ML17156A750
| ML17156A750 | |
| Person / Time | |
|---|---|
| Site: | Perry  |
| Issue date: | 06/05/2017 |
| From: | Louden P Division Reactor Projects III |
| To: | Hamilton D FirstEnergy Nuclear Operating Co |
| References | |
| EA-17-043 IR 2017009 | |
| Download: ML17156A750 (16) | |
See also: IR 05000440/2017009
Text
UNITED STATES NUCLEAR REGULATORY COMMISSION REGION III 2443 WARRENVILLE RD. SUITE 210 LISLE, IL 60532-4352 June 5, 2017
Mr. David Hamilton Site Vice President
FirstEnergy Nuclear Operating Company
Perry Nuclear Power Plant
Mail Stop A-PY-A290 P.O. Box 97, 10 Center Road Perry, OH 44081-0097 SUBJECT: PERRY NUCLEAR POWER PLANT-NRC INSPECTION REPORT 05000440/2017009 AND PRELIMINARY WHITE FINDING Dear Mr. Hamilton:
On April 27, 2017, the U.S. Nuclear Regulatory
Commission (NRC) completed an inspection at your Perry Nuclear Power Plant and the inspectors discussed the results of this inspection with you and other members of your staff. The results of this inspection are documented in the enclosed report. The enclosed report documents a finding with an associated apparent violation
that the NRC has preliminarily determined to be White, with low-to-moderate safety significance and an associated Technical Specification (TS) violation of TS 3.8.1, "AC Sources-Operating." This
finding involved the licensee's failure
to evaluate the effects of voltage suppression diode failure on the Standby Diesel Generator (SDG) control circuit, which was a component subject to the
requirements of Title 10
Code of Federal Regulations (CFR) Part 50, Appendix B. Specifically, the licensee failed to consider the effect of a shorted diode on the control circuitry of the SDG,
and, as a result, failed to recognize that installation of voltage suppression diodes across control
relays, with no mitigation for diode failure, was not suitable for the SDG control circuit. This introduction of new components (diodes) into the control circuitry resulted in the eventual failure of the SDG control circuit, thereby rendering the SDG inoperable and unable to start.
We assessed the significance of the finding using the significance determination process
(SDP) and readily available information. We are considering escalated enforcement
for the apparent violation consistent with our Enforcement Policy, which can be found at
http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. Because we have not made a final determination, no notice of violation is being issued at this time. Please be aware that further NRC review may prompt us to modify the number and characterization of
the apparent violation(s)
. We intend to issue our final significance determination
and enforcement decision, in writing, within 90 days from the date of this letter. The NRC's SDP is designed to encourage an
open dialogue between your staff and the NRC; however, neither the dialogue nor the written information you provide should affect the timeliness of our final determination.
D. Hamilton - 2 -
Before we make a final decision, you may choose to communicate your position on the facts and assumptions used to arrive at the finding and assess its significance by either:
(1) attending and presenting at a Regulatory Conference, or (2) submitting your position in writing. The focus of a Regulatory Conference is to discuss the significance of the finding. Written responses should reference the inspection report number and enforcement action
number associated with this letter in the subject line. Your written response should be
sent to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Center,
Washington, DC 20555-001, with a copy to Mr. Jamnes Cameron, Chief, Branch 4, Division of
Reactor Projects, U.S. Nuclear Regulatory Commission, Region III, 2443 Warrenville Road,
Lisle, IL 60532. If you request a Regulatory Conference, it should
be held within 40 days of your receipt of this letter. Please provide information you would like us to consider or discuss with you at least 10 days prior to any scheduled conference. If you choose to attend a Regulatory Conference,
it will be open for public observation. If you decide to submit only a written response, it should
be sent to the NRC within 40 days of your receipt
of this letter. If you choose not to request a
Regulatory Conference or to submit a written response, you will not be allowed to appeal the NRC's final significance determination. Please contact Mr. Jamnes Cameron at 630-829-9833, and in writing, within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision. The final resolution of this matter will be conveyed in separate correspondence. This letter, its enclosure, and your response (if any) will be made available for public inspection
and copying at
http://www.nrc.gov/reading-rm/adams.html
and at the NRC Public Document Room in accordance with 10 CFR 2.390, "Public Inspections, Exemptions, Requests for Withholding" Electronic Reading Room.
