events (SOE) printout, post-event report and causal evaluations, corrective action program (CAP) documents, conducted interviews with plant operators and other Millstone staff, and developed a detailed understanding of the event (Attachment 2). The following represents an abbreviated summary of the significant automatic plant responses and operator actions.

At 0701, on May 25, 2014, a dual-unit reactor trip occurred at the Millstone Station. Prior to the event, the station had one offsite line out-of-service (OOS) (Line 371) for maintenance. A suspected ground fault on the grid in the Northeast Utilities Card substation caused the loss of offsite line 383. Line 310 tripped on instantaneous ground over current which was unexpected. The final line (Line 348) tripped on over current when both units attempted to feed the full power output of both Millstone units through the single remaining line (Line 348). All onsite emergency diesel generators (EDG)started and powered their respective safety busses. A detailed discussion of this sequence of events and a diagram of the Millstone switchyard are provided in 3 and Attachment 4, Figure 1, respectively.

The Millstone staff declared a Notice of Unusual Event (NOUE) for both units at 0715 due to a LOOP for greater than 15 minutes. Offsite power was restored to at least one safety bus at each unit by approximately 1030 and fully restored at 1256 on May 25, 2014. The NOUE was exited at 1414 on May 25, 2014.

Unit 2s response to the LOOP was as expected with one minor complication; a water hammer occurred in the non-safety related condensate polishing system. Since Unit 2s response to the LOOP was uncomplicated, a detailed event timeline was not included in this report.

Unit 3s operational response was challenged by a loss of instrument air when the 3B instrument air compressor (IAC) failed to start, following recovery of the safety electrical buses from their respective EDGs. Although the instrument air system is non-safety related, the 3B instrument air compressor is powered from a safety bus, and should have automatically started during the event. The loss of instrument air resulted in isolation of the normal letdown flow path for the reactor coolant system (RCS) due to system valves drifting closed as air pressure diminished. This challenged operators in controlling pressurizer level and pressure. Operators reduced charging flow to a minimum value allowing procedurally required boron addition to the RCS to occur.

However, with the loss of the normal letdown flow path, pressurizer level rose. Rising pressurizer level led to a rise in reactor coolant system pressure. Operators controlled RCS pressure by manually cycling pressurizer power operated relief valves (PORV) as needed. The normal method of pressure reduction was unavailable as pressurizer sprays require reactor coolant pumps to be in operation. The reactor coolant pumps lost power as a result of the LOOP. Operators established RCS letdown utilizing an approved flow path from the reactor vessel head vents to the pressurizer relief tank (PRT). The volume of water sent to the PRT via the reactor vessel head vents and the cycling of the pressurizer PORVs caused the PRT rupture disc to open, as designed, diverting RCS water into the containment. An additional challenge from the LOOP was the loss of all main condenser circulating water pumps, which along with residual steam inputs into the condenser, resulted in decreasing condenser vacuum and subsequent activation of low pressure turbine rupture disks. Due to the activation of low pressure turbine rupture disks and a lower than expected average RCS temperature, the main steam isolation valves (MSIV) were manually closed. Ultimately, instrument air was recovered, and normal charging and letdown was restored. Pressurizer level and pressure were brought back within their normal operating bands, and discharging of RCS to the PRT was ceased. A more detailed Unit 3 event timeline is contained in 2 and the equipment issues are discussed in Section 4 of this report.

2. Electrical System Response to the Event

a. Inspection Scope

The team reviewed and assessed the onsite and offsite electrical systems and the performance of these systems during the events on May 25, 2014. Specifically, the team reviewed the actual and expected response of these systems and verified they were consistent with the applicable licensing and design bases. Additionally, the team evaluated switchyard activities, coordination of activities with the offsite transmission system operator, and issues that affected offsite power.

b. Findings and Observations

2.1 Failure to Complete a 10 CFR 50.59 Evaluation for Removal of Severe Line Outage Detection

Introduction:

The team identified a Severity Level III AV of Title 10 of the Code of Federal Regulations (10 CFR) 50.59, Changes, Tests, and Experiments, for Dominions failure to complete a 10 CFR 50.59 evaluation and obtain prior NRC approval for a change made to the facility as described in the Updated Final Safety Analysis Reports (UFSAR) for both units. Specifically, Dominion removed a special protection system (SPS), which was described in the UFSAR as being credited to meet the requirements of General Design Criterion (GDC) 17. Dominion concluded in the 10 CFR 50.59 screening that a 10 CFR 50.59 evaluation was not required and therefore, prior NRC approval was not needed to implement this change. However, the team concluded that had Dominion completed a 10 CFR 50.59 evaluation, it was likely that NRC approval would have been required prior to implementation.

Description:

The Millstone Unit 2 and 3 UFSARs state that the offsite power system is designed to provide reliable sources of power to the onsite alternating current (AC)power distribution system adequate for the safe shutdown of the unit in compliance with General Design Criterion 17 (GDC-17). GDC-17 states, in part, electric power from the transmission network to the onsite electric distribution system shall be supplied by two physically independent circuits designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. The last paragraph of GDC-17 states, in part, that provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies.

As illustrated in Figure 2 of Attachment 4, prior to December 2012, the four transmission lines from the Millstone switchyard were routed upon two transmission paths consisting of double-circuit steel towers (DCT) (two transmission lines on a common tower)separated by 330 feet, until a point where the lines separated towards their individual transmission line substations.

The team noted the design and licensing bases of both Units 2 and 3 detailed that the DCT configuration caused Millstone to be susceptible to a simultaneous transmission tower fault scenario, either due to a line fault or due to tower collapse. Due to the possibility of this simultaneous loss of two circuits on either transmission tower, coupled with one of the two remaining circuits on the opposite DCT being OOS, Millstone utilized a generator rejection SPS known as Severe Line Outage Detection (SLOD). SLOD was described in Millstone Unit 2 and Unit 3 UFSAR Sections 8.1 and 8.2, respectively, as being credited for meeting the requirements of GDC-17. Specifically, SLOD was designed to protect the last remaining transmission line during potential grid instability conditions, and to ensure the availability of the offsite power to both units. The UFSAR further specified operability requirements for SLOD when one transmission line was taken OOS:

(1) to have SLOD fully operational, and limit the net station output 2500 mega-watt (MW) and limit the output of Unit 3 to the Maximum Allowable Millstone Generation Contingency limit, if applicable, or

(2) reduce load to a total station output of 1750 MW (Gross)/1650 MW (Net) within 30 minutes after the element (transmission line) is removed from service.

The UFSAR states, that the operability requirements specified above ensure that, upon loss of a double circuit line with a third line OOS and generation in excess of 1750 MW (Gross)/ 1650 MW (Net), offsite power is available for safe shutdown; maintaining system stability minimizes the probability of coincident loss of both offsite supplies. This is consistent with the requirements of GDC-17. Moreover, the UFSAR states, GDC-17 also requires that the probability of losing an offsite supply coincident with loss of the nuclear power unit be minimized. Because of the necessity for SLOD to complete its function within 0.30 seconds (18 cycles), SLOD trips Millstone Unit 3 by tripping switchyard breakers instead of the generator breaker (this eliminates the extra time required for relay and communication channel operation in a transfer trip scheme).

The team reviewed the basis for the operability requirements in the UFSAR for SLOD, and the transient stability analysis The Millstone Severe Line Outage Detection Special Protection System Upgrade NPCC SPS #23, dated February 12, 2007. In particular, the stability analysis showed that the grid becomes unstable for the following condition:

When Millstone total generation is greater than 1750 MWe gross, and three of the four transmission lines are out of servicetotal output is now being directed to one line, the grid becomes unstable and voltage sags occur. This may result in the trip of the last remaining transmission line, resulting in loss of offsite power sources to both Millstone units.

