Semantic search
Jump to navigation
Jump to search
| Site | Quarter | Title | Description | |
|---|---|---|---|---|
| 05000313/FIN-2018003-01 | Arkansas Nuclear | 2018Q3 | Failure to Translate the Design Requirements into Instructions for Refueling Emergency Diesel Generators | The inspectors identified a Green finding and associated non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to translate current design into instructions for Unit 1 and Unit 2 diesel fuel oil transfer system. Specifically, the licensee failed to translate the current diesel fuel oil transfer system design into instructions to refuel Unit 1 and Unit 2 safety-related fuel bunkers, T-57 and 2T-57, if the non-safety bulk diesel fuel oil tank T-25 was unavailable following a design basis event (e.g., tornado, external flooding, or earthquake) for which it was not designed to withstand. |
| 05000341/FIN-2018003-01 | Fermi | 2018Q3 | Failure to Apply Torque Values Described in Maintenance Procedure for Flexible Couplings on Emergency Diesel Generator 12 | A finding of very low safety significance with an associated non-cited violation of Technical Specification 5.4.1.a was self-revealed when plant operators discovered a pencil-thick lube oil leak coming from a flexible coupling on emergency diesel generator 12 during planned surveillance testing. Specifically, a lube oil leak developed when the flexible coupling located between the engine driven lube oil pump and the lube oil filter failed due to improper torque applied to the coupling On April 20, 2018, the licensee was performing a routine slow start surveillance of emergency diesel generator 12 (EDG12), when plant operators noted a pencil-thick lube oil leak from the flexible coupling fastener located between the engine driven lube oil pump and the lube oil filter with the engine running in idle. Plant operators subsequently shut down the engine, discontinued the surveillance, and EDG12 was declared inoperable. The licensee performed an investigation and found the flexible coupling fastener was torqued to 120 in/lbs. Maintenance procedure 35.307.008, Emergency Diesel Generator Engine General Maintenance, Enclosure X, Revision 44 required a torque value of 240260 in/lbs for the size of piping the fastener was on. The coupling was last disturbed in 2011, and the maintenance procedure at that time did not contain information regarding torque values for flexible couplings. A similar flexible coupling fastener failed in 2016 due to inadequate work instructions for torqueing flexible couplings (NCV 05000341/201600401, ADAMS Accession Number ML17030A328), and corrective actions were developed to use the vendor recommended values that had already been added to the maintenance procedure as Enclosure X in 2014. However, the corrective actions did not require all flexible couplings to be checked to ensure they were appropriately torqued. Opportunities existed for the licensee to ensure these flexible couplings were properly torqued according to vendor recommendations, either through scheduled maintenance online or during refueling and forced outages. Therefore, on April 20, 2018, another flexible coupling that was not checked as an extent of condition failed due to an under torqued condition. |
| 05000456/FIN-2018003-01 | Braidwood | 2018Q3 | Inadequate Detail in Maintenance Procedure for Emergency Diesel Generator 2-Year Inspection Contributed to 1A Emergency Diesel GeneratorFuel Rack Binding | A self-revealed finding of very low safety significance (i.e., Green) and an associated Non-Cited Violation (NCV) of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, was identified for the licensees failure to include adequate detail within their maintenance procedures to enable proper lubrication of the emergency diesel generator (EDG) fuel rack control linkage. Specifically, the preventative maintenance template for the fuel rack control linkage required that the manual fuel trip lever and associated linkage be lubricated every 2 years. However, the licensees implementing 2year maintenance procedure failed to include specific instructions to disassemble the lever assembly for lubrication. This lack of lubrication contributed to the mechanical binding of the emergency diesel generator fuel rack and failure of the 1A EDG during surveillance testing on April 22,2018. |
| 05000289/FIN-2018003-01 | Three Mile Island | 2018Q3 | 1A Emergency Diesel Generator Lube Oil Leak Inadequate Corrective Actions | A self-revealed Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, was identified for failure to develop and implement adequate corrective actions to ensure the availability and reliability of the 1A emergency diesel generator. |
| 05000366/FIN-2018003-01 | Hatch | 2018Q3 | Inoperability of 2A EDG Due to Inadequate Acceptance Criteria for Determining Cleaning Requirements of Emergency Diesel Generator Day Tanks | The inspectors documented a Green, self-revealing, non-cited violation of Unit 2 Technical Specification 5.4.1(a) for the licensees failure to incorporate preventative maintenance criteria for Emergency Diesel Generator (EDG) day tanks as recommended by Regulatory Guide (RG) 1.33, 9.a. Specifically, procedure 52SV-R43-001-0, Diesel, Alternator, and Accessories Inspection, Ver. 30.4, did not contain deterministic criteria in the visual inspection of the fuel filters to initiate the cleaning of the EDG day tanks and thus prevent EDG inoperability. The EDG day tanks had never been inspected and cleaned. |
| 05000313/FIN-2018011-01 | Arkansas Nuclear | 2018Q3 | Failure to Properly Size the Unit 1 Emergency Diesel Generator Room Ventilation Svstems | An NRC identified Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion Ill, "Design Control," was identified for failure to properly size the Unit 1 emergency diesel generator room ventilation systems to be capable of removing the design heat load during the most limiting design conditions while maintaining redundancy of the exhaust fans. |
| 05000298/FIN-2018011-03 | Cooper | 2018Q2 | Inadequate Design Basis Calculation for the EDG Rooms Temperature Distribution | An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, occurred for the licensees failure to ensure design control measures provide for verifying or checking the adequacy of design of the emergency diesel generator room ventilation system by use of alternate or simplified calculation methods, or by a suitable testing program. Specifically, the licensee incorrectly extrapolated the results of the test program, which led to an incorrect room temperature profile. Additionally, the design calculation did not assume potential failures of the CO2 dampers. |
| 05000298/FIN-2018011-04 | Cooper | 2018Q2 | Incorrect Classification of Potential Safety-Related Components | An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, occurred for failure to assure that applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the inspectors identified three examples of the licensees failure to properly classify potential safety-related components in the emergency diesel generator ventilation system and RHR service water booster pump room cooling systems. |
| 05000282/FIN-2018011-02 | Prairie Island | 2018Q2 | Potential Failure to Protect Class I Structures, Systems,and Components from Tornado Generated Missiles | Inspectors identified a number of structure, systems,and components (SSCs) that lacked protection from tornado generated missiles. The following SSCs were identified: Division 1 and Division 2 Emergency Diesel Generators (D1/D2 EDGs)engine exhaust, fuel oil day tank vents, and main fuel oil storage tanks vents; and Diesel Driven Cooling Water Pumps (DDCWPs) main fuel storage tank vents, day tank vents, engine exhausts, and rooms ventilation intake and exhaust equipment. In various cases susceptible SSCs for redundant equipment (e.g. fuel tank vents) were right next to or within a few feet of each other such that a single missle could affect both trains of the system A review of the sites licensing bases, including the original FSAR, identified the D1/D2 EDGs and the DDCWPs as Class I, safety-related SSCs, which are required to be designed to withstand, without loss of capability, environmental phenomena including tornadoes and tornado generated missiles. Specifically, the current USAR Table 12.2-1, Classification Of Structures, Systems and Components, list both systems as Class I and has two notes of interest. Note 1 applies to the Diesel Generators and their associated (Main) Fuel Oil Storage Tank, which states, in part, The indicated Design Class I is applicable to D1/D2 Diesel Generators and associated(emphasis added) safety related components and systems. The second note is listed at the beginning of the Table, which states,in part,To determine detail design classifications and boundaries separating different design classes within the overall classification scheme listed here, refer to controlled drawings. A review of controlled drawings, including NF-39255-1, Flow Diagram Diesel Generators D1 & D2 Unit 1 & 2,Revision 85, and NF-39232, Flow Diagram Fuel & Diesel System Unit 1 & 2, Revision 86,showed the fuel oil vents for the main storage tanks, fuel oil vents for the day tanks,engine exhaust piping,mufflers, and silencers for the D1/D2 EDGs and DDCWPs were classified as safety-related Class I SSCs. A review of the current UFSAR identified the following sections of interest:The USAR Section 1.5.I, Overall Plant Requirements, Criterion 2 -Performance Standards, Answer, established in part The system and components designated Class I in Section 12, in conjunction with administrative controls and analysis, as applicable, are designed to withstand, without loss of capability to protect the public, the most severe environmental phenomena ever experienced at the site with appropriate margins included in the design for uncertainties in historical dataThe USAR Section 12.2.1.1.a, Classification of Structures and Components, defines Design Class I as Those structures and components including instruments and controls whose failure might cause or increase the severity of a loss-of-coolant accident or result in an uncontrolled release of substantial amounts of radioactivity, and those structures and components vital to safe shutdown and isolation of the reactor.The USAR Section 12.2.5.1.g.1, Protection for Class I Items, establishes, in part, that Class I items are protected against damage from: Missiles from different sources.These sources comprise: Tornado created missiles.The USAR Section 12.2.1.3.2.c., Tornado Loads, defines the design tornado driven missile as assumed equivalent to an airborne 4 x 12 x 120 plank travelling end-on at 300 mph, or a 4000 lbs automobile flying through the air at 50 mph and at not more than 25 feet above ground level.Based on the above, the inspectors were concerned the susceptible SSCs could lose the capability to perform their safety-related function if they were impacted by tornado generated missiles. For example, an impact to the fuel oil vents could crimp the vent path resulting in a vacuum inside the tanks that could collapse the tank and/or cause the associated fuel transfer pump to lose net positive suction head The licensee provided a position paper proposing the susceptible SSCs identified by the inspectors were meeting their current licensing bases and no further actions were required. The inspectors disagreed, but decided to request support from the Office of Nuclear Reactor Regulation (NRR) to obtain clarification on the sites licensing bases related to tornado generated missiles. Planned Closure Action: The inspectors have requested NRR to provide clarification on the sites current licensing bases regarding tornado generated missiles required protection.Licensee Action: Licensee is considering doing a self-review of design and licensing basis of the fuel oil storage tank vent lines to understand and clarify design class of the lines Corrective Action Reference:501000012997 |
| 05000275/FIN-2018008-03 | Diablo Canyon | 2018Q2 | Failure to Promptly Identify and Correct Emergency Diesel Generator 1-1 Cardox System Inoperability | An NRC-identified, Green, non-cited violation (NCV) of the licensees fire protection license condition occurred when licensee personnel failed to identify a trouble light lit on the Emergency Diesel Generator (DG) 1-1 cardox fire protection system panel. The light, which had been lit for 2 weeks before being identified by the NRC, indicated a condition that would have prevented the automatic fire suppression system from effectively suppressing a fire in the DG 1-1 room. |