Sincerely,
/RA/
Patrick L. Louden, Director
Division of Reactor Projects
Docket No. 50-440 License No. NPF-58
Enclosure: Inspection Report 05000440/2017009 cc: Distribution via LISTSERV
D. Hamilton - 3 -
Letter to David Hamilton from Patrick L. Louden dated June 5, 2017
SUBJECT: PERRY NUCLEAR POWER PLANT-NRC INSPECTION REPORT 05000440/2017009 AND PRELIMINARY WHITE FINDING
DISTRIBUTION: Jeremy Bowen
RidsNrrPMPerry Resource
RidsNrrDorlLpl3
RidsNrrDirsIrib Resource Cynthia Pederson
DRPIII
DRSIII
ROPassessment.Resource@nrc.gov
ADAMS Accession Number: ML17156A750 OFFICE RIII RIII RIII RIII NAME LKozak:tt IKhan RSkokowski JCameron DATE 05/22/2017 05/30/2017 05/23/2017 05/30/2017
OFFICE RIII RIII NAME JLara PLouden DATE 06/01/2017 06/05/2017 OFFICIAL RECORD COPY
Enclosure U.S. NUCLEAR REGULATORY COMMISSION REGION III Docket No: 50-440 License No: NPF-58 Report No: 05000440/2017009 Licensee: FirstEnergy Nuclear Operating Company (FENOC) Facility: Perry Nuclear Power Plant Location: North Perry, OH Dates: December 12, 2016, through April 27, 2017 Inspectors: R. Elliott, Acting Senior Resident Inspector J. Nance, Resident Inspector M. Doyle, Acting Resident Inspector
I. Hafeez, Reactor Inspector
I. Khan, Reactor Inspector
L. Kozak, Senior Reactor Analyst
J. Robbins, Reactor Inspector
Approved by: J. Cameron, Chief
Branch 4
Division of Reactor Projects
2 SUMMARY Inspection Report 05000440/2017009; Perry Nuclear Power Plant; Identification and Resolution
of Problems. The enclosed inspection report documents a finding that has preliminarily been determined to be White, a finding with low to moderate safety significance, that may require additional
U.S. Nuclear Regulatory Commission (NRC) ins
pections, regulatory actions, and oversight, with an associated violation of Technical Specification (TS) 3.8.1, "AC Sources-Operating." The significance of inspection findings is indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) and determined using Inspection Manual Chapter (IMC) 0609,
"Significance Determination Process," dated April 29, 2015. Cross-cutting aspects are
determined using IMC 0310, "Aspects Within the Cross-Cutting Areas," dated
December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRC's Enforcement Policy, dated November 1, 2016. The NRC's program for overseeing
the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," dated July 2016. NRC-Identified and Self-Revealed Findings Cornerstone: Mitigating Systems Preliminary White. The inspectors identifi
ed a finding preliminarily determined to be of low to moderate safety significance (White), and an associated apparent violation of Title
10 of the Code of Federal Regulations (10 CFR) 50, Criterion III, "Design Control," for the licensee's failure to implement measures for the selection and review for suitability of application of voltage suppression diodes installed in the control circuitry for the Division 2 Standby Diesel Generator, which was a component subject to the
requirements of 10 CFR Part 50, Appendix B. Specifically, Engineering Change
Package 04-00049 failed to consider the effects of a shorted diode on the control
circuitry for the Division 2 Standby Diesel Generator, and instead, introduced new
components (diodes) into the control circuitry that resulted in the eventual failure of this safety-related equipment. This rendered the standby diesel generator inoperable and unable to start for longer than its technical specification allowed outage time, which was
a violation of Technical Specification 3.8.1, "AC Sources-Operating." The licensee
documented the issue in CR 2016-13183, and subsequently replaced the failed
component and then modified circuitry to remove the replacement diode and the remaining diodes from similar components. The inspectors determined that the licensee's failure to evaluate the effects of voltage suppression diode failure on the Standby Diesel Generator control circuit was contrary
to the requirements of 10 CFR Part 50, Appendix B, Criterion III and a performance
deficiency which was within the licensee's ability to foresee and prevent. The inspectors
determined that the performance deficiency was of more than minor significance because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability,
reliability, and capability of systems that respond to initiating events to prevent
undesirable consequences (i.e., core damage). Specifically, the design of the Division 2
Standby Diesel Generator control circuit resulted in the inoperability and unavailability of the Division 2 Standby Diesel Generator from April 2, 2015, to November 8, 2016, when the failed diode was replaced.