This condition impacts the reliability of the offsite power sources. SLOD was designed to prevent a total loss of offsite power that is caused by conditions described above, by reducing station electrical generation output. SLOD was designed to detect this condition by monitoring the Millstone total generation output (< 1750 MWe) and monitoring each transmission line for power flow (+/- 10 MWe). In this postulated fault scenario, SLOD initiates a trip signal to the Millstone switchyard breakers 15G-13T-2 and 15G-14T-2 (Unit 3 Generator tie line breakers), resulting in isolation of the Unit 3 generator from the grid (which would result in a load rejection Unit 3 trip), leaving Unit 2 in synchronism with the grid, and maintaining offsite power to both units.

On May 25, 2014, at approximately 0701, while both units were operating at 100 percent power (total output 2166 MWe Gross), Millstone experienced a dual-unit trip following a LOOP (Figure 1 of Attachment 4 provides a diagram of the Millstone switchyard). Prior to the event, one transmission line had been OOS for scheduled maintenance. A phase-to-ground fault on a disconnect switch in the Card substation, located several miles from the Millstone switchyard, caused the automatic isolation of that line. This was followed almost immediately by the loss of a third offsite transmission line through relay operations at the applicable switchyard and grid substations. Finally, because a single offsite transmission line is not capable of carrying the total generation (MWe) of both units simultaneously, this last remaining transmission line was lost (isolated) due to the expected overload condition created by both units power output being carried by a single transmission line. The team determined that if the SLOD SPS had been in service, only Unit 3 would have tripped and Unit 2 would have remained online and providing at least one offsite power source.

The team identified that in 2012 and 2013, Northeast Utilities, the transmission entity and the owner of the Millstone switchyard, modified transmission circuits at the Millstone switchyard to eliminate the existence of the simultaneous double circuit fault scenarios, which as discussed previously, existed due to the physical placement of two transmission lines on a common tower. This modification by Northeast Utilities installed two new transmission paths going out of the Millstone switchyard. The new offsite transmission line configuration consisted of four, single 345 kV transmission lines each located on a single circuit tower and transmission path, which is illustrated in Figure 3 of 4, of this inspection report.

The team also noted this modification included removal of the SLOD SPS, based on a belief by Northeast Utilities and Dominion that it was no longer required. At the time, Dominion believed that the removal of the DCT configuration eliminated the credited fault scenarios contained in the design and licensing bases of both units. The team noted that on December 20, 2012, Northeast Utilities disabled the active trip function of the SLOD SPS at the Millstone switchyard. The elimination of SLOD also resulted in physical modifications to switchyard supervisory panel CRP 909 in the Millstone Unit 1 control room, and required updates to various Millstone documents, including the UFSAR and operating procedures. These modifications and document updates were performed through implementation of a design change process in accordance with Dominion fleet and Millstone-specific procedures. These design change documents included a 10 CFR 50.59 screening and applicable safety analysis report (SAR) change notices for both the Millstone Unit 2 and 3 UFSARs.

The team noted that Dominions 10 CFR 50.59 screening for the SLOD SPS design change concluded that a full 10 CFR 50.59 evaluation was not required, because it incorrectly concluded that the SLOD system had no safety functional requirements that were credited in the safety analysis. Therefore, removal of SLOD did not have an adverse effect on any UFSAR-described design function. However, the team identified that not only is SLOD described in the UFSAR, but also documented a specific design function to prevent a dual-unit trip and total LOOP and maintain the stability of the electric grid under certain analyzed fault scenarios.

As previously discussed, one of the credited fault scenarios described in the UFSAR, was the simultaneous loss of two transmission circuits on a common structure, which occurs while one of the remaining transmission circuits is OOS. The SLOD SPS design change attempted to eliminate this credited fault scenario by routing all four 345 kV transmission lines on separate towers and transmission paths. The team identified that the new design lacked physical independence from the other transmission lines, in that the physical separation or distance between the newly-installed towers and the existing towers was not adequate (illustrated in Figure 3 of Attachment 4). Specifically, the team determined that under specific circumstances, the credited mechanical tower failure could still result in the simultaneous loss of two transmission circuits based on the 75 foot distance between the original double-circuit tower and the newly-installed tower.

The team concluded that this new design configuration of the transmission towers and offsite lines is not completely different from the original configuration, in regards to the credited fault scenario that results in the loss of three of the four transmission lines.

Moreover, the team determined that the separation of the transmission lines onto individual towers, and the use of this assumption as a basis for removal of the SLOD SPS results in adverse effects on the specified UFSAR described design function of maintaining a stable electric grid.

The team reviewed Regulatory Guide (RG) 1.187 and Nuclear Energy Institute (NEI)96-07, Guidelines for 10 CFR 50.59 Evaluations, Revision 1, which provides methods that are acceptable to the NRC staff for complying with the provisions of 10 CFR 50.59.

In particular, the team reviewed the screening criteria in NEI 96-07 and determined that the following screening criteria would have been met, and therefore, would have required a full 10 CFR 50.59 evaluation:

• Does the activity decrease the reliability of a structure, system, and component (SSC) design function, including either functions whose failure would initiate a transient/accident or functions that are relied upon for mitigation?

• Does the activity reduce existing redundancy, diversity, or defense in-depth?

• Does the activity add or delete an automatic or manual design function of the SSC?

The team concluded that Dominion did not adequately address these criteria, and therefore, failed to complete a full evaluation. Specifically, the team determined that removal of the SLOD SPS required a full 10 CFR 50.59 evaluation, because it was a change that adversely affected its design function as described in the Millstone Unit 2 and Unit 3 UFSAR, Section 8.1 and 8.2, respectively. NEI 96-07 states that, in this regard, changes that would relax the manner in which Code requirements [in this case GDC-17] are met for certain SSCs should be screened for adverse effects on design function.

Furthermore, the team determined that removal of SLOD may have resulted in more than a minimal increase in the likelihood of occurrence of a malfunction of the offsite power system as described in the UFSAR. NEI 96-07 defines malfunction of an SSC important to safety as the failure of the SSCs to perform their intended design function -

including both non-safety related and safety-related SSCs. The design function of SLOD, as described in the UFSAR, was to automatically cease generation at Millstone Unit 3, depending on certain transmission system contingencies and the net output of the Millstone Station. Should the system condition arise where:

(1) any of the four transmission circuits is unavailable,

(2) the power generation at Millstone is above the predetermined MW level, and

(3) two additional transmission circuits are forced OOS, then SLOD would detect this condition, and within 0.30 seconds (18 cycles), SLOD would preferentially trip Millstone Unit 3, leaving Unit 2 on line and offsite power provided to both units. This condition is consistent with the requirements of GDC-17, and both Unit 2 and Unit 3 design and licensing bases. Example 7 in Section 4.3.2 of NEI 96-07 provides that prior NRC approval would be required for changes that would (permanently) substitute manual actions for automatic actions for performance of UFSAR described design functions. Removal of the SLOD SPS resulted in the elimination of the automatic function of the preferential tripping Millstone Unit 3 within 0.30 seconds (18 cycles). As a result, the team determined that this automatic function could not have been substituted with human interaction (i.e., manual action within 0.30 seconds (18 cycles), the specified design function), and therefore, prior NRC approval was likely required.

NEI 96-07, Section 4.3.2, states in part, that departures from the design, fabrication, construction, testing, and performance standards as outlined in the General Design Criteria (Appendix A to Part 50) [in this case GDC-17] are not compatible with a no more than minimal increase standard. Removal of the SLOD SPS may have caused more than a minimal increase in the likelihood of occurrence of a malfunction of the offsite power system. Removal of the SLOD SPS without development of procedural guidance to direct operator action to reduce power in the event of the loss of transmission lines, did not minimize the probability of losing electric power from any of the remaining offsite lines as a result of loss of power from the transmission network. Therefore, the team determined that:

(1) the screening evaluation performed by Dominion for SLOD SPS removal was inadequate because the change adversely affected the design function as described in the UFSAR, and as such, required a complete evaluation, and

(2) prior Commission approval was likely required prior to implementing the change, in accordance with 10 CFR 50.59 (c)(2)(ii).