| 05000275/FIN-2018008-01 | Diablo Canyon | 2018Q2 | Emergency Diesel Generator Mission Time for Operability Evaluations | The team identified an unresolved item (URI) related to diesel generator (DG) mission time for operability evaluations. On December 3, 2016, an operator discovered during rounds that the air inlet boot seal on DG 1-2 had degraded, and subsequently, an inspection of the other diesel generators (DGs) revealed that the DG 2-2 boot seal was also degraded. The licensee performed an operability evaluation and concluded that the DGs were operable based on a mission time of 24 hours. The licensee then performed a past operability evaluation, concluding that the DGs had remained able to perform their safety function for this stated 24-hour mission time despite the deficiency; therefore no licensee event report was required by 10 CFR 50.73. The team requested information related to the basis of the 24-hour mission time. The licensee provided a non-controlled reference document, Engineered Safety Feature (ESF) Equipment Mission Time, to the licensees operability determination Procedure OM7.ID12. The document listed the mission time for the DGs as 7 days (24 hours, 6 hours). The 6 and 24 hour values depend on the particular accident sequence and electrical power recovery time, and were from a letter sent to the NRC related to the licensees Individual Plant Examination of External Events (IPEEE), which is a plant-specific probabilistic risk assessment (PRA). The 7-day value is related to the required diesel fuel oil storage volume as discussed in Technical Specification Bases 3.8.3. The document also states that the licensee has no defined post-accident operation / mission times because such times are not mandated by regulation or recommended by NRC guidance. The team noted, however, that IPEEEs do not typically evaluate accidents past 24 hours, and furthermore, IMC 0326, Operability Determinations and Functionality, states that the use of PRA or probabilities of occurrence of accidents or external events is not consistent with the assumption that the event occurs, and is not acceptable for making operability decisions. Additionally, Procedure OM7.ID12 defines mission time as the duration of structure, system, or component (SSC) operation that is credited in the current licensing bases for the SSC to perform its specified safety function; however, as documented above by the licensee, there is no design or licensing basis mission time for the DGs. The licensees definition of mission time is essentially the same as described in IMC 0326. The inspectors performed a brief review of documents related to mission times. Technical Specification Limiting Condition for Operation 3.8.3, Diesel Fuel Oil, Lube Oil, Starting Air, and Turbocharger Air Assist, requires verification of diesel fuel oil level to satisfy a 7-day fuel oil storage requirement. Additionally, NUREG-1407 discusses an Electric Power Research Institute approach that defines and evaluates the capacity of those components required to bring the plant to a stable condition (either hot or cold shutdown), and maintain that condition for at least 72 hours. Also, the ESF equipment mission time document referenced several 30-day mission times for SSCs that would require emergency power from either offsite power, if available, or the DGs. The team also performed a search of previous NRC findings at the DCPP, Unit 1 and 2, and found one reference to a 7-day mission time for the DGs in NRC Pilot Engineering Inspection Report 2006005. The inspectors also reviewed NEI 97-04, Design Bases Program Guidelines, Revised Appendix B, Guidance and Examples for Identifying 10 CFR 50.2 Design Bases. The Appendix describes how the 10 CFR 50.2 design bases of a facility are a subset of the current licensing basis and are required pursuant to 10 CFR 50.34(a)(3)(ii) and (b) and 10 CFR 50.71(e), to be included in the updated Final Safety Analysis Report (FSAR). Title 10 CFR 50.2 design bases consist of design bases functions and design bases values. Design bases values are the values or ranges of values of controlling parameters established as reference bounds for design to meet design bases functional requirements. In other words, the 10 CFR 50.2 design bases include the bounding conditions under which SSCs must perform their design bases functions and may be derived from normal operation, or any accident or events for which SSCs are required to function. Because 10 CFR 50.71(e), IMC 0326, and Procedure OM7ID.12 indicated that DG mission time should be part of the design and licensing bases, and documented in the FSAR, but a DG mission time design and licensing basis does not appear to exist at DCPP, Units 1 and 2, the inspectors could not determine that an appropriate mission time was used for a past operability determination. Therefore, the team could not conclude that the licensee had not missed a 10 CFR 50.73 event report because of a potentially incorrect assumption about DG mission time. This is applicable to both units. Planned Closure Action(s): In order to resolve this issue, the NRC needs to determine whether or not the basis for the 24-hour DG mission time is appropriate by determining which standard or standards apply to mission time at DCPP, Units 1 and 2. Licensee Action(s): Because the licensees position is that the DG mission time is not a part of their current licensing or design basis, they maintain that the 24-hour mission time used in the past operability determination was adequate to provide reasonable assurance of operability and, therefore, no event report was required. However, prior to this inspection and because of other uncertainties in determining mission times, the licensee generated Notification 50832335 to reassess the mission times associated with the ESF equipment. The intent is to develop the bases for ESF equipment mission time in a controlled document. However, this effort is not yet complete and, as such, the mission time for the DGs has not been evaluated under this notification. Corrective Action Reference(s): Notifications 50832335, 50882125, 50882140, and 50882498. |
| 05000461/FIN-2018050-01 | Clinton | 2018Q2 | Failure to Follow Multiple Procedure | On May 17, 2018, a To-Be-Determined (TBD) finding and an associated Apparent Violation of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, and Technical Specification 3.8.2, Condition B.3,were self-revealed for the licensees failure to follow multiple procedures that affected quality.This resulted in the unavailability and inoperability of the Division 2 Emergency Diesel Generator when it was relied upon for plant safety |
| 05000341/FIN-2018002-03 | Fermi | 2018Q2 | Failure to Adequately Evaluate the Operability of Emergency Diesel Generator11 | A finding of very low safety significance was self-revealed for the licensees failure to adequately evaluate the operability of a condition adverse to quality identified on Emergency Diesel Generator (EDG) 11. Specifically, a lube oil leak was evaluated as having no impact to the operation of the emergency diesel generator. However, during the next surveillance run of EDG 11, the engine had to be shut down and declared inoperable due to the lube oil leak degrading during operation. |
| 05000336/FIN-2018010-04 | Millstone | 2018Q2 | Flood Seals Not Installed in Unit 2 A EDG and Auxiliary Building Penetrations | The team identified a finding of very low safety significance (Green) and associated NCV of 10 CFR Part 50, Appendix B, Criterion XIV, Corrective Actions. Dominion identified a condition adverse to quality but did not correct the condition. Specifically, Dominion performed evaluations and walk downs in 2012 and 2016 to validate that all necessary flood seals for design basis and beyond design basis flood events had been properly installed. Dominion determined that they could not verify 50 wall penetrations had seals installed and entered the deficiency into the corrective action program. The team noted that an electrical conduit that passed through a Unit 2 A emergency diesel generator (EDG) building exterior wall, located below the design basis flood height, was one of the penetrations in question. During the inspection, following NRC questions, Dominion removed the electrical conduit cover plate and confirmed that a seal was not installed. |
| 05000458/FIN-2018002-02 | River Bend | 2018Q2 | Enforcement Action (EA)-18-053: Enforcement Discretion for Tornado-Generated Missile Protection Noncompliances | Title 10 CFR Part 50, Appendix A, General Design Criteria for Nuclear Power Plants, Criterion 2, Design Bases for Protection Against Natural Phenomena, states, in part, that systems, structures, and components (SSCs) important to safety shall be designed to withstand the effects of natural phenomena, such as tornadoes. Criterion 4, Environmental and Dynamic Effects Design Basis, states, in part, that SSCs important to safety shall be appropriately protected against dynamic effects including missiles that may result from events and conditions outside the nuclear power unit. Section 3.5.2, Structures, Systems, and Components to be Protected from Missiles, of the Updated Safety Analysis Report (USAR) details the structures that are designed to withstand tornado missile impact.On February 7, 2017, the NRC issued Enforcement Guidance Memorandum (EGM) 15-002, Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance, Revision 1 (ADAMS Accession Number ML16355A286). The EGM referenced a bounding generic risk analysis performed by the NRC staff that concluded that tornado missile vulnerabilities pose a low risk significance to operating nuclear plants. Because of this, the EGM described the conditions under which the NRC staff may exercise enforcement discretion for noncompliance with the current licensing basis for tornado-generated missile protection. Specifically, if the licensee could not meet the technical specification required actions within the required completion time, the EGM allows the staff to exercise enforcement discretion provided the licensee implements initial compensatory measures prior to the expiration of the time allowed by the limiting condition for operation. The compensatory actions should provide additional protection such that the likelihood of tornado missile effects are lessened. The EGM then requires the licensee to implement more comprehensive compensatory measures within approximately 60 days of issue discovery. The compensatory measures must remain in place until permanent repairs are completed, or until the NRC dispositions the non-compliance in accordance with a method acceptable to the NRC such that discretion is no longer needed. Because EGM 15-002 listed River Bend Station as a Group A plant, enforcement discretion expired on June 10, 2018. On May 10, 2018, River Bend Station submitted a request to extend the enforcement discretion period to June 10, 8 2020. On May 31, 2018, River Bend Station submitted asupplement to the May 10 request. On June 6, 2018, the NRC granted an extension to the enforcement discretion until June 10, 2020. The initial conditions of Design Basis Accident (DBA) and transient analyses in the USAR, Chapter 6 and Chapter 15, assume Engineered Safeguards Features (ESF) systems are operable. The AC, DC, and AC vital bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, reactor coolant system, and containment design limits are not exceeded.The onsite standby power source for each 4.16 kV ESF bus is a dedicated emergency diesel generator (EDG). An EDG starts automatically on a loss of coolant accident signal (i.e., low reactor water level signal or high drywell pressure signal) or on an ESF bus degraded voltage or under voltage signal. In the event of a loss of preferred power, the ESF electrical loads are automatically connected to the EDGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a DBA such as a loss of coolant accident. Standby service water (SSW) is required by Technical Specification 3.7.1. The ultimate heat sink (UHS) consists of one 200 percent capacity cooling tower and one 100 percent capacity water storage basin. The UHS basin capacity is required by Regulatory Guide 1.27 and USAR 9.2.5 to maintain a minimum of 30 days inventory to mitigate the consequences of a DBA without replenishment. The UHS is designed to perform its safety function assuming a single failure coincident with a loss of offsite power and with respect to the 30 day mission time assuming a single division of SSW is in service.The safety design bases of these SSCs includes ensuring the SSCs are protected from the effects of natural phenomena, such as earthquakes, tornadoes, hurricanes, floods, and external missiles (GDC-2).On May 4, 2018, the licensee identified vulnerabilities in the EDG building, the control building, and the SSW cooling tower where tornado-born missiles could potential render safety-related equipment contained in these buildings inoperable. Potentially affected equipment included all three EDGs, Division II DC electrical power distribution subsystem, residual heat removal (RHR) pumps B and C, SSW pumps A, B, C, and D, Division I standby cooling tower fans, and multiple Division I SSW motor operated valves. These vulnerabilities were identified as part of the licensees review of Regulatory Information Summary 2015-06, Tornado Missile Protection. These issues were entered into the corrective action program as Condition Reports CR-RBS-2018-02687, 02768, and 02775.Corrective Actions: As a result of these issues, the licensee declared all three EDGs, the Division II DC electrical power distribution subsystem, RHR pumps B and C, SSW pumps A, B, C, and D, Division I standby cooling tower fans, and multiple Division I SSW motor operated valves inoperable, complied with the applicable technical specification action statements, initiated Condition Reports CR-RBS-2018-02687, 02768, and 02775, invoked the EGM discretion guidance, implemented initial compensatory measures, and returned the SSCs to an operable- degraded/non-conforming status. The licensee instituted compensatory measures intended to reduce the likelihood of tornado missile effects. These included verifying that guidance was in place for severe weather procedures, abnormal and emergency operating