3 A Significance and Enforcement Review Panel, using IMC 0609, Appendix A, "Significance Determination Process for Findings At-Power," dated June 19, 2012,
preliminarily determined the finding to be of
low-to-moderate safety significance. The inspectors did not identify any cross-cutting aspects associated with this finding because the condition had existed since at least 2007, when the diodes were originally installed in
the DC control power circuits, and therefore, was not indicative of current plant performance. (Section 4OA2.1)
Licensee Identified Finding
None.
4 REPORT DETAILS 4. OTHER ACTIVITIES Cornerstone: Mitigating Systems 4OA2 Identification and Resolution of Problems (71152) .1 Annual Follow-up of Selected Issues: Division 2 Diesel Generator Failure to Start due to a Failed Diode in the 125 VDC Control Power Circuit a. Inspection Scope The inspectors reviewed corrective actions and the licensee's causal analysis for condition report (CR) 2016-06450, which documented the failure of the Division 2 Standby Diesel Generator (SDG) to start during a routine surveillance test conducted on May 6, 2016. The failure to start was due to a shorted surge suppressor diode for relay
R11A, a relay in the normal start portion of the 125 VDC control power circuit for the
SDG. The inspectors evaluated the licensee's identified failure mechanisms and
associated corrective actions for that event in light of a subsequent failure of a shorted surge suppressor diode for relay R10BB in the emergency start circuit for the same SDG that occurred on November 6, 2016. The inspectors also reviewed the licensee's corrective actions and causal analysis for the subsequent failure. As appropriate, the inspectors verified the following attributes during their review of the licensee's corrective actions for the above condition report and other related condition
reports: * complete an accurate identification of the problem in a timely manner commensurate with its safety significance and ease of discovery;
- consideration of the extent of condition, generic implications, common cause, and previous occurrences;
- evaluation and disposition of operability/functionality/reportability issues;
- classification and prioritization of the resolution of the problem commensurate with safety significance;
- identification of the contributing causes of the problem;
- identification of corrective actions, which were appropriately focused to correct
the problem;
- completion of corrective actions in a timely manner commensurate with the safety significance of the issue;
- effectiveness of corrective actions taken to preclude repetition; and
- evaluate applicability for operating experience and communicate applicable lessons learned to appropriate organizations. The inspectors discussed the corrective actions and associated evaluations with licensee personnel. This review constituted one in-depth problem identification and resolution inspection sample as defined in Inspection Procedure (IP) 71152.
5 b. Findings Introduction: The inspectors identified a preliminary White finding associated with an Apparent Violation (AV) of Title 10 of the
Code of Federal Regulations (10 CFR) Part 50, Criterion III, "Design Control," and an associated violation of TS 3.8.1, for the licensee's
failure to implement measures for the selection and review for suitability of application of voltage suppression diodes installed in the control circuitry for the Division 2 SDG, which was a component subject to the requirements of 10 CFR Part 50, Appendix B.