Dominion has initiated condition reports CR 553967 and CR 551068, participated in a root cause evaluation with Northeast Utilities to determine whether the relay operations that initiated the events of May 25, 2014 were appropriate for the circumstances, and implemented a compensatory measure by issuing an Operations Standing Order (SO)for interim guidance on future offsite line outages and plant generation output. The SO provides for the following compensatory measures:

(1) Once per shift, verify all four 345 kV lines to the Millstone switchyard are in service, and

(2a) with one or more 345 kV lines OOS, enter TS 3.8.1.1 for one offsite source inoperable (72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />), or

(2b) within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, reduce load to a total station output of 1750 MWe (Gross), 1650 MWe (Net).

The team determined that these compensatory measures are reasonable and appropriate.

Analysis:

The team determined that Dominions failure to complete a 10 CFR 50.59 evaluation for the removal of SLOD and to adequately evaluate the change to determine if prior NRC approval was required was a performance deficiency. The traditional enforcement process was used for this performance deficiency because it impacted the NRCs ability to perform its regulatory function. In accordance with the NRC Enforcement Policy, Section 6.1 and the NRC Enforcement Manual guidance, the severity level of a 10 CFR 50.59 violation was assessed based on the consequence evaluated by the significance determination process (SDP). This AV was determined to be more than minor because the team determined that the change to the facility required a full 10 CFR 50.59 evaluation and it is likely that it would have required Commission review and approval prior to implementation.

For each unit, the AV was assessed at a preliminary Severity Level III, because the consequence evaluated, using the SDP, estimated conditional core damage probabilities (CCDP) that were more than very low safety significance (i.e. greater than green). A Region I Senior Reactor Analyst completed two estimates of the CCDP for each unit in accordance with methods described in the Risk Assessment Standardization Program documentation, and assumed that not having the SLOD system in-service, resulted in the dual-unit trip and LOOP on May 25, 2014. These methods estimated CCDPs for Unit 2 in the range of one in 66,000 to 120,000 for such events, and for Unit 3 one in 74,000 to 137,000, for such events. In both cases, the assumption was that with SLOD removed and one transmission line out-of-service, Dominion should have implemented the combined-unit output limitations such that given the event of May 25, 2014, neither unit would have experienced a LOOP. The major difference in risk being that the Unit 2 turbine-driven auxiliary feedwater (TDAFW) pump does not automatically start and the preferential use of the station blackout (SBO) EDG for Unit 3 during a dual-unit SBO event. Both methods involved setting the grid-related LOOP Initiating Event frequency to 1.0. The first method, which included nominal offsite power recovery assumptions and EDG mission times and the probability equipment, could have been OOS for maintenance, at the time of the event. The second method, discussed in the event risk analysis section, involved more realistic assumptions, such as no significant equipment OOS at the time, and that offsite power was actually recovered after about 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. The dominant core damage sequences were the same for both units. For the first method, a non-SBO, with one EDG successfully functioning, but with failure of a motor-driven and TDAFW pumps and failure of feed and bleed operations; for the second method - an SBO caused by a common cause failure of all EDGs (including the SBO EDG) and the failure of the TDAFW, with inability to recover AC power (offsite power or an EDG) in one hour.

There is no cross-cutting aspect assigned to this violation, as it is being processed under traditional enforcement.

Enforcement:

Title 10 CFR 50.59, Changes, Tests, and Experiments, Section (c)(2)(ii)requires, in part, that a licensee shall obtain a license amendment pursuant to 10 CFR 50.90 prior to implementing a proposed change if the change would result in more than a minimal increase in the likelihood of occurrence of a malfunction of a SSC important to safety previously evaluated in the final safety analysis report (as updated).

10 CFR 50.59(d)(1) requires, in part, that a licensee shall maintain records of changes in the facility made pursuant to paragraph

(c) of this section. These records must include a written evaluation which provides the bases for the determination that the change does not require a license amendment pursuant to paragraph (c)(2) of this section.

Contrary to the above, on December 20, 2012, Dominion failed to obtain a license amendment pursuant to 10 CFR 50.90, prior to implementing a change that may have resulted in more than a minimal increase in the likelihood of occurrence of a malfunction of an SSC important to safety previously evaluated in the UFSAR. Specifically, Dominion allowed a design change to the offsite power system (removal of the severe line outage detection system), a system described in the UFSAR, and failed to conduct a written evaluation or provide a basis for the determination that the change did not require a license amendment in accordance with 10 CFR 50.59 (c)(2). The change may have resulted in more than a minimal increase in the likelihood of occurrence of an offsite power malfunction such that the removal of SLOD decreased the reliability of the offsite power system, reduced the defense-in-depth; and disabled an automatic generator rejection function, which protected the offsite power sources during transients caused by grid-related conditions. The removal contributed to the likelihood of a dual-unit trip and loss of offsite power to both units.

Dominion initiated condition reports (CR 553967 and CR 551068) to address this issue and has implemented a reasonable interim compensatory measure to address the technical issues surrounding the removal of SLOD. Long term corrective actions to address issues identified in the 10 CFR 50.59 process are being developed.

This is being treated as an AV preliminarily determined to be Severity Level III, AV 05000336, 423/2014011-01, Failure to Complete a 10 CFR 50.59 Evaluation for Removal of SLOD.

2.2 Inadequate Implementation of Dominions Design Change Process

Introduction:

The team identified a finding of very low safety significance (Green), in that Dominion did not ensure correct implementation of their design change process procedure when establishing licensing basis requirements for removal of SLOD.

Specifically, Dominion did not correctly evaluate the impact of removing the system on the requirements of GDC-17 and did not address the physical independence and the failure mechanism of this new design in the applicable design change documents.

Description:

In 2012 and 2013, Northeast Utilities, the transmission entity and the owner of Millstone switchyard, modified the transmission circuits in the Millstone switchyard to eliminate the simultaneous double circuit fault scenario that existed with the two transmission lines co-located on a common tower. Northeast Utilities installed two new transmission paths going out of the Millstone switchyard, which consisted of single circuit towers and transmission lines so each of the four 345 kV lines are now on its own transmission path. Prior to this, Millstones four transmission lines from the switchyard were routed upon two transmission paths, consisting of double-circuit steel towers (two transmission lines on a common tower) separated by 330 feet, until a point where the lines are separated towards their individual grid substations. Northeast Utilities project scope included removal of the SLOD system at the Millstone switchyard. These components, removal of SLOD and installation of the two transmission paths, were accomplished without direct supervision from Dominion. However, due to the elimination of SLOD, physical modification to the switchyard supervisory panel CRP 909, in the Millstone control room and updates of various Millstone documents, the UFSAR and operating procedures, were required. Dominion prepared and implemented a design change (MPG-12-01018) to accomplish these actions.

The SLOD system was described in Millstones Unit 2 and Unit 3 UFSAR, Sections 8.1 and 8.2, respectively, as being credited to meet the requirements of GDC-17. GDC-17 states, in part, that provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies.

SLOD was designed to sense the availability of the four transmission lines and the individual generator output and to automatically trip Unit 3 if a condition developed where the output of both units would be carried by one transmission line. This would prevent the overload of the remaining line and preserve the offsite power supply to both units. Provisions were also added in the UFSAR to limit the combined output of both units if a transmission line was removed from service and SLOD was not functional.

The team determined that the design change document that was prepared in accordance with the Dominions design change process procedure CM-AA-DDC-201 did not correctly address how the proposed design complies with the current design basis and licensing basis. Dominions design change procedure CM-AA-DDC-201, 4, Section 4.0, states that the design change document shall discuss the current design and how the design change complies with, affects, or changes the design. The team reviewed the design change documents and concluded that it did not address the impacts of removal of SLOD on the reliability of the offsite power system.