procedures, and FLEXsupport guidelines, verifying that training on these procedures was current, and verifying that a heightened level of awareness of the vulnerability was established.Corrective Action Reference(s) : CR-RBS-2018-02687, CR-RBS-2018-02768, and CR-RBS-2018-02775Enforcement:Violations: Technical Specification 3.8.1 requires, in part, that three diesel generators shall be operable in Modes 1, 2, and 3. Technical Specification 3.8.1.H requires entry into LimitingCondition for Operation 3.0.3 when three or more required AC sources are inoperable. Limiting Condition for Operation 3.0.3 requires that action shall be initiated within one hour to place the unit in Mode 2 within 7 hours, in Mode 3 within 13 hours, and in Mode 4 within 37 hours.Contrary to the above, prior to May 4, 2018, three diesel generators were not operable, and action was not initiated to place the unit in Mode 2 within 7 hours, in Mode 3 within 13 hours,and in Mode 4 within 37 hours. Specifically, the EDG building was not designed to withstand the effects of natural phenomena, such as tornadoes. The licensee initiated a condition report, invoked the enforcement discretion guidance, implemented initial compensatory measures, and returned the SSCs to an operable- degraded/non-conforming status. The inspectors verified through inspection sampling that the EGM 15-002 criteria were met and that the issue was documented in Condition Report CR-RBS-2018-02687. Therefore, EGM 15-002 enforcement discretion was applied to the required shutdown actions associated with this technical specification.Technical Specification 3.8.9 requires, in part, that the Division II AC and AC vital bus electrical power distribution subsystems shall be operable in Modes 1, 2, and 3. Technical Specification 3.8.9.D requires the station to take action to place the unit in Mode 3 within 12 hours when one or more AC or AC vital bus electrical power distribution subsystems have been inoperable for more than 8 hours. Contrary to the above, prior to May 4, 2018, the Division II AC and AC vital bus electrical power distribution subsystems were not operable for more than 8 hours, and action was not initiated to place the unit in Mode 3 within 12 hours. Specifically, the control building was not designed to withstand the effects of natural phenomena, such as tornadoes. The licensee initiated a condition report, invoked the enforcement discretion guidance, implemented initial compensatory measures, and returned the SSCs to an operable- degraded/non-conforming status. The inspectors verified through inspection sampling that the EGM 15-002 criteria were met and that the issue was documented in Condition Report CR-RBS-2018-02768. Therefore, EGM 15-002 enforcement discretion was applied to the required shutdown actions associated with this technical specification.Technical Specification 3.5.1 requires, in part, that each emergency core cooling system (ECCS) injection subsystem shall be operable in Modes 1, 2, and 3. Technical Specification 3.5.1.D requires the station to take action to place the unit in Mode 3 within 12 hours when two ECCS injection subsystems have been inoperable for more than 72 hours. Contrary to the above, prior to May 4, 2018, two required ECCS injection subsystems that included RHR pumps B and C were inoperable for more than 72 hours, and action was not initiated to place the unit in Mode 3 within 12 hours. Specifically, the control building was not designed to withstand the effects of natural phenomena, such as tornadoes.The licensee initiated a condition report, invoked the enforcement discretion guidance, implemented initial compensatory measures, and returned the SSCs to an operable- degraded/non-conforming status. The inspectors verified through inspection sampling that the EGM 15-002 criteria were met and that the issue was documented in Condition Report CR-RBS-2018-02768. Therefore, EGM 15-002 enforcement discretion was applied to the required shutdown actions associated with this technical specification.Technical Specification 3.7.1 requires, in part, that two SSW subsystems shall be operable in Modes 1, 2, and 3. Technical Specification 3.7.1. H requires the station to take action to place the unit in Mode 3 within 12 hours when both pumps associated with one SSW subsystem have been inoperable for more than 72 hours. Contrary to the above, prior to May 4, 2018, SSW pumps P2B and P2D, associated with SSWsubsystem B, were inoperable for more than 72 hours, and action was not initiated to place the unit in Mode 3 within 12 hours. Specifically, the SSW cooling tower was not designed to withstand the effects of natural phenomena, such as tornadoes. The licensee initiated a condition report, invoked the enforcement discretion guidance, implemented initial compensatory measures, and returned the SSCs to an operable- degraded/non-conforming status. The inspectors verified through inspection sampling that the EGM 15-002 criteria were met and that the issue was documented in Condition Report CR-RBS-2018-02775. Therefore, EGM 15-002 enforcement discretion was applied to the required shutdown actions associated with this technical specification.Severity/Significance: Not ApplicableBasis for Discretion: The NRC exercised enforcement discretion in accordance with EGM 15-00, Revision 1, because the licensee implemented initial compensatory measures in accordance with the EGM. |
| 05000250/FIN-2018002-01 | Turkey Point | 2018Q2 | Unit 3 Emergency Diesel Generator (EDG) Operability during Fuel Oil Transfer to Unit 4 Fuel Oil Storage Tanks | From April 2, through April 10, 2018, the 4B emergency diesel generator (EDG) was out of service for maintenance. On April 4, 2018, the licensee transferred diesel fuel oil (fuel) from the Unit 3 common storage tank, using the 3A EDG fuel transfer pump, 3P10A, to the 4B EDG storage tank. To perform the fuel transfer, operators aligned the 3A EDG fuel transfer system by: 1) removing the 3P10A control switch from the automatic position; 2) closed the air-operated fill valve CV-3-2046A, to the 3A EDG day tank, by isolating and venting its instrument air supply line; and, 3) opened normally locked-closed Unit 3 and Unit 4 fuel transfer manual valves. During the fuel transfer from Unit 3 to Unit 4, the automatic fuel transfer operation from the Unit 3 storage tank to the 3A EDG day tank was defeated. The licensee did not consider the 3A EDG inoperable in this alignment and credited operator manual actions (OMAs) to restore its day tank to automatic fill operation. Technical Specification (TS) surveillance requirement 4.8.1.1.2.b, requires in part, that, each diesel generator shall be demonstrated OPERABLE by demonstrating that a fuel transfer pump starts automatically and transfers fuel from the storage system to the day tank. The inspectors questioned if the licensee was in compliance with the surveillance requirement during the fuel transfer and if the 3A EDG was operable by crediting OMAs. The licensees initial assessment was that the 3A EDG remained operable during the fuel transfer. Additionally, the licensee described that this particular issue was previously reviewed and described in a condition report evaluation, 00-14-19, dated September 22, 2000. The evaluation concluded that automatic operation of the fuel transfer pump was required for EDG operability but automatic operation of the day tank fill valve was not required for operability. The 3A and 3B EDG day tank fill valves are pneumatically operated valves and rely on the non-safety grade instrument air system for operation. Additionally, the evaluation stated that since the instrument air system was non-safety related, and the large EDG day tanks provide ample run time for the EDGs, OMAs were considered part of the system design basis. The inspectors noted to the licensee that the Turkey Point TSs do not specifically credit OMAs associated with the EDG fuel transfer system in a limiting condition for operation (LCO). The inspectors also noted to the licensee that TS Surveillance Requirement (SR) 4.0.1 states Surveillance Requirements shall be met during the OPERATIONAL MODES or other conditions specified for individual Limiting Conditions for Operation unless otherwise stated in an individual Surveillance Requirement. TS SR 4.8.1.1.2.b. requires demonstrating that a fuel transfer pump starts automatically and transfers fuel from the storage system to the day tank. If CV-3-2046A fails closed on a loss of instrument air, the licensee has an off-normal operating procedure that uses local OMAs to align a compressed air bottle to open CV-3-2046A to align fuel to the 3A EDG day tank. UFFSAR section 9.15.1.1.2.1.5 stated in part, Air-operated valves in the transfer lines from the diesel oil storage tank to the day tank automatically open in response to signals developed by logic circuitry incorporating tank level and pump control switch positions. The valves can be locally opened using a separate air source in the event normal instrument air is not available. Section 9.15.1.3.1 described in part Sufficient time exists for providing an alternative air source for opening the day tank fill isolation valves should instrument air fail before the day tank is emptied. With respect to the fuel transfer evolution, the licensee stated that the restoration could be completed with OMAs in sufficient time prior to the day tank being depleted of fuel. The license initiated AR 2269269 to complete a design basis and license basis review on the EDGs for operability during cross unit fuel transfers. Interim actions included declaring the EDG out of service anytime a cross unit fuel transfer was performed. At the conclusion of the inspection period the licensee had not completed the design and license basis evaluation. It was indeterminate whether a performance deficiency exists. This issue remains unresolved pending review of the licensees design and license basis evaluation. Planned Closure Action: A review of the licensees design and license basis evaluation documented in AR 2269269 was required for closure and to determine a performance deficiency exists. Licensee Actions: The license entered this issue into the corrective action program as AR 2269269 to complete a design and license basis review of EDG operability during cross unit fuel transfers. Interim actions included declaring the EDG inoperable any time a cross unit fuel transfer was performed. Corrective Actions Reference: AR 2269269 |
| 05000414/FIN-2018002-03 | Catawba | 2018Q2 | Notice of Enforcement Discretion Granted from Technical Specifications Related to the Failure of the 2A EDG During Post-Maintenance Test | As required by Inspection Manual Chapter 0410 Section 06.03.c, an unresolved item is being opened associated with a Notice of Enforcement Discretion 18-2-001 related to approval to not comply with TS requirements associated with the failure of the 2A emergency diesel generator during post-maintenance testing on June 11, 2018. On the basis of the staffs evaluation of the licensees request, the NRC concluded that granting the NOED was consistent with the NRCs Enforcement Policy and had no adverse impact on public health and safety or the environment. Therefore, as communicated orally to the Duke staff on June 14, 2018, the NRC exercised enforcement discretion to not enforce compliance with TS LCO 3.8.1 Condition G requirements that Catawba Nuclear Station, Units 2, be in Mode 2 by 10:08 a.m. EDT on June 14, 2018. Unit 2, Mode 3 entry was extended by 48 hours, to allow completion of repair on the 2A emergency diesel generator. Planned Closure Action: Inspectors will review the licensees cause evaluation for this issue.Licensee Actions: Duke completed repairs to the 2A emergency diesel generator such that the condition causing the need for the NOED was corrected at 9:06 p.m. EDT on June 14, 2018. Corrective Action Reference: CR 2212222 |
| 05000352/FIN-2018001-02 | Limerick | 2018Q1 | Emergency Diesel Generator Combustion Air Overheating | A self-revealed Green NCV of LGS Unit 1 TS 6.8.1 and TS 3.8.1.1 was identified when Exelon failed to properly maintain an operating procedure to maintain a fail-safe design feature for the EDGs which led to the D12 EDG combustion air overheating and caused the EDG to be inoperable for greater than its TS allowed outage time. |