Specifically, Engineering Change Package 04-00049 failed to consider the effects of a
shorted diode on the control circuitry for the Division 2 SDG, and introduced new
components (diodes) into the control circuitry, resulting in the eventual failure of this safety-related equipment, rendering the SDG inoperable and unable to start via the emergency start circuit from April 2, 2015, until the failed diode was replaced on November 8, 2016. Description: On May 6, 2016, while conducting a post-maintenance test of the Division 2 SDG using the normal start circuit, all control power to the SDG was lost, rendering the SDG inoperable. The licensee's investigation determined that the failure was due to a
shorted surge suppressor diode for relay R11A, installed as part of a modification
implemented in 2007. This diode shorted together the positive and negative sides of the control power to the circuitry and caused the125VDC supply breakers (CB-1, CB-2, CB-3, and CB-4) for the two available sources of power to open and de-energize the
control circuitry thus rendering the diesel generator incapable of performing its design
function. The licensee replaced the failed diode and successfully re-tested the SDG.
Since the licensee did not characterize the failure as a significant condition adverse to
quality, a formal root cause analysis was neither required nor performed. During troubleshooting testing, the licensee performed continuity testing of other diodes in the normal and emergency start circuits for the Division 2 SDG, including a diode associated with relay R10BB, which was associated with the emergency start circuit of
the Division 2 SDG and which was also installed as part of the 2007 modification.
However, the testing was insufficient to detect a degraded condition of that diode.
Subsequent vendor testing determined that resistance checks are insufficient to detect failed diodes, and reverse bias leakage current testing was necessary to identify the degraded condition. On November 6, 2016, while performing PTI-R43-P0006B; Division 2 Diesel Generator Pneumatic Logic Board Functional Check; Revision 15, 125 VDC circuit breakers CB-1,
CB-2, CB-3, and CB-4 opened. The licensee entered this failure of the Division 2 SDG
into its Corrective Action Program (CAP) as CR 2016-13183. Subsequent
troubleshooting and causal analysis revealed that a diode installed for voltage
suppression across control relay R10BB failed and caused a short circuit condition on the 125VDC control circuit. The short circuit condition resulted in the 125VDC circuit breakers CB-1, CB-2, CB-3, and CB-4 opening and a subsequent loss of control
power to the Division 2 SDG; the same condition that occurred during the May 16, 2016,
failure of the normal start circuit. As stated above, relay R10BB is used in the diesel
generator's emergency start circuity (i.e. Loss of Off-site Power (LOOP) or Loss of Coolant Accident (LOCA)). The last successful test of the SDG emergency start circuitry was on April 2, 2015. The R10BB relay is not used in the circuit for normal starts.
6 The inspectors reviewed Engineering Change Package (ECP) 04-00049, Standby Diesel Generator Governor Replacement, which installed control relays R10BB and
R11A and their associated voltage suppression diodes in 2007. The inspectors determined that this modification installed voltage suppression diodes across several control relays, including relays R11A and R10BB. The inspectors noted that the ECP
addressed how installation of voltage suppression diodes would limit high voltages
during relay coil de-energization, but failed to address the effects of a diode failure on
the control circuit, specifically in a shorted condition. The inspectors reviewed drawing
206-0216-00006 Sheet 2 Revision Z, Standby Diesel Engine Control Panel 1H51-P054B, and determined that failure of the voltage suppression diode for relay R10BB would result in an effective fault condition on the 125 VDC control power circuit and a
subsequent loss of control power (via opening of circuit breakers CB-1, CB-2, CB-3,
and CB-4) during an emergency start of the SDG. This loss of control power would render the SDG inoperable and unavailable, even through the normal start circuit. The inspectors were concerned that the licensee failed to evaluate the effects of modifying the SDG control power circuit with voltage suppression diodes and, therefore, failed to establish measures to assure the suitability of application of parts and equipment that are essential to safety-related functions of structures, systems, and
components. Specifically, the installation of voltage suppression diodes, without
mitigation for diode failure, was not suitable for use in the SDG control circuit because it