The team determined that the failure to evaluate this in the design change document resulted in the removal of SLOD system and it affected the compliance with GDC-17.

Specifically, SLOD system was described in the UFSAR and was credited to minimize the probability of losing the last remaining transmission line during a condition that could cause loss of three out of four transmission lines.

The team also determined that the design change did not address the possibility of a mechanical failure of transmission line towers, such as an existing tower falling on the new tower and causing simultaneous failure of two transmission lines. The intent of the design change was to eliminate the simultaneous double-circuit tower fault scenario by separating each of the 345 kV transmission lines on its own tower and its own transmission path. The new design installed two new transmission paths that are located approximately 75 feet (average) from the existing paths within a common right-of-way. The team determined that the 75 feet separation between the existing towers and new towers may not be adequate to prevent a simultaneous double circuit fault scenario if one of the original transmission towers (130 feet tall) falls over onto the newly-installed tower (110 feet). Therefore, the new configuration of the transmission lines is also vulnerable to the same credible fault scenario resulting in loss of three out of four transmission lines. Unit 2 UFSAR Section 8.1.2.1 addressed the original tower heights and the ground clearances between towers. The UFSAR details that the 330 feet separation indicates significant enough clearance to provide adequate physical independence of the transmission lines. The team found that the design change documents did not address this failure mode in the Failure Mode and Effects Analysis section, as required by procedures.

Analysis:

The team determined that Dominions failure to implement their design change process procedure was a performance deficiency. Dominion did not follow their design change process in evaluating the impact of the design on the offsite power requirements.

This performance deficiency was more than minor because it was associated with design control attribute of the initiating events cornerstone and affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown and power operations.

The team determined that this performance deficiency was of very low safety significance, in accordance with Inspection Manual Chapter (IMC) 0609, Appendix A, Significance Determination Process for Finding At-Power, using Exhibit 1, Initiating Events Screening Questions, Section C, Support System Initiators. The answer to the question in Section C would be NO, because the finding by itself did not increase the likelihood of a loss of two transmission lines with one line OOS. The Millstone licensing basis is to prevent a dual-unit LOOP, with one transmission line OOS, for a simultaneous double circuit tower fault or with a grid fault on a single transmission line that is properly cleared. The May 25, 2014, event was outside of the Millstone licensing basis, because the sequence of occurrences that resulted in a dual-unit LOOP, was attributed to a fault on a transmission line that was properly cleared by relay operations at Millstone switchyard, but the same fault was sensed by a distance relay located in a substation several miles from the Millstone, which caused a loss of second transmission line.

The team determined that this finding had a cross-cutting aspect in the area of Human Performance, Procedure Adherence, because the design change process procedure was not adequately followed, in that the impact of the change on the current design basis and licensing bases was not evaluated and understood through the design change process [H.8].

Enforcement:

This finding does not involve enforcement action because no violation of regulatory requirements was identified, as SLOD was a non-safety related system, and therefore, not subject to 10 CFR Part 50, Appendix B requirements. Dominion entered this performance deficiency into their corrective action program (CR 553968). Because this finding does not involve a violation of regulatory requirements and is of very low safety significance (Green), it is identified as a finding. (FIN 05000336, 423/2014011-02, Inadequate Implementation of Dominions Design Change Process).

3. Event Diagnosis and Operator Performance

a. Inspection Scope

The inspectors interviewed Millstone Unit 3 control room personnel that responded to the May 25, 2014, event, including the on-shift Unit Supervisor (US) and Shift Manager (SM)at the time of the event, the Operations Manager, and two other Unit 3 SMs. The interviews were conducted to assess operator performance during the event. The inspectors also reviewed narrative logs, post-event personnel questionnaires, the event review team report, sequence of events and alarm printouts, condition reports, PPC trend data, procedures used by the crew during the event, and procedures delineating crew roles and responsibilities for Emergency Operating Procedure (EOP)implementation.

b. Findings and Observations

Introduction:

The team identified a finding involving the failure of Millstone Unit 3 licensed control room operators to implement a procedure step during their response to the May 25, 2014, LOOP. Specifically, the operations crew did not implement procedurally-required actions of the EOPs in a timely manner, consistent with Emergency Operating Procedure Users Guide (EOPUG), as specified in Technical Specification (TS) 6.8.1.

Description:

On May 25, 2014, at 0701, Millstone Unit 3 was operating at 100 percent power. A generator load reject caused a turbine trip/reactor trip and resultant crew entry into E-0, Reactor Trip or Safety Injection. Both EDGs started and loaded onto their safety buses. At 0705, all immediate actions of E-0 were complete and transition to ES-0.1, Reactor Trip Response, was completed at 0720.

Operators proceeded through ES-0.1 and performed a control room brief for their imminent transition to ES-0.2, Natural Circulation Cooldown, at 0845. However, contrary to OP 3272, EOP Users Guide, operators did not proceed into ES-0.2, as directed by procedure, until 1438, at which point offsite power had been restored and restoration of reactor coolant pumps (RCP) was imminent.

OP 3272 states, in part: Unless otherwise specified, a step need not be fully completed before proceeding to the next step. Once a step is begun, the SM/US may determine it desirable and acceptable to continue the procedure actions even though the current task is not yet complete; however, completing the task in a timely manner is still required.

In summary, the inspectors determined that the operators should have transitioned to ES-0.2 from step 14 of ES-0.1 at approximately 0845 hours0.00978 days <br />0.235 hours <br />0.0014 weeks <br />3.215225e-4 months <br /> in accordance with the EOP rules of usage. Instead, the operators remained at this step for approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

By stopping their progression through the EOPs, the operators delayed implementation of ES-0.2 steps that required RCS boration and cooldown activities which would have resulted in the transition to a more stable shutdown condition.

Analysis:

The performance deficiency was that the Millstone Unit 3 operations crew did not properly implement and execute procedurally-required actions of the EOPs in a timely manner and in accordance with the EOPUG, and as required by TS 6.8.1.

Traditional enforcement does not apply since there were no actual safety consequences, no impact on the NRCs ability to perform its regulatory function, or willful aspects associated with the finding.

The finding is more than minor because the finding is associated with the Human Performance attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage).

Additionally, the performance deficiency, if left uncorrected, would have the potential to lead to a more significant safety concern. It is required by Technical Specifications and individual operator licenses that procedures are correctly implemented. The inspectors evaluated the finding using the Phase 1, Initial Screening and Characterization of Findings, worksheet in Attachment 4 to IMC 0609, Significance Determination Process and determined the finding to be of very low safety significance (Green). The finding was of very low safety significance (Green) because it did not result in an actual loss of function, only delayed additional cooldown and boration activities that would have assisted in event mitigation given the existing plant conditions.

This finding had a cross-cutting aspect in the Human Performance cross-cutting area, Procedure Adherence component, because Millstone Unit 3 licensed personnel did not implement EOPs in a timely manner and in accordance with the EOPUG [H.8].

Enforcement:

The inspectors identified a violation of TS 6.8.1, Procedures, which states, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Appendix A of RG 1.33, February, 1978. Regulatory Guide 1.33, Appendix A, Paragraph 2, General Plant Operating Procedures, requires written procedures for Recovery from Reactor Trip.

Contrary to the above, on May 25, 2014, the control room crew did not implement EOPs in a timely manner and in accordance with EOP usage guidelines. Specifically, the Millstone Unit 3 operations crew stopped from approximately 0845 to 1438 at Step 14 of ES-0.1, which did not contain any logic to prevent proceeding to the next step, contrary to EOP Usage Guidelines and OP 3272. Although there were no actual safety consequences to the operators actions, failing to implement the EOPs for an extended period of time could have resulted in operators not addressing plant conditions in accordance with the EOPs, especially when additional cooldown and boration activities could have assisted in event mitigation given the existing plant conditions. This operator performance issue was entered into the licensees CAP as CR 551059. The violation is being treated as a non-cited violation (NCV), consistent with Section 2.3.2 of the Enforcement Policy. (NCV 05000423/2014011-03, Failure to Correctly Implement Emergency Operating Procedures).