| 05000416/FIN-2017011-03 | Grand Gulf | 2018Q1 | Failure to Conduct Common Cause Failure Evaluation in Response to Inoperable Emergency Diesel Generator | The inspectors identified three instances of a non-cited violation of Technical Specification 3.8.1, AC Sources Operating, for the licensees failure to take required actions for an inoperable emergency diesel generator. Specifically, after classifying the Division I or Division II emergency diesel generator as inoperable on the basis of nonconforming conditions, and after failing to either verify that the opposite train emergency diesel generator was not inoperable due to common cause failure within 24 hours or conduct a surveillance run on the opposite train emergency diesel generator within 24 hours, the licensee failed to enter Mode 3 within 12 hours as required by Technical Specification 3.8.1, Actions B.3.1, B.3.2, and G.1, respectively. The licensee entered this issue into their corrective action program as Condition Report CR-GGN-2017-11393. The licensee initiated corrective actions to conduct an adverse condition analysis. The failure to take required actions for an inoperable emergency diesel generator was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment reliability attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Actions B.3.1 and B.3.2 of Technical Specification 3.8.1 exist to ensure the availability, reliability, and capability of at least one emergency diesel generator in scenarios where there is a potential for a common cause failure of both emergency diesel generators, and the licensee took neither action. Using Nuclear Regulatory Commission Inspection Manual Chapter 0609, Appendix A, Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, the inspectors determined that the finding was of very low safety significance (Green) because the finding did not represent an actual loss of function of either the Division I or Division II emergency diesel generator for greater than its technical specifications allowed outage time. The finding had a cross-cutting aspect in the area of human performance, consistent process, because the licensee failed to use a consistent, systematic approach to make decisions. Specifically, the licensee failed to review the required actions of the applicable technical specification to ensure that all of those actions would be properly carried out (H.13). |
| 05000353/FIN-2018001-01 | Limerick | 2018Q1 | Failure of Emergency Diesel Generator Lube Oil Pipe Nipple Fitting | A self-revealed Green non-cited violation (NCV) of 10 CFR 50, Appendix B, Criterion XVI, Corrective Action, and LGS Unit 2 technical specification (TS) 3.8.1.1 was identified when Exelon failed to correct a degraded lube oil pipe nipple fitting on the D22 emergency diesel generator (EDG) when maintenance was performed to address leakage which caused inoperability of the EDG for greater than its TS allowed outage time. |
| 05000219/FIN-2018001-01 | Oyster Creek | 2018Q1 | Untimely Licensee Event Report for Reportable Conditions Associated with the No. 2 Emergency Diesel Generator | The inspectors identified a non-cited, Severity IV violation of 10 CFR 50.73(a)(1) for a failure to submit a licensee event report (LER) within 60 days after the discovery of an event requiring a report. Specifically, on October 9, 2017, Exelon determined that the No. 2 emergency diesel generator was inoperable for longer than the allowed outage time, which is reportable as a condition prohibited by technical specifications. Exelon did not submit an LER for this event until January 3, 2018 |
| 05000454/FIN-2018010-01 | Byron | 2018Q1 | Failure to Prescribe Motor Driven Auxiliary Feedwater Pump Test Procedures that Accounted for the Allowed Emergency Diesel Generator Frequency Variation | The inspectors identified a Green finding and an associated Non-Cited Violation (NCV)of Title 10 of the Code of Federal Regulations (CFR),Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the failure to prescribe motor driven auxiliary feedwater pump test procedures that accounted for the allowed emergency diesel generator frequency variation. Specifically, the motor driven auxiliary feedwater pump surveillance procedures would allow a pump with degraded and unacceptable performance to meet the test acceptance criteria based upon the test being performed at nominal frequency and not accounting for potentially lower, allowable, emergency diesel generator frequency. |
| 05000237/FIN-2018001-01 | Dresden | 2018Q1 | Enforcement Action: EA18016: Unanalyzed Condition for Tornado Missiles | On June 10, 2015, the NRC issued Regulatory Issue Summary (RIS) 201506, Tornado Missile Protection (ML15020A419), focusing on the requirements regarding tornado generated missile protection and required compliance with the facility-specific licensing basis. The RIS also provided examples of noncompliance that had been identified through different mechanisms and referenced Enforcement Guidance Memorandum (EGM) 15002, Enforcement Discretion For Tornado Generated Missile Protection Non-Compliance, which was also issued on June 10, 2015 (ML15111A269) and revised on February 7, 2017 (ML16355A286). The discretion applied to Technical Specification (TS) limiting condition for operations (LCOs) that would require a reactor shutdown or mode change if the licensee could not meet the required actions within the TS completion time due to structures, system, and components (SSCs) declared inoperable because of tornado generated missile issues. The EGM stated that a bounding risk analysis performed for this issue concluded that tornado missile scenarios do not represent an immediate safety concern because their risk is within the LIC504, Integrated Risk-Informed Decision-Making Process for Emergent Issues, risk acceptance guidelines. In the case of Dresden Station, the EGM provided for enforcement discretion of up to three years from the original date of issuance of the EGM. The EGM allowed the licensee to re-establish operability when the licensee implemented, prior to the expiration of the time mandated by the affected LCOs, initial compensatory measures that provided additional protection such that the likelihood of tornado missile effects were lessened followed by more comprehensive compensatory measures within 60 days of issue discovery. The enforcement discretion was also conditional to the comprehensive measures remaining in place until permanent repairs are completed or until the NRC dispositions the non-compliance in accordance with a method acceptable to the NRC such that discretion is no longer needed. Section 3.5 of the Dresden Power Station Updated Final Safety Analysis Report (UFSAR) states in part that SSCs important to safety shall be adequately protected against missiles generated by various causes, including natural phenomena. On February 12, 2018, the licensee initiated IR 04103159, identifying a nonconforming condition of Section 3.5. Specifically, the vent lines for the U2, U2/3, and U3 emergency diesel generator (EDG) fuel oil tanks were not adequately protected from tornado-generated missiles. The licensee declared fuel oil tanks and their associated EDGs inoperable, and promptly implemented compensatory measures designed to reduce the likelihood of tornado-generated missile effects. The condition was reported to the NRC as Event Notice (EN) 53204 as an unanalyzed condition and potential loss of safety function. Corrective Action(s): The licensee documented the inoperability of the SSCs in the Corrective Action Program (CAP) and in the control room operating log. In addition, the affected TS LCO conditions applicable in the mode of operation at the time of discovery were documented in the control room operating log. The shift manager notified the NRC resident inspector of implementation of EGM 15002, and documented the implementation of the compensatory measures to establish the SSCs operable but nonconforming prior to expiration of the LCO required action. The licensees immediate compensatory measures included: Verifying that procedures were in place and training was current for performing actions in response to a tornado event. Verifying that procedures were in place and training was current to respond to a tornado watch, such as: (1) actions to be taken relating to tornado missile hazards; (2) potential restoration of equipment important to maintaining safe shutdown conditions that is unavailable at the time of the tornado watch; (3) warning and protection strategies for personnel; and (4) damage assessment and restorative actions for equipment that may be damaged during a tornado. Establishing a heightened level of station awareness and preparedness relative to identified tornado missile vulnerabilities. The licensees longer term compensatory measure was to modify DOA001002, Tornado Warning Severe Winds procedure to include actions for damage assessment and restorative actions for systems with a vulnerability to damage from tornado missiles. Corrective Action Reference: IR 04103159 |
| 05000298/FIN-2018001-01 | Cooper | 2018Q1 | Licensee-Identified Violation | Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that for those systems, structures, and components to which this appendix applies, Design control measures shall provide for verifying or checking the adequacy of design.Contrary to the above, between September 2003, and December 19, 2017, the licensee failed to verify or check the adequacy of design of quality-related components associated with the Division 1 and 2 emergency diesel generator 125 Vdc control power circuits. Specifically, in 2003, the licensee modified the design of the control power circuit through Part Evaluation (PE) 4222806 and replaced 24 original light bulb lamp assemblies with a different style of light bulb and a carbon film dropping resistor (vs. the original wire-wound design). This change created an unrecognized vulnerability that left the affected portions of the circuit with dropping resistors that provided insufficient protection from shorting due to indication light bulb failures. As a result, on December 19, 2017, the licensee declared both emergency diesel generators inoperable due to the design vulnerability.Significance/Severity Level: The finding created a design vulnerability in the emergency diesel generator control power circuits, and resulted in the Division 1 and 2 emergency diesel generators being declared inoperable at the time of discovery. Although the emergency diesel generators were declared inoperable, subsequent licensee analysis determined that the system retained its function, and maintained a reasonable expectation of operability while the design deficiencies existed. Accordingly, the inspectors assessed the significance of this finding in accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings at Power, dated June 19, 2012, and determined this finding was of very low safety significance (Green) because it was a deficiency affecting the design or qualification of a mitigating structure, system, or component (SSC), but the SSC maintained its operability. Corrective Action Reference(s):Immediate corrective actions included compensatory measures to remove light bulbs from the vulnerable lamp assemblies in order to eliminate the shorting hazard. This issue was entered into the licensees corrective action program as Condition Report CR-CNS-2017-07513, and the licensee initiated a root cause evaluation |
| 05000219/FIN-2018001-02 | Oyster Creek | 2018Q1 | Enforcement Action (EA)-18-007: No. 2 Emergency Diesel Generator Ring Lug Failure | On October 9, 2017, during a routine surveillance load test, the No. 2 emergency diesel generator failed approximately 5 minutes into the run due to a broken ring lug on a current transformer. Laboratory analysis of the broken ring lug determined that the ring lug failed due to fatigue cracking that was initiated due to stresses caused by bending and twisting of the electrical lug. Exelon last conducted a load surveillance on the No. 2 emergency diesel generator on September 25, 2017. Corrective Actions: Corrective actions included replacement on the broken ring lug on the No. 2 emergency diesel generator, extent of condition inspections on the No. 1 and No. 2 emergency diesel generators for additional bent or twisted ring lug connectors, and revision to the electrical ring lug installation and emergency diesel generator procedures to include inspection for bent or twisted ring lugs. Corrective Action Reference(s): Issue report 4060815 Enforcement:Violation: Oyster Creek Technical Specification 3.7.C.2.b states, in part, that if one diesel generator becomes inoperable during power operation, the reactor may remain in operation for a period not to exceed 7 days. Contrary to the above, on October 9, 2017, it was recognized that one diesel generator was inoperable for greater than the technical specification allowed outage time of 7 days, and Oyster Creek continued power operation. Specifically, on October 9, 2017, No. 2 emergency diesel generator failed to run during a routine surveillance test due to a broken ring lug on a current transformer, which resulted in a total inoperability time of 6.5 months.Severity/Significance: For violations warranting enforcement discretion, Inspection Manual Chapter 0612 does not require a detailed risk evaluation, however, safety significance characterization is appropriate. A Region I Senior Reactor Analyst (SRA) performed a best estimate analysis of the safety significance using the Oyster Creek Standardized Plant Analysis Risk (SPAR) model, Version 8.50 and Systems Analysis Programs for Hands-On Integrated Reliability Evaluations (SAPHIRE). The evaluation estimated the total (internal and external events risk) increase in core damage frequency (CDF) to be in the mid to high E-6/yr range, or a low to moderate safety significance. The SRA evaluated the internal events risk contribution due to the inoperability of the No. 2 emergency diesel generator for an approximate 6.5 month exposure time. The exposure time relative to when the No. 2 emergency diesel generator was no longer capable of meeting its 24 hour mission time is uncertain due to the effect of vibration induced fatigue, and therefore the method prescribed within the RASP handbook guidance was used. 9 The analyst used the guidance in Section 2.5 of the Handbook, Revision 2.0, to estimate the exposure time of 6.5 months based on the cumulative 24 hour summation of the No. 2 emergency diesel generator surveillance test proven run time. This approach is appropriate