caused an undetectable failure of the SDG. The installation of these diodes produced no apparent safety benefit to the control system to counter the additional unreliability introduced by the new components. This point was documented in the 10 CFR Part 21
notification that Engine Systems, Inc. issued for the diodes on March 27, 2017
(EN 52642). The notification stated that it was acceptable to remove the diodes from
their relays and that no changes or impacts would be expected for the associated
equipment. The licensee, in its root cause evaluation, similarly determined that the diodes were not required to protect components in the control power circuits and could be removed. In its root cause evaluation, the licensee determined that the loss of control power to the Division 2 SDG on May 16, 2016, and on November 6, 2016, was due to a
manufacturing defect in the diodes associated with relays R11A and R10BB,
respectively, and thus beyond its ability to foresee and prevent. Although the inspectors do not dispute whether there was a manufacturing defect in the failed diodes, they determined that the point was not pertinent to the licensee's failure to evaluate the effects of voltage suppression diode failure. In each case, the failed diodes provided an
indication that the licensee's modification installed in 2007, introduced new components
(diodes) into the SDG control circuit design such that their failure resulted in the eventual
failure of safety-related equipment (the Division 2 SDG) nine years after initial installation. The inspectors determined that following the previous testing of the circuit on April 2, 2015, the emergency start circuit diode would have either failed (shorted) the
next time the circuit was energized (e.g., demand for emergency start from a loss of
off-site power or loss of coolant accident) or that the diode failed when the testing was completed and the circuit was de-energized. The licensee's corrective actions included replacing the failed diode, performing PTI-R43-P0006B satisfactorily, and implementing modification ECP 16-0348, "Modify Division 1 and Division 2 Diesel Generator control circuitry for relay flyback diode
failure," to remove the voltage suppression diodes from the SDG control circuitry.
7 Analysis: Title 10 of the CFR, Part 50, Appendix B, Criterion III, "Design Control," requires, in part, that measures be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components. The inspectors determined that the licensee's failure to evaluate the effects of voltage suppression
diode failure on the SDG control circuit was contrary to the requirements of 10 CFR Part
50, Appendix B, Criterion III, and a performance deficiency. Specifically, the licensee
failed to consider the effect of a shorted diode on the control circuitry of the SDG and, as
a result, failed to recognize that installation of voltage suppression diodes across control relays, with no mitigation for diode failure, was not a suitable modification of the SDG control circuit. The inspectors determined that the performance deficiency was of more than minor significance because it was associated with the design control attribute of the mitigating
systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to
prevent undesirable consequences (i.e., core damage). Specifically, the design of the Division 2 SDG control circuit resulted in the inoperability and unavailability of the Division 2 SDG when diode R10BB failed in the shorted condition. The inspectors determined the finding could be evaluated using the Significance Determination Process (SDP) in accordance with IMC 0609, "Significance Determination
Process," Attachment 0609.04, "Initial Characterization of Findings," dated
October 7, 2016, and Appendix A, "The Significance Determination Process for Findings
At-Power," Exhibit 2, "Mitigating Systems Screening Questions," dated June 19, 2012. The finding represented an actual loss of system safety function of the Division 2 diesel generator for greater than its TS 3.8.1.B4 allowed outage time of 14 days. Therefore, a detailed risk evaluation was performed in accordance with IMC 0609, Appendix A.
A Region III Senior Reactor Analyst (SRA) performed a detailed risk evaluation using the NRC's Standardized Plant Analysis Risk (SPAR) Model for Perry, Revision 8.19. The
SRA determined that several changes to t
he SPAR model were necessary to fully capture plant-specific features affecting the dominant risk sequences for this evaluation. Idaho National Laboratory staff who maintain the SPAR models for the NRC made the model changes as requested by the SRA. The changes included the ability to cross-tie direct current (DC) power, fast fire water injection, and the ability to vent containment under station blackout conditions. The Perry plant has additional equipment originally intended for a second unit that includes a second set of DC batteries that can be aligned to support the operating unit.