4. General Equipment Performance

a. Inspection Scope

The team reviewed and assessed the Units 2 and 3 initial equipment conditions and equipment response, including consistency with the plants design and regulatory requirements, and identification of any potential design deficiencies. The team reviewed the Dominion Event Review Team Report, PPC data, maintenance work orders, operating experience and generic communications, operability determinations, post-maintenance testing results, and condition reports. However, consistent with the SIT Charter contained in Attachment 1, the teams primary focus was on activities and complications associated with the event at Unit 3.

b. Findings and Observations

No findings were identified.

Unit 3 B Instrument Air Compressor The B IAC failed to re-start following the EDG start and vital bus load sequencing resulting in an approximately 2-hour loss of instrument air. The team reviewed Dominions troubleshooting analysis, which identified, based on intermittent resistance readings, the most likely cause of the failure of the B IAC to re-start was due to a failed start-permissive relay. The team noted that this normally-energized Westinghouse relay (Type BF62F) for the non-safety-related B IAC was originally installed-equipment, and aged relays that fail to change state, often exhibit intermittent resistance readings. The team noted that Dominion had classified this relay as non-critical, consistent with its function in accordance with maintenance rule guidelines. Additionally, the team did not identify any self-imposed or industry-driven standard that would have established preventive maintenance activities for this failed relay.

Unit 3 Low Pressure Turbine Rupture Disk During the loss of offsite power event, the circulating water pumps lost power and were no longer removing heat from the condenser, as designed. As a result, the pressure increased in the condenser as the vacuum degraded due to the loss of cooling water.

Shortly before the operators closed the MSIVs to limit steam in-leakage to the condenser, the A low pressure turbine rupture disk activated, as designed. The rupture disk was replaced prior to the unit restarting. The inspectors determined that the rupture disk performed as designed to protect the condenser from overpressure.

Unit 3 Turbine Driven Auxiliary Feedwater Pump Discharge Pressure The team evaluated the performance of the TDAFW, noting that the Woodward turbine speed control governor was replaced on January 26, 2014.

The TDAFW pump, 3FWA*P2, started and provided feedwater flow to the steam generators as designed during a LOOP. The operators took actions per standing order SO-14-004, which was established to minimize the potential for lifting auxiliary feedwater discharge relief valve (3FWA*RV45), to control the rate of closure of the TDAFW pump flow control valves (3FWA-H32A/B/C/D and 3FWA-H36A/B/C/D) to greater than 15 seconds over full travel in the closed direction. Dominion developed the SO following discharge pressure spikes observed during a full flow test conducted on January 26, 2014, following the replacement of the Woodward governor. On three occasions during the May 25, 2014, LOOP event, as flow was being throttled, the discharge pressure of the pump exceeded the discharge relief valve (3FWA*RV45) setpoint of 1850 psig, approximately one second in duration for each occurrence. A review of the PPC trend data showed the peak discharge pressure reached during the event was 1881.2 psig

(~1.7 percent above the relief valve setpoint) for 1.5 seconds. The Crosby JLT spring-loaded relief valve is designed to allow a steady stream of fluid to flow from the valve when system pressure reaches the 1850 psig setpoint, and to open with a pop type lift to the full lift position when system pressure increases to 3-5 percent overpressure.

Dominion removed 3FWA*RV45 to perform as-found testing and determined the valve had performed as designed, and a pop-type lift did not occur during the May 25, 2014, event.

Dominions review of the PPC trend data of discharge pressure during the event showed that some of the pressure spikes were observed to occur in the open direction.

Moreover, Dominion had not seen this phenomenon in previous maintenance and surveillance TDAFW pump runs. As a result, the SO was modified to include controlled throttling in both the open and closed direction.

Following the event, Dominion reduced the operating speed of the TDAFW pump from the design speed setting of 4500 +/- 50 RPM to 4475 +/- 10 RPM to increase the margin between the discharge pressure and the relief valve setpoint. The revised speed setting will provide approximately 6.4 percent margin between the average operating discharge pressure and the relief valve setpoint. However, the team noted that this new operating range is 10 RPM above the lower limit of the in-service testing operating band of 4455 RPM. Dominion initiated a CR 550279 to implement a design change to increase the operating margin of the TDAFW pump.

Unit 3 Volume Control Tank The volume control tank (VCT) maintains specific hydrogen concentrations in the RCS to control and scavenge oxygen produced due to radiolysis of the water. The VCT has two pressure control valves which work together to maintain hydrogen pressure in the tank.

The first pressure control valve, 3GSH-PV48, is an air-operated valve controlled by a pressure transmitter, which is powered by a non-safety bus. The second pressure control valve, 3GSH-PCV43, is a mechanical regulator set to limit downstream pressure to 50 psia. Normal VCT pressure is approximately 39 psia.

During the event, the Unit 3 VCT over-pressurized causing its relief valve to lift and relieve its contents to the primary drains transfer tank (PDTT) which is located in the Auxiliary Building (AB). The cause of the VCT pressurization was determined to be a failure of pressure control valve, 3GSH-PCV43. Upon the loss of instrument air caused by the LOOP and failure of the B IAC, control valve 3GSH-PCV48 closed as designed.

When instrument air was restored, the pressure transmitter remained de-energized because its power was from a de-energized non-safety bus. Subsequently, as designed, 3GSH-PCV48 responded to the failed low pressure transmitter and associated increased VCT pressure. As the pressure increased in the VCT, 3GSH-PCV43 failed to maintain pressure at or below 50 psia, and the VCT over-pressurized. As designed, the relief valve lifted to protect the VCT. As-found inspection conducted by Dominion of 3GSH-PCV43, identified the existence of perforations in the valve diaphragm, which was repaired prior to plant start-up. The inspectors reviewed previous condition reports and work orders associated with 3GSH-PCV43 and determined the valve had a history of maintenance issues; however, 3GSH-PCV43 does not have any associated preventative maintenance activities. Dominion initiated a CR 550280 to perform a maintenance rule functional failure evaluation of 3GSH-PCV43.

Unit 3 Pressurizer Power Operated Relief Valves The PORVs cycled 11 times during the event while an alternate letdown path was being established. The initial six times were automatic, and the last five times were manual to maintain a pressure band between 2200-2300 psig. The inspectors determined that the PORVs operated as designed and that operator actions were appropriate to control reactor plant pressure.

Unit 3 Shutdown Instrument Air Compressors The team determined that while the UFSAR still listed the air compressors as being available to provide a reliable source of air for limited shutdown loads during a LOOP event, they were identified by Northeast Utilities in 1997, to adversely affect the component cooling water (CCW) system response during design basis events. As a result, they were effectively removed as a credited system, without removal of the corresponding UFSAR language, utilizing design change request (DCR), M3-97005, Shutdown Compressors Unavailability Acknowledgement, Revision 0, and abandoned in place with some potential to be utilized following implementation of preventive maintenance (PM) and/or corrective maintenance. The team noted that although these air compressors could have been more effectively maintained (preventive maintenance)for emergency use under specific conditions, they were not required to be available for accident mitigation during the events of May 25, 2014.

5. Emergency Plan/Event Response

a. Inspection Scope

The team reviewed Dominions Emergency Plan and Emergency Action Levels to determine if the Plan was implemented appropriately in response to the event. The team also reviewed condition reports, offsite notification forms, and 10 CFR 50.72 event notifications.

b. Findings and Observations

No findings were identified.

The team determined that Dominion implemented their emergency plan appropriately.

The emergency classification level of NOUE was appropriate and the notifications and communications to the offsite response organizations and the NRC were timely.