for periodically operated components that degrade during operation (i.e. vibration induced fatigue only occurs while the emergency diesel generator is in-service/operating). Given this approach, the dominant internal events, loss of offsite power were evaluated for the estimated internal risk increase. This contribution was estimated at 2E-6/yr increase in CDF. The dominant sequences involved loss of offsite power events with a concurrent failure of the No. 1 emergency diesel generator, failure of the combustion turbines, and failure to recover offsite power or recover an emergency diesel generator prior to core damage.The SRA performed various modeling changes after a review of revised calculations for DC battery life:Analysis noted that Oyster Creek Generating Station recirculation pump seals are similar in design to those tested in reports generated for Nine Mile Point Unit 1 with the use of CAN2A seals. Therefore, the failure probability of the seals in the station blackout sequence wasadjusted from 0.1 to 5E-2 similar to Nine Mile Point Unit 1 SPAR model 8.50.The failure to load shed action (DCP-XHE-XM-LSHED) in the model was calculated using the SPAR-H method and revised to 1.2E-2 versus being assumed to always fail (TRUE).Failure probabilities for 1, 2, or 3 stuck open electromatic relief valves were revised to be consistent with the previous model version 8.22 because of the isolation condenser design at Oyster Creek Generating Station which limits cycling and significantly reduces the probability of a failed open electromatic relief valve due to isolation condensers controlling pressure.The depressurization function using electromatic relief valves, if required, was calculated through SPAR-H to be 1E-2 for sequences where total seal failure is assumed (DEPSEALFAIL) (conservatively assumed limited time available).The diesel driven firewater pumps are both available and were set to calculated fault tree failure probabilities instead of always failed in the previous model. These are 2,000 gallons per minute pumps with a large supply of water and relatively simple operator actions to inject to the reactor pressure vessel. The firewater was assumed to fail at 0.1 when a total recirculation seal failure occurs due to assumed time constraints.The offsite power and the emergency diesel generator required recovery time events were increased to 24 hours for events where DC load shedding was successful, without seal failures and isolation condenser success along with diesel driven firewater success.The SRA noted the No. 2 emergency diesel generator was recoverable. In fact, the diagnosis of the failed condition was performed in a nominal 8-10 hours from the failure. Therefore, a probability of failure to recover event for the conditional case was developed. The SRA used SPAR-H as simple guidance, which conservatively supported a reasonable assumption of a 0.10 conditional probability of failure to recover the emergency diesel generator within 24 hours. The base case utilized a calculation within SPAR of 0.33 failure to recover probability for 24 hour sequences. To estimate the external risk contribution, the SRA identified that the most significant external risk contribution was from fire events. Seismic, external flooding, and high wind events were not significant contributors for the issue. From discussions with Oyster Creek Fire probabilistic risk analysts and a review of this failure condition, the increase in CDF due to the failed No. 2 emergency diesel generator for the assumed 6.5 month exposure time was estimated at 4.5E-6/yr ((8.5E-5/yr-4.5E-5/yr) x (6.5/12 months) x 0.2).The DC safety-related battery life would be at least a nominal 14 hours and longer if DC bus stripping occurred, this allows for extended isolation condenser or electromatic relief valve function, with injection from diesel driven firewater. Given the time considerations and characteristics of the failure, an assumed recovery at a failure probability of 0.2 (slightly higher than internal due to less time) was applied for the No. 2 emergency diesel generator, which was a best estimate determined through SPAR-H insights. The dominant fire sequence was a fire affecting the A and B 4kV switchgear rooms, where combustion turbine support would be lost, with failure of the No. 1 emergency diesel generator breaker to close, and failure of locally operating the isolation condenser due to eventual loss of power. The SRA noted that FLEX credit was not quantified and would result in a lower risk estimation likely in the low E-6/yr range. Combining internal and external risk contributions, the total increase in CDF was 6.5E-6/yr, or low to moderate safety significance. The SRA determined that Exelon uses a Large Early Release Frequency (LERF) factor value of 8E-2. This value takes into consideration operator action for those relevant high pressure vessel breach scenarios (fuel-coolant interaction, liner-melt-through, and direct containment heating). This also credits procedure strategies where other mitigating actions are taken such as flooding the drywell. The SRA review of the dominant sequences and time to core damage affirmed that LERF did not increase the risk over that determined from the increase in CDF.Basis for Discretion: The inspectors determined that the ring lug failure was not within Exelons ability to foresee and prevent. As a result, no performance deficiency was identified. The inspectors assessment considered:1. Exelons review of emergency diesel maintenance performed in 2015 checked allconnections of the current transformer for tightness. The inspectors did not identify any gaps or deficiencies in the 2015 inspections. Inspectors also reviewed completed biennial inspections of the connection dating back to 1991 and did not identify any gaps.2. At the time of the failure, the current transformer connections did not have a time directed replacement frequency recommended by the Emergency Diesel Generator Owners Group. The inspectors did not identify any additional vendor or industry recommendations specific to the failed component or considerations specific to the failed component that existed prior to the failure.3. Industry operating experience information available to Exelon did not identify the potential for the fatigue cracking of the bent wire ring lug that was experienced.4. The bent ring lug failure was not the result of a failure on the part of Exelon staff; no standards existed on bending of the lug during installation and is considered skill of the craft.The NRC determined that it was not reasonable for Exelon to have been able to foresee and prevent this violation of NRC requirements, and as such, no performance deficiency existed. Therefore, the NRC has decided to exercise enforcement discretion in accordance with Sections 2.2.4 and 3.10 of the NRC Enforcement Policy and refrain from issuing enforcement action for the violation of technical specifications (EA-18-007). Further, because Exelons actions did not contribute to this violation, it will not be considered in the assessment process or the NRC Action Matrix. Exelons equipment corrective action program evaluation report (ECAPE) determined that the ring lug failed on the No. 2 emergency diesel generator as a result of fatigue cracking, which was initiated due to excessive stress caused by bending and twisting of the ring lug beyond limits specified in industry guidelines. The inspectors noted that the ECAPE did not provide supporting information regarding how the ring lug was bent and twisted beyond industry guidelines. Specifically, industry guidance states that ring lugs can be bent up to 90 degrees. The broken ring lug found in the No. 2 emergency diesel generator was bent at approximately 45-55 degrees per the ECAPE, which was within industry guidelines. Additionally, the ECAPE did not include specific guidance on twisting allowances for ring lugs. Exelon documented the inspectors observation in Issue Report 4089829. As a result of the inspectors observation, Exelon revised the ECAPE to say the ring lug failed on the No. 2 emergency diesel generator as a result of fatigue cracking, which was initiated due to excessive stress caused by bending and twisting of the ring lug. |
| 05000425/FIN-2018001-03 | Vogtle | 2018Q1 | Inadequate Refurbishment of Emergency Diesel Generator Pneumatic Control System Logic Boards | A Green self-revealing NCV of TS Section 5.4.1.a, Procedures, was identified for the licensees failure to properly preplan and perform maintenance work on the Unit 2 B train (2B)emergency diesel generator (EDG) pneumatic control shutdown logic board. The inadequate shutdown logic board refurbishment resulted in a pneumatic control system air leak that generated an EDG shutdown signal during testing and de-energized the safety-related emergency power bus. |
| 05000254/FIN-2018001-04 | Quad Cities | 2018Q1 | Enforcement Action: EA18021: EDG Non-conformance for Tornado Missiles (EGM 15002) | On June 10, 2015, the NRC issued Regulatory Issue Summary (RIS) 201506, Tornado Missile Protection (ML15020A419), focusing on the requirements regarding tornado-generated missile protection and required compliance with the facility-specific licensing basis. The RIS also provided examples of noncompliance that had been identified through different mechanisms and referenced Enforcement Guidance Memorandum (EGM) 15002, Enforcement Discretion For Tornado Generated Missile Protection Non-Compliance, which was also issued on June 10, 2015, (ML15111A269) and revised on February 7, 2017 (ML16355A286). The EGM applies specifically to a structure, system, and component (SSC) that is determined to be inoperable for tornado-generated missile protection. The EGM stated that a bounding risk analysis performed for this issue concluded that tornado missile scenarios do not represent an immediate safety concern because their risk is within the LIC504, Integrated Risk-Informed Decision-Making Process for Emergent Issues, risk acceptance guidelines. In the case of Quad Cities Nuclear Generating Station, the EGM provided for enforcement discretion of up to 3 years from the original date of issuance of the EGM. The EGM allowed NRC staff to exercise this enforcement discretion only when a licensee implements, prior to the expiration of the time mandated by the limiting conditions for operation (LCO), initial compensatory measures that provided additional protection such that the likelihood of tornado missile effects were lessened. In addition, licensees were expected to follow these initial compensatory measures with more comprehensive compensatory measures within approximately 60 days of issue discovery. The comprehensive measures should remain in place until permanent repairs are completed or until the NRC dispositions the non-compliance in accordance with a method acceptable to the NRC such that discretion is no longer needed. In 1967, the NRC issued general design criterion to which the Quad Cities Nuclear Generating Station was evaluated against. Quad Cities Updated Final Safety Analysis Report (UFSAR), Section 3.1, Conformance with NRC General Design Criteria, discusses this criterion and its applicability to the sites design. Specifically, UFSAR Section 3.1.1.2, Criterion 2Performance Standards, states, those systems and components essential to the prevention of accidents or to mitigation of their consequences shall be designed, fabricated, and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena such as earthquakes, tornadoes, flooding conditions, winds, ice, and other local site effects. Section 3.1.1.2 further states that plant equipment which is important to safety is designed to permit safe plant operation and to accommodate all design basis accidents for all appropriate environmental phenomena at the site without loss of their capability. On March 1, 2018, during an engineering review of the Quad Cities, Units 1 and 2 facility design, the licensee identified a nonconforming condition with the aforementioned general design criterion. Specifically, the licensee identified that the three EDG systems intake stacks, exhaust stacks, fuel oil storage tank vent lines, and diesel oil day tank vent lines were inadequately protected against tornado missiles. As a result of the nonconforming condition, the licensee declared the Units 1, 2, and 12 EDG systems inoperable and entered the Technical Specifications (TS) LCO required action statements. The condition was reported to the NRC in Event Notice 53235 as an unanalyzed condition and a condition that could have prevented fulfillment of a safety function. Corrective Actions: The licensee documented the inoperability and functionality of the affected SSCs and the applicable TS LCO action statements in the CAP and in the control room operating log. The shift manager notified the NRC resident inspector of implementation of EGM 15002 and documented the implementation of the compensatory measures to establish the SSCs as operable but nonconforming prior to expiration of the required LCO action statements. The licensees initial (and final) compensatory measures included: verification that procedures and training for a tornado watch or warning were in place to provide additional instructions for operators to respond in the event of tornados or high winds, and a potential loss of SSCs vulnerable to the tornado missiles; confirmation of readiness of equipment and procedures dedicated to the Diverse