This alignment under station blackout scenarios can provide adequate DC power for the
full 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> PRA mission time. This plant specific feature can support continued high pressure core spray (HPCS) operation and containment venting in certain station black-out (SBO) scenarios such that offsite power recovery is not required for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The plant has a fast fire water injection capability that supports the use of a diesel fire water pump for low pressure injection to the reactor pressure vessel in certain SBO
scenarios when injection using the reactor core isolation cooling (RCIC) system is
initially successful. For these station blackout scenarios, offsite power recovery is required within eight hours if containment venting is not available.
8 The Perry SPAR model was also modified to change the common cause component group (CCCG) for the Standby Diesel Generators. A CCCG models a group of
components that are similar in design, operation, and maintenance, and therefore susceptible to failure from common causes. The determination of a CCCG typically includes components within a system and does not routinely extend to like components
across system boundaries. The SPAR model
baseline CCCG included the Division 1, Division 2, and Division 3 diesel generators. Although there are similarities across all
three diesel generators, the NRC determined that the Division 3 diesel generator should
not be included in the CCCG, primarily because
it is significantly different in size, manufacturer, and function. The CCCG was modified to include only the Division 1 and
Division 2 Standby Diesel Generators. In addition to the modeling changes descri
bed in the previous paragraphs, the SPAR model was updated with the most recent diesel generator failure probabilities and
common cause alpha factors. The data
are on the NRC's public website at http://nrcoe.inl.gov/resultsdb/. The SRA made the following assumptions about the degraded plant condition for the
detailed risk evaluation:
- The Division 2 Standby Diesel Generator w
ould not have automatically started in response to a loss of offsite power event. The basic event in the SPAR model for failure to start was set to "True".
- The Division 2 Standby Diesel Generator could not be manually started and was
not recoverable.
- The exposure time for the degraded condition used in the evaluation was one year. The degraded condition existed from April 2015 until November 2016, which is greater than one year. The "T/2" method to exposure time determination, which is 1/2 the time from the last successful operation until the standby diesel generator failure was not applicable due to the failure mechanism.
The standby diesel generator emergency start function was not degrading while it
was in a standby mode and was not degrading during manual start operations. The maximum exposure time used in the SDP is one year. The change in core damage frequency (CDF) due to the degraded condition was estimated to be 7.3E-6/yr. This is the CDF for internal events. The dominant core damage sequence involved an SBO event in wh
ich the HPCS and RCIC systems fail and power is not recovered within 30 minutes. A second dominant core damage
sequence involves an SBO event in which HPCS is successful, but containment venting fails and power is not recovered. The SRA considered risk contributions from internal fires and seismic events and concluded that any other external event contribution would be negligible. The internal
fire CDF was estimated to be 1.5E-6/yr., which is a small risk contribution to the overall significance of the finding. The risk contribution from seismic events was determined to
be less than 1E-7/yr., and did not impact the results of the detailed risk evaluation. For internal fires, the SRA used the Individual Plant Examination for External Events (IPEEE) to estimate the fire risk contribution. From the IPEEE, the SRA determined that
internal fires in only the control room or the turbine power complex could cause a loss of offsite power and contribute to the risk significance of this finding.
9 For the control room, the SRA determined that panels designated as Group 2B and Group 4B in the control room would contribute to a change in risk because a fire in these
panels could result in a loss of offsite power event. The total fire frequency for Group 2B and 4B panels was 7.8E-4/yr. For the scenarios in which the control room is not evacuated, the SRA multiplied the fire frequency by the change in conditional core
damage probability calculated using the SPAR model for a plant-centered loss of offsite
power with the Division 2 standby diesel generator failed. This resulted in a CDF estimate of 1.1E-7/yr. For the scenario in which the control room is evacuated, the SRA
calculated a change in risk of 3.8E-7/yr., using information in the IPEEE regarding control room evacuation scenarios that involve a loss of offsite power with no Division 2 damage due to the fire (fire damage State 3 in the IPEEE). The total delta CDF
estimated for control room fires due to the degraded condition was approximately
5.0E-7/yr. For the Turbine Power Complex, the SRA used the same approach, combining the
IPEEE fire frequency with the delta conditional core damage probability calculated using the SPAR model. The delta CDF for turbine power complex fires due to the degraded
condition was estimated to be 1E-6/yr. The SRA reviewed the potential for risk contribution due to large early release frequency (LERF) using the guidance of IMC 0609 Appendix H, "Containment Integrity Significance Determination Process." The SRA applied the Appendix H LERF "factor" of 0.2 for BWR
Mark III Containment Plants to a subset of core damage sequences that represent
"early" core damage sequences. Using this approach, the SRA determined that the
LERF contribution to the overall significance of the finding was no greater than the CDF estimate and that CDF was the appropriate metric to use in evaluating the significance of
the finding.