6. Radiological Response

a. Inspection Scope

The team reviewed and assessed the effectiveness of Dominions radiological response to this event. Because Unit 2 did not experience radiological issues following the event, the team focused on the Unit 3 Auxiliary Building (AB) and containment areas that were impacted by associated RCS water inputs from the PDTT overflow via lifting of the VCT relief valve and the PRT via the activation of the rupture disc, respectively. The team interviewed plant personnel involved in the radiological response and walked down the impacted areas in the AB. The team also reviewed applicable surveys, air samples, and the offsite dose calculations performed to address the unexpected gaseous release from the reactor plant ventilation vent due to the overflow of the PDTT into the AB.

b. Findings and Observations

No findings were identified.

In the Unit 3 AB, the team noted that RCS water from the overflow of the PDTT, while normally directed to the building sump, also affected the reactor plant gaseous ventilation system (VRS). This resulted in a flowpath from the VRS system on the 66 foot elevation of the AB, down to the basement via cable chase holes in the floors.

The team verified that radiation protection (RP) personnel took appropriate steps to survey and post/demarcate the affected areas in accordance with site procedures, and consistent with requirements of 10 CFR Part 20, Standards for Protection Against Radiation. Contamination levels ranged from 12 millirad on the 66 foot elevation, under the VRS damper, to 10,000 disintegrations per minute (dpm) on areas of the floor on the 4-foot elevation, based on large area swipes. The affected areas were decontaminated by June 1, 2014, with no personnel contaminations, and appropriately de-posted. The pressurizer rupture disc in containment was surveyed and levels of 2 million dpm were identified. The disc was replaced and no personnel contamination events occurred during the disc replacement or decontamination efforts.

The total dose received by personnel during this event, including decontamination and maintenance activities, was 17 millirem (mR) for Unit 2 and 100 mR for Unit 3. A conservative calculation was performed by Dominion staff that bounded the amount of activity released to the environment. In particular, the team noted that Dominion made an extremely conservative assumption that the entire RCS volume leaked into the AB, completely degasified, and completely released into the atmosphere in one hour. The calculation showed that this resultant dose (mostly from tritium), given the extremely conservative assumptions, was 0.01 mR, far below NRC release limits, and both historical and design values contained in the UFSAR for this particular release path and radionuclide. The team noted these results will be reported to the NRC in the annual effluents report.

7. Risk Significance

a. Initial Assessment The initial risk assessment for this event is documented in the enclosed SIT charter (Attachment 1).

b. Estimation of Event Core Damage Probability for Both Units In accordance with the SIT charter, a Region I Senior Reactor Analyst used the information developed by the team and the Millstone Standardized Plant Analysis Risk (SPAR) models to estimate the CCDP for each unit given the actual LOOP on May 25, 2014.

Unit 2 The Millstone Unit 2 SPAR model, Revision 8.17, dated July 2008, with the assumptions and changes discussed below, was used to estimate a CCDP in the range of 1 in 120,000 (mid to high E-6) given the actual event. The dominant core damage sequences included: the grid related loss of offsite power and the failure of the onsite AC power supplies - failure of the two unit EDGs and the station blackout diesel generator (SBODG) because of a common cause failure; failure of TDAFW; and failure to recover offsite power or a failed unit EDG in one hour.

• The probability of grid-related LOOP (IE-LOOPGR) was set to 1.0; all other initiating event probabilities were set to zero.

• Offsite Power Recovery- Operators were able to recover offsite power to both units in approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, therefore:

o Basic events OEP-XHE-XL-NR01HGR (Operator Fails to Recover Offsite Power in 1 Hour) and OEP-XHE-XL-NR02HGR (Operator Fails to Recover Offsite Power in 2 Hours) were set to TRUE.

o Basic events OEP-XHE-XL-NR03HGR (Operator Fails to Recover Offsite Power in 3 Hour), OEP-XHE-XL-NR06HGR (Operator Fails to Recover Offsite Power in 6 Hour) and OEP-XHE-XL-NR08HGR (Operator Fails to Recover Offsite Power in 8 Hour) were set to a nominal failure probability of 1E-3, based on the availability of offsite power and associated procedures to repower the safety busses.

• Emergency Diesel Generator Failure to Run - The mission time for the two Unit 2 EDGs and the SBODG was adjusted to the 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, resulting in a failure to run of 7.7E-3 for all three machines. (Basic Event ZT-DGN-FR-L, used as a template for EDG failures to run, mission time taken to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> vice 23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br /> in the base model)

• To adjust the potential for using the SBODG at Unit 2, the basic event for a dual unit LOOP was set to 1.0 and the chance that Unit 3 would preferentially need the SBODG was set to the probability of Unit 3 EDGs failing in a 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> exposure period equal to 3.5 E-4.

• All test and maintenance basic events were set to false, because there was no significant equipment OOS at the time of the event.

• The Unit 2 SPAR model was changed to correct an error, which had assumed that station DC battery chargers were needed to support the starting of the motor-driven auxiliary feedwater (MDAFW) pumps. The change would fail the associated MDAFW pump if DC power from the associated station batteries was not available to supply control power to the 4160 VAC safety busses.

Unit 3 The Millstone Unit 3 SPAR model, Revision 8.20, dated August 2009, with the assumptions and changes discussed below, was used to estimate a CCDP in the range of 1 in 137,000 (mid to high E-6) given the actual event. The dominant core damage sequence included: the grid related loss of offsite power and the failure of the onsite AC power supplies - failure of the two unit EDGs and the SBODG because of a common cause failure; failure of TDAFW; and failure to recover offsite power or a failed unit EDG in one hour.

• The probability of grid-related LOOP (IE-LOOPGR) was set to 1.0; all other initiating event probabilities were set to zero.

• Offsite Power Recovery - Operators were able to recover offsite power to both units in approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, therefore:

o Basic events OEP-XHE-XL-NR01HGR (Operator Fails to Recover Offsite Power in 1 Hour) and OEP-XHE-XL-NR02HGR (Operator Fails to Recover Offsite Power in 2 Hours) were set to TRUE.

o Basic events OEP-XHE-XL-NR03HGR (Operator Fails to Recover Offsite Power in 3 Hour), OEP-XHE-XL-NR04HGR (Operator Fails to Recover Offsite Power in 4 Hour) OEP-XHE-XL-NR06HGR (Operator Fails to Recover Offsite Power in 6 Hour) and OEP-XHE-XL-NR08HGR (Operator Fails to Recover Offsite Power in 8 Hour) were set to a nominal failure probability of 1E-3, based on the availability of offsite power and associated procedures to repower the safety busses.

• Emergency Diesel Generator Failure to Run - The mission time for the two Unit 3 EDGs and the SBODG was adjusted to the 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, resulting in a failure to run of 7.7E-3 for all three machines. (Basic Event ZT-DGN-FR-L, used as a template for EDG failures to run, mission time taken to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> vice 23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br /> in the base model)

• The basic event for a dual unit LOOP was set to 1.0.

• Except for the diesel driven fire pump, all test and maintenance basic events were set to false, because there was no significant equipment OOS at the time of the event.

• The difficulties in controlling RCS pressure, given the inability to quickly restore letdown flow, resulted in the opening of the two PORVs a total of 11 times. The basic events for event conditional PORV operation (opening) during a LOOP or SBO were taken to 1.0. The chance of each PORV sticking open was increased, given the total of 11 demands (PPR-SRV-OO-455A increased by a factor of 6 to 5.8E-3 and PPR-SRV-00-456 increased by a factor of 5 to 4.8E-3).

• The instrument air system is not modeled.

8. Exit Meetings

On July 15, 2014, the team presented their overall assessment and observations to Mr. Matt Adams, Plant Manager, and other members of Millstone management and staff.

The inspectors confirmed that any proprietary information reviewed during the inspection period was not retained and properly returned to Millstone personnel.

