L-17-216, Response to NRC Inspection Report 05000440/2017009 and Preliminary White Finding

Response to NRC Inspection Report 05000440/2017009 and Preliminary White Finding

ML17200C945
Person / Time
Site:	Perry
Issue date:	07/14/2017
From:	Hamilton D FirstEnergy Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-17-216 IR 2017009
Download: ML17200C945 (6)

Text

FENOC' Perry Nuclear Power Plant P.O. Box 97 10 Center Road Perry, Ohio 44081 FirstEnergy Nuclear Operating Company 440-280-5382 David B. Hamilton Vice President -

July 14, 2017 L-17-216 A ITN: Document Control Center U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Perry Nuclear Power Plant Docket No. 50-440, License No. NPF-58 Response to NRC Inspection Report 05000440/2017009 and Preliminary White Finding On June 5, 2017, the Nuclear Regulatory Commission (NRC) issued Inspection Report 05000440/2017009 and a Preliminary White Finding to the Perry Nuclear Power Plant.

This Inspection Report contained a Preliminary White Finding and Apparent Violation

• 05000440/2017009-01 "Unsuitable Application of Surge Suppression Diodes in Standby Diesel Generator Control Power Circuitry."

In a letter dated June 14, 2017, the FirstEnergy Nuclear Operating Company (FENOC) notified the NRC of our choice to submit a written response to the Inspection Report.

Attached is FENOC's response, which adds some clarification to the initial apparent violation.

We have reviewed the preliminary white finding and we believe the description of the performance deficiency does not comport with the root cause and it does not accurately characterize the issue. The attachment provides detail of the disputed language. We respectfully request your consideration of this information prior to issuing the final violation.

There are no regulatory commitments contained in this letter. If there are any questions or if additional information is required, please contact Mr. Nicola Conicella, Manager-Regulatory Compliance, at (440) 280-5415.

Sincerely, f)--1<~

David Hamilton Vice President

Perry Nuclear Power Plant L-17-216 Page 2 Attachments Response to Apparent Violation 05000440/2017009-01 "Unsuitable Application of Surge Suppression Diodes in Standby Diesel Generator Control Power Circuitry" cc: NRG Branch Chief - Jamnes Cameron NRG Project Manager - Kimberly Green NRG Regional Administrator - Cynthia D Pederson NRG Director of Reactor Projects - Patrick L. Louden NRG Resident Inspectors

Attachment l-17-216 Page 1of4 Violation Details Inspection Report 05000440/2017009, dated June 5, 2017, contained the following Preliminary White Finding for the Perry Nuclear Power Plant (PNPP):

Preliminary White. The inspectors identified a finding preliminarily determined to be of low to moderate safety significance (White), and an associated apparent violation of Title 10 of the Code of Federal Regulations (10 CFR) 50, Criterion Ill, "Design Control," for the licensee's failure to implement measures for the selection and review for suitability of application of voltage suppression diodes installed in the control circuitry for the Division 2 Standby Diesel Generator, which was a component subject to the requirements of 10 CFR Part 50, Appendix B.

Specifically, Engineering Change Package 04-0049 failed to consider the effects of a shorted diode on the control circuitry for the Division 2 Standby Diesel Generator, and instead, introduced new components (diodes) into the control circuitry that resulted in the eventual failure of this safety-related equipment. This rendered the standby diesel generator inoperable and unable to start for longer than its technical specification allowed outage time, which was a violation of Technical Specification 3.8.1, "AC Sources-Operating." The licensee documented the issue in CR 2016-13183, and subsequently replaced the failed component and then modified circuitry to remove the replacement diode and the remaining diodes from similar components.

The inspectors determined that the licensee's failure to evaluate the effects of voltage suppression diode failure on the Standby Diesel Generator control circuit was contrary to the requirements of 10 CFR Part 50, Appendix B, Criterion Ill and a performance deficiency which was within the licensee's ability to foresee and prevent. The inspectors determined that the performance deficiency was of more than minor significance because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the design of the Division 2 Standby Diesel Generator control circuit resulted in the inoperability and unavailability of the Division 2 Standby Diesel Generator from April 2, 2015, to November 8, 2016, when the failed diode was replaced.

A Significance and Enforcement Review Panel, using IMC 0609, Appendix A, "Significance Determination Process for Findings At-Power," dated June 19, 2012, preliminarily determined the finding to be of low-to-moderate safety significance.

The inspectors did not identify any cross-cutting aspects associated with this finding because the condition had existed si.nce at least 2007, when the diodes were originally installed in the DC control power circuits, and therefore, was not indicative of current plant performance. (Section 40A2.1)

Response

The FirstEnergy Nuclear Operating Company (FENOC) does not agree with the performance deficiency as described. FENOC asserts that the design was adequate

Attachment L-17-216 Page 2of4 and appropriate for use in the control circuit and without the manufacturing defect would have functioned as designed.