and Flexible Coping Strategy (FLEX); verification that training was up to date for individuals responsible for implementing preparation and emergency response procedures; establishment of a heightened level of station awareness and preparedness relative to identifying tornado missile vulnerabilities; and revision to procedure QCOA 001010, Tornado Watch-Warning, Severe Thunderstorm Warning, or Severe Winds, to include guidance for unobstructing and/or repairing crimped diesel fuel oil tank vent lines. Corrective Action References: IR 1281009: Tornado Missile Protection Unresolved Item and IR 4110003: EDG Non-Conformance for Tornado Missiles Enforcement: Violation: The enforcement discretion was applied to the required shutdown actions of the following TS LCOs for both units: TS 3.0.3: General Shutdown LCO (cascading or by reference from other LCOs); and TS 3.8.1: AC SourcesOperating. Severity/Significance: The subject of this enforcement discretion, associated with tornado missile protection deficiencies, was determined to be less than red (i.e., high safety significance) based on a generic and bounding risk evaluation performed by the NRC in support of the resolution of tornado-generated missile non-compliances. The bounding risk evaluation is discussed in Enforcement Guidance Memorandum 15002, Revision 1, Enforcement Discretion for Tornado-Generated Missile Protection Non-Compliance, and can be found in ADAMS Accession No. ML16355A286. Basis for Discretion: The NRC exercised enforcement discretion in accordance with Section 2.3.9 of the Enforcement Policy and EGM 15002 because the licensee initiated initial compensatory measures that provided additional protection such that the likelihood of tornado missile effects were lessened. The licensee reviewed their initial compensatory measures to determine if more comprehensive compensatory measures were warranted. Upon their review, the licensee concluded that their initial compensatory measures were sufficient to satisfy both the short-term and long-term actions required by the EGM and therefore no additional actions were necessary for enforcement discretion. The disposition of this enforcement discretion closes URI05000254/201100904; 05000265/ 201100904: Tornado Missile Protection of the Emergency Diesel Generator Air Intake and Exhaust. |
| 05000272/FIN-2018007-01 | Salem | 2018Q1 | Failure to Perform Testing of Emergency Diesel Generator Bypass Switches | The team identified a finding of very low safety significance (Green) involving an NCV of Salem Unit 1 License Condition 2.C.(5) and Salem Unit 2 License Condition 2.C.(10) of the respective facility operating licenses for failure to implement and maintain in effect all provisions of the approved Fire Protection Program. Specifically, PSEG did not periodically test or check the EDG bypass switches to verify that they were capable of performing their intended design functions during safe shutdown operation in the event of a significant fire. |
| 05000255/FIN-2017007-01 | Palisades | 2017Q4 | Failure to Periodically Test the Emergency Diesel Generators Capacity to Start and Accelerate Design Basis Sequenced Loads | The team identified a finding of very-low safety significance (Green) and an associated NCV of Title 10 of the Code of Federal Regulations, Part50, Appendix B, Criterion XI, Test Control, for the failureto periodically test the emergency diesel generators(EDGs) capability to start and accelerate all of the sequenced loads within the applicable design voltage and frequency transient and recovery limits.Specifically, EDG testingactivities did not demonstrate that all of the EDG auto-sequenced loads started and accelerated within the applicable voltage and frequency limits during start-up and recovery. In addition, the licensee did not perform adequate post-modification testing after replacing the EDG governor controller system or voltage regulators. Thelicensee captured theseissuesin their Corrective Action Programas Condition Report (CR)2017-05265 and CR 2017-05283, and performed an operability evaluation which reasonably determined the affected structures, systems, and componentswere operable.The performance deficiency was determined to be more-than-minor because it was associated with the Mitigating Systems cornerstone attribute of equipment performance and affected the cornerstone objective of ensuring the availability, reliability, and capability of mitigating systems thatrespond to initiating events to prevent undesirable consequences. The finding screened as of very-low safety significance (Green) becauseit did not result in the loss ofoperability or functionality of mitigating systems. Specifically, the licensee evaluated the most recent voltage and frequency data from the last EDG output breaker testsin which the data recorder was left running after the output breaker shut and reasonably determined that the EDGs and the affected loads were operable. The team did not identify a cross-cutting aspect associated with this finding because it was not confirmed to reflect current performance due to the age of the performance deficiency. Specifically, the associated testingprocedures were established more than 3years ago. |
| 05000382/FIN-2017008-02 | Waterford | 2017Q4 | Failure to Meet RG 1.9 Emergency Diesel Testing Requirements during Surveillance Test Results in Missed Surveillance | The team identified a Green non-cited violation of Waterford Steam Electric Station, Unit 3, Technical Specification Limiting Condition for Operation 3.8.1.1 for failure to maintain operability of two separate independent diesel generators. Specifically, on May 23, 2017, the licensee failed to verify that the train A emergency diesel generator energized all auto-connected shutdown loads through the load sequencer and operated for greater than or equal to five minutes in accordance with Technical Specification Surveillance Requirement 4.8.1.1.2. |
| 05000382/FIN-2017008-04 | Waterford | 2017Q4 | Potential Failure to Obtain a License Amendment for Changes to Diesel Generator Surveillance Test Interval | The team identified an unresolved item for the licensees failure to perform a 10 CFR 50.59 safety evaluation and subsequently obtain a license amendment for changes to the surveillance testing frequency of the emergency diesel generators. The licensees process for changing surveillance test intervals is controlled by Technical Specification 6.5.18, Surveillance Frequency Control Program. The licensees changes to the surveillance test intervals are made in accordance with NEI 04-10, Risk Informed Method for Control of Surveillance Frequencies, Revision 1, as written in procedure EN-DC-355, Engineering Evaluation of Proposed Surveillance Test Interval Changes, Revision 2. The team reviewed the licensees changes to the surveillance test interval, as required by Technical Specification Surveillance Requirements 4.8.1.1.2.e, for emergency diesel generators. The licensee changed the surveillance test interval for the train A and B emergency diesel generators from both emergency diesel generators tested every 18 months to each emergency diesel generator tested every 36 months. The team determined that testing the emergency diesel generators once every 36 months was contrary to guidance in Regulatory Guide 1.9, Application and Testing of Safety-Related Diesel Generators in Nuclear Power Plants, Revision 4. Specifically, Section 2.3.2.3, Refueling Outage Testing, requires the capability of the overall emergency diesel generator design should be demonstrated during every refueling outage not exceeding a period of 24 months. The team determined that the licensee did not correctly evaluate the change to the surveillance interval in accordance with surveillance frequency control program change process. Specifically, the licensee did not correctly evaluate NEI 04-10, step 1, Check for Prohibitive Commitments, and step 2, Can Commitments be Changed? of the change process. The team determined that this change would require a 10 CFR 50.59 safety evaluation and subsequent license amendment because it would result in more than a minimal increase in likelihood of a malfunction of a component important to safety as previously described in the final safety analysis report. Specifically, the test interval would no longer meet the applicable acceptance standard, Regulatory Guide 1.9, to which the licensee is committed. Planned Closure Action(s): The NRC inspectors will review the final corrective actions, pending NRC resolution of applicability of 10 CFR 50.59 to the surveillance frequency control program. Licensee Action(s): Prior to this inspection, the licensee identified this 10 CFR 50.59 issue in the corrective action program because of industry operating experience. At the time of this inspection, the licensee had not completed the final corrective action and 10 CFR 50.59 activities.These corrective actions will be completed once industry guidance on the NRC resolution of applicability of 10 CFR 50.59 to the surveillance frequency control program was available. Corrective Action Reference(s): Condition Reports CR-WF3-2017-05590 and CR-WF3-2017-5602 NRC Tracking Number: 05000382/2017008-04 |
| 05000461/FIN-2017011-01 | Clinton | 2017Q4 | Failure to Correct an Identified Degraded Condition on the Division 3 Shutdown Service Water Pump | A self-revealing finding and an apparent violation of 10 CFR 50, Appendix B, Criterion XVI, Corrective Action, with associated violations of Technical Specification (TS) 3.7.2 and TS 3.5.1 were identified on June 15, 2017, for the licensees failure to correct a degraded condition identified during the evaluation performed as a result of the Division 3 shutdown service water (SX) pump failure in 2014. Specifically, the licensee identified corrosion of the Division 3 SX pump sleeves as a contributing cause of the 2014 pump failure and failed to appropriately evaluate and correct this issue. This resulted in the Division 3 SX pumps failure to start on June 15, 2017, and rendered the Division 3 SX pump inoperable for a time longer than its TS allowed outage time. The licensee entered this issue into the corrective action program and implemented design changes to the pump and motor assembly, including installing a new motor with higher starting torque characteristics and replacing the pump shaft sleeves and packing with parts more resistant to corrosion. The licensee has completed multiple successful runs of the new pump with no abnormalities noted. The inspectors determined that the licensees failure to correct a degraded condition identified during the evaluation performed as a result of the 2014 Division 3 SX pump failure appears to be not in accordance with the requirements of 10 CFR 50, Appendix B, Criterion XVI, and was a performance deficiency. The performance deficiency was determined to be more than minor because it impacted the Mitigating Systems cornerstone attribute of equipment performance and adversely affected the cornerstone objective of ensuring the availability, capability and reliability of equipment that responds to initiating events. Specifically, the performance deficiency resulted in the failure of the Division 3 SX pump, which impacted the operability and functionality of the high pressure core spray system and the Division 3 emergency diesel generator. Using IMC 0609, Appendix A, Significance Determination Process for Findings At-Power, dated June 19, 2012, a Significance and Enforcement Review Panel preliminarily determined the finding to be of low to moderate safety significance. The inspectors determined that this finding affected the cross-cutting area of problem identification and resolution in the aspect of evaluation, where the organization thoroughly evaluates issues to ensure that resolutions address causes and extent of 3 conditions commensurate with their safety significance. Specifically, the licensee failed to properly evaluate the Division 3 SX pump sleeve corrosion rates when performing the component life evaluation, the component operability evaluation and the evaluation in response to the abnormal noises identified during periodic pump runs. (P.2) |
| 05000296/FIN-2017004-02 | Browns Ferry | 2017Q4 | Failure to Perform an IDO without delay for 3A EDG after Observing Indications of a Degraded Condition | The inspectors identified a NCV of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures and Drawings, for failure to perform an immediate operability determination (IDO) for 3A Emergency Diesel Generator (EDG) upon discovering a degraded condition. Specifically, on December 19, 2017, the licensee failed to perform an IDO after identifying and confirming less than minimum cooling flow, thus leaving the EDG in an indeterminate state of operability.The performance deficiency is more than minor because it was associated with the equipment performance attribute and affected the associated cornerstone objective to ensure availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. As a corrective action, the licensee performed operations to restore flow within the acceptable range and performed an IDO. The violation was entered into the licensee's CAP as CR 1370601. The inspectors determined that the finding had a cross-cutting aspect in the human performance area of H.13, Consistent Process, because the performance deficiency was caused by not following a consistent, systematic approach to making a decision concerning operability of the affected DG. |