ATTACHMENT 1 - SPECIAL INSPECTION TEAM CHARTER SPECIAL INSPECTION TEAM CHARTER Millstone Nuclear Power Station Units 2 and 3 Dual-Unit Reactor Trips and Loss of Offsite Power May 25, 2014 Background:

At 0701, on May 25, 2014, a dual-unit reactor trip occurred at the Millstone Station. The station had one offsite line OOS (Line 371) for maintenance. A suspected ground fault on the grid near Haddam Neck caused the loss of offsite line 383. Line 310 tripped on instantaneous over current which was unexpected. The final line (Line 348) tripped on over current when both units attempted to feed their entire output through the single remaining line (Line 348). All onsite emergency diesel generators (EDG) started and powered their respective emergency busses.

The station declared a Notice of Unusual Event (NOUE) for both units at 0715 due to a LOOP for greater than 15 minutes. Offsite power was restored at 1256 on May 25, 2014. The licensee exited the NOUE at 1414 on May 25, 2014.

Unit 2s response to the LOOP was as expected with one minor complication, a water hammer in the condensate polishing system.

Unit 3s response was challenged by a loss of instrument air, resulting in a delay to re-establish letdown or excess letdown. Eventually the operators established a path through the reactor vessel head-vent to the pressurizer relief tank (PRT) in accordance with procedures. This resulted in the opening of the rupture disk on the PRT and the contents of the PRT discharging into primary containment as designed.

Additional Unit 3 challenges included:

• The PORVs cycled approximately 10 times.

• One low pressure turbine rupture disk ruptured during the event.

• The VCT tank over pressurized, lifting a relief valve while trying to re-establish normal letdown. This also resulted in over-pressurizing the primary drain test tank (PDTT) and overflowing the PDTT into the Auxiliary Building.

• The main generator output breakers failed to trip.

• The turbine driven auxiliary feedwater pump (TDAFW) discharge pressure exceeded the pressure set point on its relief valve.

• Instrument air (IA) was not restored in a timely manner. This adversely affected letdown control and operation of various air operated valves.

Basis for the Formation of the Special Inspection Team:

The event was modeled using SAPHIRE 8.1.0 with SPAR model 8.20 and 8.17 for Unit 3 and 2 respectively. The following unit specific evaluations are as follows:

Unit 2: An Event Assessment was conducted in the Event Condition Assessment (ECA)module. The initiating event was classified as a switchyard centered LOOP. It took approximately 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to restore offsite power to the safety buses. As a result mission time for auxiliary feedwater (AFW), EDGs, and offsite power were adjusted in accordance the Risk Assessment Standardization Program (RASP) Vol 1, Section 10 guidance. Since Millstone only has one station blackout (SBO) diesel, on a dual unit LOOP resulting in an SBO, Unit 3 is given priority for the SBO EDG. This was adjusted by adjusting the dual unit LOOP basic event to True. There were no other equipment or operator action adjustments made to the model. The resulting conditional core damage probability (CCDP) was approximately 3.7E-6. The dominant sequence was the LOOP with a failure of AFW and a failure to successfully conduct feed and bleed.

Unit 3 LOOP with TDAFW: An Event Assessment was conducted in the ECA module. The initiating event was classified as a switchyard centered LOOP. It took approximately 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to restore offsite power to the safety buses. As a result, mission time for AFW, EDGs, and offsite power were adjusted in accordance the RASP Vol 1, Section 10 guidance. Due to complications resulting from the loss of IA and the recycling of the PORVs, the basic event for PORV operations during a LOOP, identified as PPR-SRV-CO-LOOP, was set to 1.0. In addition, the diesel-driven fire pump was reported to be OOS. This was addressed by adjusting the basic event that credits firewater makeup to the steam generators (S/Gs), AFW-XHE-XM-FIREW, to 1.0. The TDAFW discharge relief valve set point was exceeded during the transient. In the event that the motor-driven AFW pumps were not in service, such as in an SBO sequence, the demands on the TDAFW would have been greater and the relief valve would have been further challenged. It is assumed in these cases that the TDAFW pump would fail to deliver sufficient flow; therefore the fail to run was set to 1.0. This conservative assumption bounds the worst case scenario with respect to the impacts of the relief valve issue since an understanding of the exact failure mechanism is not fully developed. The dominant sequence is for an SBO with a CCDP of 1.4E-5.

In accordance with Inspection Manual Chapter 0309, Table 1, the condition for Unit 3 places the recommended inspection in the overlap between a Special Inspection and an Augmented Inspection. The condition for Unit 2 places the recommend inspection in the overlap between no additional inspection and a Special Inspection. Since both units have large dry containments, contributions from conditional large early release are minimal.

Objectives of the Special Inspection:

The objectives of the special inspection are to review and assess:

(1) the plants response to the trips and LOOP including any responses which may have challenged the design and licensing basis;

(2) equipment issues related to the event;

(3) operator performance and communication related to the event;

(4) procedural adequacy concerns; and

(5) how Dominion responded and addressed the unexpected perturbations on Unit 3. To accomplish these objectives, the following will be performed:

1. Develop a complete sequence of events for Units 2 and 3 including follow-up actions taken

by Dominion. This review should consider any licensee-developed timelines, logs, strip chart recordings, computer points and trends, sequence of events printouts, or other data used by Dominion to analyze and/or reconstruct the event.

2. Review and assess the equipment response to the event and evaluate whether it was

consistent with plant design and licensing basis. In addition, review and assess the adequacy of associated operability assessments, technical or engineering evaluations, corrective and preventive maintenance, and post-maintenance testing. Evaluate the safety significance of any equipment issues identified as well as their impact on the plants license, technical specifications, regulatory requirements, or aging management programs.

3. Review and assess operator performance including procedures, logs, communications

(internal and external), and appropriateness of NRC reporting during the event. Consider use of the plant specific simulator to verify plant response was consistent with the design including any operator actions taken.

Also, consider Dominions implementation of the emergency plan during the event.

4. Review and assess the effectiveness of Dominions response to this event. This should

include internal and external communications, directions of actions from the outage control center, and short term actions taken to address the identified equipment issues.

5. Assess whether maintenance-related activities could have contributed to the event, or

impacted the response and recovery. In addition, evaluate Dominions control of switchyard activities (including coordination with the transmission operator) that may affect offsite power reliability and its effect on plant safety.

6. Review the radiological consequences of the event and the impacts, if any, on worker

occupational doses and offsite release.

7. Review relevant operating experience to assess Dominions effectiveness at identifying and

correcting any similar equipment issues or the prevention of any previous similar events.

8. Review and assess the adequacy of procedures and adherence to procedures used to

respond to the dual-unit trip, particularly those associated with the loss of instrument air and the restoration of the reactor coolant system letdown/excess letdown system.

9. Evaluate the impact of the dual unit trip and the LOOP on licensee event response activities

and communications.

10. Collect any data necessary to refine the existing risk analysis and document the final independent risk analysis in the Special Inspection Team report.

Additionally, the team leader will review lessons learned from the Special Inspection and, if appropriate, prepare a feedback form on recommendations for revising the Reactor Oversight Process baseline inspection procedures in order to proactively identify the issues and causes involved with the event.

Guidance:

Inspection Procedure 93812, Special Inspection, provides additional guidance to be used by the Special Inspection Team. Team duties will be as described in Inspection Procedure 93812.

The inspection should emphasize fact-finding in its review of the circumstances surrounding the event. It is not the responsibility of the team to examine the regulatory process. Safety concerns identified that are not directly related to the event should be reported to the Region I office for appropriate action.

The Team will conduct an entrance meeting and begin the initial onsite inspection on June 2, 2014. While on site, the Team Leader will provide daily briefings to Region I management, who will coordinate with the Office of Nuclear Reactor Regulation, to ensure that all other parties are kept informed. A report documenting the results of the inspection should be issued within 45 days of the completion of the inspection. This Charter may be modified should the team develop significant new information that warrants review.