The total CDF estimate for internal events and internal fire risk was 8.8E-6/yr., which represents a finding of low to moderate safety significance (White). The inspectors identified no cross-cutting issues associated with this finding because the condition had existed since at least 2007, when the diodes were originally installed in the DC control power circuits, and therefore, was not indicative of current plant performance.
Enforcement Title 10 of the CFR, Part 50, Appendix B, Criterion III, "Design Control," requires, in part, that measures be established for the selection and review for suitability of application of
materials, parts, equipment, and processes that are essential to the safety-related
functions of the structures, systems and components. Technical Specification 3.8.1 "AC Sources-Operating" condition B.4 states, in part, that the required inoperable diesel
generator be restored to operable status within 14 days. From April 24, 2007, until November 8, 2016, the licensee failed to review for suitability of application of parts essential to the safety-related functions of the Division 2 Standby Diesel Generator, a safety-related system. Specifically, Engineering Change Package 04-00049 failed to consider the effects of shorted voltage suppression diodes installed
on the control circuitry for the Division 2 Standby Diesel Generator, and instead,
introduced new components (diodes) into the control circuitry that resulted in the
eventual failure of this safety-related equipment. Consequently, on November 6, 2016, the Division 2 Standby Diesel Generator emergency start circuit diode associated with
10 relay RR10BB was found failed after an unsuccessful attempt to test the emergency start function. The Division 2 Standby Diesel Generator was inoperable and unable to
perform its emergency start function from April 2, 2015, until the emergency start diode was replaced and the Division 2 Standby Diesel Generator was returned to service on November 8, 2016, which was longer than the Technical Specification allowed outage
time of 14 days. The failure to consider the effects of shorted voltage suppression
diodes installed in the SDG and resultant inoperability of the Division 2 SDG are
apparent violations of 10 CFR 50 Appendix B Criterion III, "Design Control" and TS 3.8.1. Immediate corrective actions included replacing the failed diode and declaring the Division 2 Standby Diesel Generator operable following post-maintenance testing. (AV05000440/2017009-01, Unsuitable Application of Surge Suppression Diodes in
Standby Diesel Generator Control Power Circuitry)
4OA6 Management Meeting
.1 Exit Meeting Summary On April 27, 2017, the inspectors presented the inspection results to Mr. D. Hamilton and other members of the licensee staff. The licensee acknowledged the issues presented.
The inspectors confirmed that none of the potential report input discussed was
considered proprietary.
Attachment
SUPPLEMENTAL INFORMATION KEY POINTS OF CONTACT
Licensee D. Hamilton, Site Vice President
F. Payne, General Plant Manager
D. Reeves, Director, Site Engineering
D. Saltz, Director, Site Performance Improvement
N. Conicella, Manager, Site Regulatory Compliance
L. Zerr, Supervisor, Regulatory Compliance
K. Nelson, Manager, Plant Engineering P. Roney, Supervisor, Nuclear Supply System Engineering
J. Caine, Supervisor, Nuclear Electrical System Engineering R. Boyles, Nuclear Engineering Specialist U.S. Nuclear Regulatory Commission J. Cameron, Chief, Reactor Projects Branch 4
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened 05000440/2017009-01 AV Unsuitable Application of Surge Suppression Diodes in Standby Diesel Generator Control Power Circuitry
(Section 4OA2.1)
Closed None. Discussed
None.