The Apparent Violation as described has these main points that FENOC does not agree*

with:

• Installation of surge suppression diodes in the SDG control circuit was not evaluated and, without mitigation for failure, was not appropriate for the SDG control power circuit.

• Installation of surge suppression diodes provided no safety benefit to the SDG control system.

• The diode failure rendered the standby diesel generator inoperable and unable to start for longer than its technical specification allowed outage time.

Details Installation of surge suppression diodes in the SDG control circuit was not evaluated and, without mitigation for failure, was not appropriate for the SDG control power circuit.

• The effects of a diode failure were considered as an aggregate evaluation of parts rather than component by component individual evaluations. The Updated Safety Analysis Report (USAR) does not discuss the reliability of SDG components at the level that the change was being made. For the SDG engine and generator, the USAR only discusses malfunction of the SDG as a unit with the result being the loss of one divisional SDG. There are no failure modes and effects analysis in the USAR for subcomponents of the diesel generator itself, the speed control system or its controls.

• No new failure modes were introduced by the addition of surge suppression diodes as addressed in NEI 96-07 "Guidelines For 10 CFR 50.59 Evaluations" section 4.3.6. The 50.59 Evaluation for ECP 04-0049 states "Reliability of the new components has been based on industry experience and experience at other nuclear facilities .... [operating] experience was reviewed through [Institute of Nuclear Power Operations] and no adverse trends were noted for the new components."

• The diodes were installed consistent with IEEE recommended practice for Powering and Grounding Electronic Equipment Section 10.4.4.1, Contact Suppression, IEEE Std. 1100-2005, which states, this is standard practice in any industrial control system. It also states that the first choice in a DC circuit is a flyback diode for voltage suppression. The IEEE standard does not provide mitigation strategies for di~de failure.

Installation of surge suppression diodes provided no safety benefit to the SDG control system.

• The use of suppression diodes does provide a safety benefit in that the voltage suppression helps to minimize arcing and degradation of contacts that interrupt current to the relays (reference the Root Cause Report for CR 2016-14456). It was later determined that the diodes could be removed without significantly impacting components in the Division 1 and 2 125 VDC control circuitry and the increased risk could be managed through preventative maintenance (PM) frequency controls.

Attachment L-17-216 Page 3of4 The diode failure rendered the standby diesel generator inoperable and unable to start for longer than its technical specification allowed outage time.

• Continuity testing in May 2016 demonstrated that the diode was not shorted, therefore, had not failed upon de-energization in April 2015. The apparent violation stated that the test conducted in May 2016 was not a valid test.

Although continuity testing would not have detected an internal manufacturing defect, it was an adequate test to determine if the diode was shorted, which would have precluded the SDG from performing its intended function.

• The root cause concluded the cause to be a defective diode (cracked die). It is not clear at what point in time the degradation of the diode would have progressed to the point of failing upon re-energization. With a cracked die in the diode, there are multiple stressors that could have affected it, including temperature changes. Therefore, there is no firm evidence demonstrating that the diode was failed in May 2016. As such, with the absence of firm evidence otherwise, it should be assumed that the diode failed at the time of discovery.

Conclusion FENOC asserts the following:

• Installation of surge suppression diodes in the SDG control circuit was appropriately evaluated and was appropriate for the SDG control power circuit.

• Installation of surge suppression diodes provided a safety benefit to the SDG control system.

• The diode failure did not render the SDG inoperable and unable to start for longer than its technical specification allowed outage time.

The root cause determined the failure to be a manufacturing defect in the specific diode that was installed in the Division 2 SDG that was to protect the components within the SDG start circuitry. This was supported by independent laboratory diode testing and a 10CFR Part 21 notification, by the vendor who supplied the diodes, of a manufacturing defect internal to the diode with the same date code as the installed diode. The supplier of the diodes used non-conservative acceptance criteria for initial diode leakage tests during their dedication process. As a result, the potential exists that a diode was supplied from the manufacturer in a degraded condition and was not detected during commercial grade dedication process. In the absence of a manufacturing defect, the diodes were sufficient for the application.

FENOC agrees that loss of control power to the Division 2 SDG should not have occurred and has taken corrective actions to prevent recurrence. Individual components, such as diodes, purchased under our Quality Assurance (QA) program are assumed to be reliable. In the NRC's Enforcement Policy, section 3.5, the NRC may refrain from issuing enforcement action for violations resulting from matters not within a licensee's control, such as equipment failures that were not avoidable by reasonable licensee QA measures or management controls. FENOC believes this to be the case in that this manufacturing defect was not detected through the supplier's commercial grade dedication process. Hence, FENOC believes NRC discretion is warranted based on our understanding of the deficiency and the root cause conclusions. FENOC respectfully

Attachment L-17-216 Page 4 of 4 requests that this performance deficiency be re-evaluated and discretion applied as per the NRC's Enforcement Policy section 3.5.

i