ATTACHMENT 2 - DETAILED SEQUENCE OF EVENTS - UNIT 3 Initial Plant Conditions: Plant at 100 percent power; Line 371 (Montville) OOS for scheduled maintenance; 07:01:43 Line 383 (Card) isolates due to ground fault of a disconnect switch at the Card substation; 07:01:43 Line 310 (Manchester) relay actuates for the fault at the Card substation 07:01:44 Line 348 (Beseck) isolates on overload due to both Millstone Unit outputs attempting to pass through one power line, which it is not designed or capable; 07:01:45 Unit 3 turbine trips on power/load unbalance followed by automatic reactor trip, as expected; 0702 - Entry into E-0; both EDGs start and power safety buses; 0705 - E-0 immediate actions complete 0715 - NOUE (PU1) declared 0720 - Exit E-0, enter ES-0.1 0723 - CHS-MV8106 closed (charging air-operated valve failed open, motor operated valve closed to limit charging to seal injection)0728 - Low pressure turbine A rupture disc blown 0729 - MSIV and MSIV bypass valves closed 0736 - Commenced immediate boration 0739 - Loss of PPC 0741 - B IAC would not start 0749 - PORV actuation in automatic 0800 - Reactor operator manually controlling RCS pressure using PORVs between 2200-2300 psig 0824 - Reactor vessel head vent letdown attempted to VCT; unsuccessful due to air loss to air-operated valve in line 0827 - Pressurizer level >89%

0828 - Main generator breaker found closed. Unable to open manually, used emergency trip pushbuttons to trip breaker 0904 - Reactor vessel head vent letdown established to PRT 0923 - Actuation of PRT rupture disc 0935 - B Instrument air compressor restored with domestic water cooling 1002 - Offsite power available to the Unit 3 reserves station service transformer (RSST)1004 - Normal charging and letdown established 1005 - PPC restored 1010 - PDTT level high due to VCT relief valve lifting 1015 - Isolated normal letdown, re-established letdown using reactor vessel head vents to VCT.

Normal letdown flow, no VCT level rise, PDTT high level, VCT high pressure 1016 - Began restoring RSST power supply to buses 34C and 34D 1028 - RSST powering bus 34C, A EDG breaker open 1036 - Bus 34A being supplied from Bus 34C 1038 - VCT pressure lowered by diverting flow 1040 - Report of leak in the Auxiliary Building above the Containment Hatch area, 43 PAB 1054 - B supplemental leak collection and recirculation system (SLCRS) stopped to support VCT high pressure; concern about water in lines and affecting both SLCRS 1105 - RSST powering bus 34D, B EDG breaker open 1105 - Vented VCT per ARP; pressure reduced from 100 psig to 35 psig 1105 - Pressurizer level <89%

1110 - Bus 34B being supplied from bus 34D; all 4160V buses energized, EDGs OFF/AUTO 1113 - PPC restored to control room 1228 - Pumped PDTT 1238 - Procedure 3209B-2, Shutdown Margin Determination for Mode 3, 4, 5, completed satisfactory; RCS average temperature at 557 degrees Fahrenheit 1256 - Offsite power restored to all safety buses 1325 - VCT filled to 40% from manual blended makeup to verify VCT level responding appropriately 1328 - Charging pump suction transferred from refueling water storage tank to VCT 1336 - Normal charging and letdown established 1355 - RCP thermal barrier flow restored 1401 - RCS boron concentration reported as 1039 ppm 1413 - Spent fuel pool cooling restored 1414 - NOUE Terminated 1438 - Transition from ES-0.1 to ES-0.2 1527 - Bus 35B energized 1553 - B RCP started 1607 - Exited ES-0.2 to OP 3207 1635 - Procedure 3209B-2, Shutdown Margin Determination for Mode 3, 4, 5 completed Sat.

Current RCS boron concentration 1039 ppm, required Xenon free boron concentration 638 ppm 1649 - Procedure 3209B-2, Shutdown Margin Determination for Mode 3, 4, 5 completed Sat.

Anticipated cooldown to 350 degrees F, current RCS boron concentration 1039 ppm, required Xenon free boron concentration 1024 ppm 1653 - TDAFW pump stopped, feeding all steam generators with motor-driven AFW pumps 1740 - B Instrument air compressor cooling supplied by turbine building CCW ATTACHMENT 3 - ELECTRICAL SEQUENCE OF EVENTS On May 25, 2014, at approximately 0701, Millstone Unit 2 and Unit 3 experienced a loss of offsite power while both units were operating at 100 percent power (total output 2166 MWe Gross). The layout of the Millstone switchyard and the four transmission lines emanating from the switchyard are illustrated in Attachment 4, Figure 1.

Prior to and during the event, the Millstone - Montville 371 line was OOS for scheduled maintenance, isolated from the Millstone switchyard through the opening of associated breakers 15G-4T-2 and 15G-5T-2. The events of May 25 appears to have been initiated with the occurrence of a C phase-to-ground fault on a disconnect switch located on the Millstone - Card 383 line located in the Card substation. This fault was subsequently cleared by relay operations at the Millstone switchyard and the Card substation, as expected, which resulted in the opening of breakers 15G-1T-2 and 15G-2T-2 in the Millstone switchyard, to properly isolate the faulted condition. This fault was also apparently sensed as an instantaneous ground fault in the Manchester substation, where relay actuation tripped the Millstone - Manchester 310 line. This resulted in three of the four transmission lines being OOS, resulting in the total electrical output from both Units 2 and 3 overloading the remaining Millstone - Beseck 348 line, which tripped-open after 1.3 seconds on overload. Breakers 15G-14T-2 and 15G-15T-2 in Millstone switchyard properly operated, which isolated the Beseck Line 348 from the switchyard.

The team noted that the apparent event initiator, the disconnect switch in the Card substation, was a known, degraded condition and was scheduled to be replaced at some point following the maintenance activities associated with Line 371. However, the condition of the disconnect switch was apparently unknown to Dominion, primarily due the location of the switch in the Card substation, which is owned and operated by Northeast Utilities and not under the purview of Dominion.

The loss of all four transmission lines resulted in following:

• Unit 2 o Loss of offsite power sources o Turbine tripped on power-load imbalance o Turbine trip initiated reactor trip signal, which caused the reactor trip o Generator tripped on reverse power. Reverse power signal opened breakers 15G-8T-2 and 15G-9T-2 in Millstone switchyard

• Unit 3 o Loss of offsite power sources o Turbine tripped on power-load imbalance o Turbine trip initiated reactor trip signal, which caused the reactor trip o Generator output breaker did not trip, which was an expected response ATTACHMENT 4 - ELECTRICAL FIGURES FIGURE 1 - Millstone Unit 2 and Unit 3 Switchyard FIGURE 2 - TRANSMISSION LINE TOWERS - PREVIOUS DESIGN FIGURE 3 - TRANSMISSION LINE TOWERS - NEW DESIGN ATTACHMENT 5 -

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

S. Smith, Manager - Operations

C. Chapin, Manager - Millstone 3 Operations

J. Barile, Nuclear Engineer III

G. DAuria, Chemistry Supervisor

K. Deslandes, Design Engineering Supervisor

T. Ickes, IST Engineer

E. Lane, Radiation Protection and Chemistry Manager

C. Maxson, Manager, Nuclear Engineering, Site

M. Nappi, Radiation Protection Supervisor

J. Plourde, Electrical System Engineer

D. Scott, Senior Engineer

B. Wilkens, Manager - Millstone Excellence

LIST OF ITEMS OPENED, CLOSED, DISCUSSED, AND UPDATED

Opened/Closed

05000336, 423/2014011-02 FIN Inadequate Implementation of Dominions Design Change Process (Section 2.2)

05000423/14011-03 NCV Failure to Correctly Implement Emergency Operating Procedures (Section 2.3)

Opened

05000336, 423/2014011-01 AV Failure to Complete a 10 CFR 50.59 Evaluation for Removal of SLOD (Section 2.1)

Closed

None