2 LIST OF DOCUMENTS REVIEWED The following is a partial list of documents reviewed during the inspection. Inclusion on this list does not imply that the NRC inspectors reviewed the documents in their entirety, but rather that
selected sections or portions of the documents were evaluated as part of the overall inspection effort. Inclusion of a document on this list does not imply NRC acceptance of the document or
any part of it, unless this is stated in the body of the inspection report. 4OA2 Identification and Resolution of Problems - CR 2016-06450; Division 2 DG Abnormal Indications on Start; dated May 6, 2016 - CR 2016-13183; During Performance of PTI-R43-P0006B CB-1, CB-2, CB-3, CB-4 DC Breakers Trip when Loaded; dated November 6, 2016 - CR G202-2008-49196; Division 2 Relay Contacts Failed during Routine Maintenance; dated November 8, 2008 - CR 2016-14251; CR 2016-13183 Identified the Need to Eliminate All Remaining Surge Suppression Diodes Installed Under ECP-04-049 on the Division 1 and Division 2 Diesel
Generators; dated December 13, 2016 - CR 2016-14456; PRA Evaluation Associated with the Division 2 EDG MSPI Failure (CR 2016-13183) Indicates a Preliminary Level of Significance that Warrants a Root Cause
Evaluation; December 19, 2016 - PRS-1916; Diesel Generator Governor Controls; Revision 3 - ECP 04-0049-01; 10 CFR 50.59 Evaluation No. 06-00228; Revision 2 - ECP 04-0049-02 & 03; 10 CFR 50.59 Evaluation No. 06-01428; Revision 0
- ECP 04-0049-02 & 03; Engineering Change Package Design Report; Revision 0
- eSOMs Plant Narrative Logs; dated November 7, 2016
- NOP-LP-2001; Corrective Action Program; Revision 38
- NORM-LP-2003; Analytical Methods Guidebook; Revision 7 - NOBP-LP-2008; FENOC Corrective Action Review Board; Revision 18 - NOBP-LP-2011; FENOC Cause Analysis; Revision 18 for CR 2016-06450
- Engine Systems, Inc.; Environmental Qualification Report for Governor Modification Components Woodward EGB-35P Governor, MPU & Connector, Accumulator & Mounting
Brackets, Selector Switch & Isolation Barrier, Governor Panel / Components - First Energy Perry Nuclear Power Plant PO # 45200506 / ESI IWO 8000748 - Document Number 8000748-EQR-1; Revision 1; dated January 24, 2007 - WO 200682028; Simple Troubleshooting Plan for Division 2 Diesel Generator Failure to Start; dated May 6, 2016 - Drawing 208-0216-00006; Standby Diesel Engine Control Panel 1H51-P054B - Division 2
1R43-C001B; Revision AA - Drawing 208-0216-00008; Standby Diesel Engine Control Panel 1H51-P054B - Division 2
1R43-C001B; Revision U - Drawing 208-0216-00016; Standby Diesel Generator - Generator Control Panel
(1H51-P055B) Division 2 1R43-S001B; Revision X - Engine Systems Inc., Part 21 Letter, Report No. 10CFR21-0116, Revision 0; dated
March 27, 2017
3 LIST OF ACRONYMS USED AV Apparent Violation CAP Corrective Action Program
CCCG Common Cause Component Group
CDF Core Damage Frequency CFR Code of Federal Regulations DC Direct Current
ECP Engineering Change Package
FENOC FirstEnergy Nuclear Operating Company
HPCS High Pressure Core Spray IMC Inspection Manual Chapter IPEEE Individual Plant Examination for External Events
LERF Large Early Release Frequency
LOCA Loss of Coolant Accident
LOOP Loss of Off-site Power
NRC U.S. Nuclear Regulatory Commission IP Inspection Procedure RCIC Reactor Core Isolation Cooling
SBO Station Black-Out
SDG Standby Diesel Generator
SDP Significance Determination Process SPAR Standardized Plant Analysis Risk SRA Senior Reactor Analyst TS Technical Specification