| 05000354/FIN-2017004-02 | Hope Creek | 2017Q4 | Inadequate Design Control of Emergency Diesel Generator Speed Switch | The inspectors identified a Green non-cited violation (NCV) of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion III, Design Control, because PSEG did not adequately provide for verifying or checking the adequacy of design by the performance of design reviews. Specifically, PSEGs equivalent change package (ECP) 80112197, did not assure that the design change ECP 80119127 was adequately reviewed prior to approval, which led to the installation of a defective model A-416 speed switch (SS), and subsequent failure of the D emergency diesel generator (EDG) to start. PSEGs immediate C/As were to remove the new failed model 416 SS and reinstall the prior model 8 SS. Additionally, PSEG entered this issue into their CAP, performed a causal evaluation, and assigned C/As to address their design change process (DCP) gaps by revising procedures and conducting training.This issue was more than minor because it was associated with the Design Control attribute of the Mitigating Systems cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). In accordance with IMC 0609.04, Initial Characterization of Findings, dated October 7, 2016, and Exhibit 2 of IMC 0609, Appendix A, The SDP for Findings At-Power, dated June 19, 2012, the inspectors determined that this finding is of very low safety significance (Green) because the performance deficiency was not a design or qualification deficiency, did not involve an actual loss of safety function, did not represent the actual loss of a safety function of a single train for greater than its technical specification (TS) allowed outage time, did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety-significant in PSEGs maintenance rule program (MRP) for greater than 24 hours. This finding had a cross-cutting aspect in the area of Problem Identification and Resolution, operating experience (OE), because PSEG did not ensure that the organization systematically and effectively collect, evaluate, and implement relevant internal and external OE in a timely manner. Specifically, PSEG did not effectively collect or review previous Part 21 issues related to the new SS as part of the OE review in their DCP. (P.5) |
| 05000395/FIN-2017007-04 | Summer | 2017Q4 | Licensee-Identified Violation | Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that design control measures provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, since 2010, the licensee failed to evaluate the loading of the emergency diesel generators at the maximum voltage and frequency allowed by TS 3/4.8.1 in Calculation DC08360-006, Diesel Generator 1A and 1B Loading, Rev. 12, and to evaluate battery terminal voltage at the maximum battery cell-to-cell resistance allowed by TS 3/4.8.2 in Calculation DC08320-010, Class 1E 125 Volt DC System Voltages and Voltage Drop, Rev. 18. The team determined the finding to be of very low safety significance (Green) because the finding was a deficiency affecting the design of a mitigating SSC, and the SSC maintained its operability. The licensee entered these issues into their CAP as CRs 10-02395 and 10-02033. ATTACHMENT: SUPPLEMENTAL INFORMATION |
| 05000324/FIN-2017004-01 | Brunswick | 2017Q4 | Loss of Emergency 4160V Bus Due to Failure to Implement Procedure | A self-revealing non-cited violation (NCV) was identified for the licensees failure to properly transfer power to the E-4 4160 volt emergency bus from the E-4 emergency diesel generator (EDG), to the normal switchgear bus 2C, as required by procedure 0OP-50.1 Diesel Generator Emergency Power System Operating Procedure. This resulted in a momentary under voltage condition followed by a re-energization of the E-4 emergency bus by EDG-4. This was entered into the licensees corrective action program (CAP) as nuclear condition report (NCR) 2151329.The licensees failure to parallel across (i.e., reclose) the normal feeder breakers prior to unloading the EDG-4 and opening the EDG-4 output breaker, which resulted in a valid and automatic actuation of the EDG-4, was a performance deficiency. The finding was determined to be greater than minor because it was associated with the human performance attribute of the Initiating Events cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during power operations. Using IMC 0609.04, Initial Characterization of Findings, Exhibit 1, the issue was classified as a transient initiator contributor because it was associated with a loss of offsite power (LOOP). Finally, using Appendix A of IMC 0609, SDP for Findings at-Power, the finding was determined to be of very low safety significance (Green) because it did not contribute to both the likelihood of a reactor trip and the likelihood that mitigating systems would not be available. Using Manual Chapter 0310, Aspects Within the Cross-Cutting Areas, the inspectors identified a cross-cutting aspect in the procedural adherence of the human performance area, because the operators failed to properly utilize an existing procedure pertinent to their particular situation and this directly resulted in the momentary loss of an emergency 4160 volt bus. (H.8) |
| 05000366/FIN-2017004-01 | Hatch | 2017Q4 | Continuous Fire Watch or Compensatory Measures Not Established per FHA | An NRC-identified non-cited violation (NCV) of Unit 2 License condition 2.C.(3)(a) Fire Protection was identified when on October 17, 2017, the licensee failed to establish a continuous fire watch or alternative compensatory measures required by Hatchs Fire Hazards Analysis (FHA), Appendix B, while the carbon dioxide fire protection system was nonfunctional during a routine maintenance outage for the 2C emergency diesel generator. Failure to establish a continuous fire watch or alternative compensatory actions as required by Hatchs Fire Hazards Analysis, Appendix B, when the low pressure carbon dioxide storage system became inoperable on October 17, 2017, was a performance deficiency. The licensee restored compliance on October 25, 2017, when the double fire door was shut, restoring functionality of the carbon dioxide system. The licensee entered this issue into the corrective action program as Condition Report (CR) 10423361.This performance deficiency was more-than-minor because the failure to establish a continuous fire watch or alternative compensatory measures adversely affected the reliability of the carbon dioxide system and/or compensatory measures. The finding screened to green because the alternate train of safe shutdown remained operable. The inspectors determined this performance deficiency had a cross cutting aspect in the Human Performance Area Training attribute because of the observed weakness in the application of FHA applicability statements. (H.9) |
| 05000461/FIN-2017009-01 | Clinton | 2017Q3 | Failure to Evaluate Replacement Relay Dropout Voltage | Preliminary White. A self-revealed finding preliminarily determined to be of low to moderate safety significance, and an associated apparent violation of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion III, Design Control, was identified on March 9, 2017, for the licensees failure to implement measures for the selection and review for suitability of application replacement relays for the Division 1 Emergency Diesel Generator (EDG) Room Vent Fan, which were components subject to the requirements of 10 CFR Part 50, Appendix B. Specifically, Engineering Changes 330624 and 366624 failed to evaluate the change in the actual drop out voltages for replacement relays on the associated fan circuitry, and instead, introduced new relays into the circuit that resulted in the failure of the fan to operate during an under voltage condition. This rendered the Division 1 EDG inoperable for a time longer than its technical specification allowed outage time, which was a violation of Technical Specification 3.8.1, AC SourcesOperating. The licensee entered this issue into the corrective action program as action request (AR) 03982792. Corrective actions for this issue included restoring the circuit to allow the ventilation fan to operate and returning the emergency diesel generator to an operable condition. The inspectors determined that the licensees failure to verify the suitability of the replacement relays for the Division 1 EDG room vent fan was contrary to the requirements of 10 CFR Part 50, Appendix B, Criterion III and a performance deficiency which was within the licensees ability to foresee and correct. The performance deficiency was determined to be more than minor because it was associated with the design control attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of the systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to verify the suitability of the replacement relays prior to installation in the Division 1 EDG room vent fan circuitry resulted in the inoperability and unavailability of the Division 1 EDG from May 18, 2016 to March 11, 2017, when one of the unsuitable relays was replaced. Using IMC 0609, Appendix A, Significance Determination Process for 3 Findings At-Power, dated June 19, 2012, a Significance and Enforcement Review Panel preliminarily determined the finding to be of low to moderate safety significance. The inspectors determined that this finding affected the cross-cutting area of human performance in the aspect of challenge the unknown, where individuals stop when faced with uncertain conditions. Risks are evaluated and managed before proceeding. Specifically, a questioning attitude was not used to understand the consequence of the differences in relay features resulting with installing a relay that was incompatible with the current design. (H.11) |
| 05000263/FIN-2017007-01 | Monticello | 2017Q3 | Inadequate Fire Barrier Inspection Procedure | The inspectors identified a finding of very-low significance (Green) and an associated Non-Cited Violation of License Condition 2.C.4 of the Monticello Nuclear Generating Plant,Unit No. 1,Renewed Facility Operating License for implementing an alternative compensatory measure that was adverse to safety shutdown.Specifically, the licensee approved the installation of a temporary fuel oil pump, in lieu of a continuous fire watch, which reduced the defense in depth of the Fire Protection Program.The inspectors determined that the use of a temporary fuel oil pump in the event of afire, in lieu of a continuous fire watch, constituted an adverse change to the Fire Protection Program,was contrary to License Condition 2.C.4 and a performance deficiency. The performance deficiency was more-than-minor because it affected the Protection Against External Factors attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the use of the alternative compensatory measure reduced the defense in depth of the Fire Protection Program by failing to provide compensatory measures to reduce the likelihood of occurrence of a fire and failing to provide prompt detection of a fire.In accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, Table 2 the inspectors determined the finding affected the Initiating Events cornerstone. The finding degraded fire protection defense-in-depth strategies, and the inspectors determined, using Table 3, that it could be evaluated using Appendix F, Fire Protection Significance Determination Process.The inspectors determined that the finding represented a low degradation and was screened as having very-low safety significance (Green) in Task 1.3.1 of IMC 0609, Appendix F,because repair activities were in place that would have maintained safe shutdown(SSD)conditions and were reasonably achievable.This finding had a cross-cutting aspect in the Conservative Bias component of the Human Performance cross-cutting area. Specifically, the licensee implemented an alternate compensatory measure that only focused on the emergency diesel generator operability and hence, the post-SSD strategy of the plant without considering the defense in depth requirements of their Fire Protection Program to prevent, detect, and suppress a fire that could affect equipment needed for SSD of the plant. |
| 05000255/FIN-2017003-01 | Palisades | 2017Q3 | Left Train Emergency Diesel Generator Load Sequencer Failure | Introduction: The inspectors identified an Unresolved Item ( URI ) associated with the failure of the left train emergency DG load sequencer to run its program. Since this sequencer is required for left train DG operability, this condition resulted in an unanticipated entry into a TS shutdown action statement. The cause of this failure is currently unknown, pending the results of a vendor evaluation of a failed load sequencer component. Description : On August 3, 2017, the control room received alarm EK 1145, Sequencer Trouble, unexpectedly. The operators identified that the indication lights were not lit on the left channel load sequencer, MC -34L101; declared the associated DG inoperable; and entered the appropriate TS action statement. The failed sequencer was removed and replaced with a new module that was satisfactorily post -maintenance tested and the left train EDG was subsequently declared operable on August 4, 2017. The failed sequencer was sent to an on -site lab for further troubleshooting. No obvious visual signs of failure were identified and the electrolytic capacitors in the module all tested satisfactorily. The module was then bench tested using a test program, which identified that although it would power up, no program would run. The licensee completed an equipment failure evaluation to review the bench test data, along with information collected in the failure modes analysis, and determined that the direct cause of the failure was a memory fault within the sequencer module that caused the sequencer to lock -up and not run its program. A fault in the memory module, memory processing interface circuitry, or the executive module could have caused the sequencer to lock up. At the end of the inspection period, further examination by t he vendor was required and in progress to determine the exact initiating point of the fault. In addition to replacing the failed sequencer, the licensees immediate corrective actions included inspecting the right train load sequencer and completing the quarterly surveillance test to ensure proper operation; the results of which were satisfactory. A plant operating experience review was conducted and did not identify any prior memory failures on the load sequencers. Once the vendors evaluation is complete, the licensee plans to re-assess the failure mechanism and any additional corrective actions required. This item is considered unresolved, pending the inspectors review of the vendor analysis and any changes made to the equipment failure evaluation, to determine if this issue constitutes a performance deficiency and/or violation of NRC requirements. (URI 05000255/2017003 01, Left Train Emergency Diesel Generator Load Sequencer Failure ) |
| 05000255/FIN-2017003-03 | Palisades | 2017Q3 | 12 Diesel Generator Trip During Maintenance Resulting in Additional Unavailability of the 12 DG | A finding of very low safety significance and an associated NCV of Technical Specification (TS) 5.4.1, Procedures, was self -revealed on March 31, 2017, when the 12 Diesel Generator ( DG ) tripped during performance of monthly TS surveillance procedure MO 7A 2, Emergency Diesel Generator 1 2. Specifically, during conduct of the monthly surveillance procedure, restoration activities associated with maintenance of breaker 152 213, 1 2 DG to Bus 1D, were being performed. When maintenance personnel closed the trip cutouts for the Z -phase of the 1 2 DG differential overcurrent relay, an unbalanced current flow into the differential relay resulted in relay actuation. This actuation resulted in a trip of the output breaker and subsequently the 1 2 DG. The trip caused a delay in the TS surveillance activities and resulted in the extended unavailability and inoperability of the 1 2 DG. The licensee entered this issue into their corrective action program (CAP) as condition report (CR) CR PLP 2017 01291. Corrective actions included retesting the 1 2 DG and updating the work instructions associated with the differential overcurrent relays to include caution statements that opening or closing trip cutouts for the relays while the output breaker s from the DGs to the associated buses were closed could cause the differential relay s to actuate and trip the DG . The issue was determined to be more than minor in accordance with IMC 0612, Appendix B, Issue Screening, because it was associated with the Mitigating System s cornerstone attribute of Procedure Quality and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding screened as having very low safety significance (Green) in accordance with IMC 0609, Appendix A, The Significance Determination Process for Findings At -Power, Exhibit 2, since the inspectors answered No to all screening questions. The finding had a cross- cutting aspect in the area of Human Performance, in the Work Management aspect , for the licensees failure to identify and manage risk commensurate to the work (H.5). |
| 05000293/FIN-2017007-02 | Pilgrim | 2017Q3 | Inadequate Design Verification of Emergency Diesel Generator Under- Frequency Alarm Setpoint | The team identified a finding of very low safety significance (Green) involving an NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, in that Entergy did not adequately verify that the emergency diesel generator (EDG) under-frequency alarm setpoint was in accordance with design basis requirements. Specifically, the EDG under- frequency alarm was set at a value less than the prescribed industry standard to protect equipment, and station procedures did not contain instructions to address the EDG under- frequency condition. In response, Entergy staff evaluated and confirmed current EDG operability and initiated actions to correct the under-frequency range in the alarm setpoint and to provide appropriate operator response guidance in operating procedures. 3 This finding was more than minor because it was associated with the design control attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with IMC 0609.04, Initial Characterization of Findings, and Exhibit 2 of IMC 0609, Appendix A, The SDP for Findings At-Power, the team determined that this finding was of very low safety significance (Green) because it was a design deficiency confirmed not to result in the loss of operability or functionality. The team determined that this finding had a cross-cutting aspect in the area of Human Performance, Avoid Complacency, because Entergy did not plan for the possibility of latent issues while processing a plant modification where the bases for EDG alarm functions were incorrect. |
| 05000346/FIN-2017003-01 | Davis Besse | 2017Q3 | Pinched Wiring Causing the Failure of Fuses Y210 and Y214 | An unresolved item (URI) was identified by the inspectors relating to the significance of pinched wires and licensees understanding of the condition and the extent of cause and condition. On July 6, 2017, during a planned replacement of fuse Y204 in electrical cabinet Y2, unrelated fuse Y214 blew. Both fuses were scheduled for replacement as part of the licensees project to replace Shawmut A25X style fuses that are susceptible to premature failure. The failure of fuse Y214 was unexpected, and the licensee was not able to discern a direct cause. The licensee determined that the failure was the fuse itself being so unstable that any perturbation was enough to cause failure. This failure resulted in multiple systems being declared inoperable including AFP 2, safety features actuation system channel 2, decay heat removal system interlock, and radiation element RE8447. On August 8, 2017, the same electrical cabinet, Y2, was opened for replacement of fuse Y216. Following the replacement, fuses Y210 and Y214 blew. The licensee attempted replacement of the fuses, but the replacement fuses blew again, shortly after being repowered. Initial licensee evaluation of the condition revealed thatthe wire bundle running along the hinge side of the cabinet door was unconstrained and two of the wires had become pinched between the door and cabinet frame, which damaged the wire insulation and allowed the wires to short circuit against the cabinet frame. The failure of Y210 and Y214 resulted in multiple systems being declared inoperable including AFP 2, safety features actuation system channel 2, decay heat removal system interlock, and emergency diesel generator 2. The licensee removed and replaced the damaged portion of the wires and used wire ties to constrain the wire bundle. The licensee entered this issue into their CAP as CRs 201707196 and 201708185. Because the licensee had yet to answer NRC inspector questions pertaining to the corrective actions and extent of condition by the end of this inspection period, the issue is being treated as a URI pending completion of the inspectors review. (URI 05000346/201700301, Examination of Extent of Cause and Condition of Pinched Wires in Electrical Cabinets) |
| 05000364/FIN-2017003-01 | Farley | 2017Q3 | Failure to perform adequate corrective maintenance on the 2B EDG | The NRC identified a non-cited violation (NCV) of Technical Specification (TS) 5.4.1.a, Procedures, for the licensees failure to implement corrective maintenance work order instructions to identify and replace piping as necessary for a degraded threaded joint on the 2B emergency diesel generator (EDG) jacket water keep warm system piping. As a result, a leak occurred at this threaded pipe joint during surveillance testing which rendered the 2B EDG inoperable. The inspectors determined that the failure to follow work order instructions to replace degraded jacket water system piping during corrective maintenance on the 2B EDG on March 3, 2017, was a performance deficiency (PD). The finding was more than minor because it was associated with the equipment reliability attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The significance of this finding was evaluated using IMC 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012. Initial screening by the resident inspectors using the Saphire Farley 1 & 2 SPAR Model resulted in a potentially greater-than-green significance. Therefore, a detailed risk analysis was performed by a regional senior reactor analyst (SRA). The NRC Farley SPAR model was used for internal events, seismic and tornado/high winds risk estimates and the licensees Farley fire probabilistic risk assessment model was used for fire risk estimation. The major analysis assumptions included: a 51-day exposure period, EDG 2B operation at nominal failure to run probability until 8 hours when EDG assumed to fail due to the PD, PD treated as having common cause failure to run potential, no recovery of the 2B EDG was assumed, and no credit for FLEX equipment was assumed. The operation of the EDG for 8 hours prior to failure and remaining mitigating equipment limited the risk. The dominant sequence was a station blackout sequence consisting of a site-wide weather-related loss of offsite power, successful reactor shutdown, random failure to run of the 1/2A and 1C EDGs, failure of the 2B EDG due to the performance deficiency, failure to manually operate the turbine driven auxiliary feedwater pump long term, and failure to recover offsite power or an EDG leading to loss of core heat removal and core damage. The detailed risk evaluation (DRE) determined that the increase in core damage frequency due to the PD was <1.0 E-6 per year, a Green finding of very low safety significance. The finding had a cross-cutting aspect of Conservative Bias in the Human Performance area, because the decision to leave the diesel in a degraded condition following maintenance on March 3, 2017 was neither conservative nor prudent when additional action could have been taken to adequately repair or evaluate the threaded pipe joint (H.14). |
| 05000414/FIN-2017011-01 | Catawba | 2017Q3 | Failure to Adequately Establish and Adjust Preventive Maintenance for Emergency Diesel Generator Excitation System Diodes. | To Be Determined (TBD): The inspectors identified an AV of Technical Specification 5.4.1.a, Procedures, for the licensees failure to adequately develop and adjust the preventive maintenance strategy for the emergency diesel generator (EDG) excitation system in accordance with AD-EG-ALL-1202, "Preventive Maintenance and Surveillance Testing Administration." The inspectors also identified an associated AV of Title 10 of the Code of Federal Regulations (10 CFR) Part 50 Appendix B, Criterion XVI, Corrective Actions, for the failure to correct a condition adverse to quality associated with elevated operating temperatures of EDG excitation system diodes. This resulted in the failure of an EDG excitation system diode and overcurrent trip of the 2A emergency diesel output breaker during a surveillance test performed on April 11, 2017. The licensee entered this condition into their corrective action program as Condition Report 2116069. The 2A EDG was returned to service on April 14, 2017 follo wing replacement of the excitation system diodes. The failure to adequately develop and adjust preventive maintenance activities in accordance with AD-EG-ALL-1202, thus allowing a condition adverse to quality to remain uncorrected, was a performance deficiency. This performance deficiency was more than minor because it affected the mitigating systems cornerstone attribute of equipment performance and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems and components that respond to initiating events to preclude undesirable consequences (i.e. core damage). Spec ifically, failure to adjust the preventive maintenance activities for the EDG excitation sy stem by incorporating operating experience, corrective maintenance history, and structures, systems, and components (SSC) performance history led to the failure of diode CR4 in the EDG excitation system and caused the 2A EDG output breaker to trip open on April 11, 2017. Using NRC Inspection Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, dated June 19, 2012, the inspectors determined that the issue affected the mitigating systems cornerstone. In accordance with NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings at Power, dated June 19, 2012, the inspectors determined that the issue required a detailed risk evaluation because the finding represents an actual loss of function of a single train for greater than its technical specification allowed outage time. This finding has a cross-cutting aspect of oper ating experience in the area of problem identification and resolution, because the organiza tion did not systematically and effectively evaluate relevant internal and external operating experience in a timely manner. Specifically, Condition Report 1566561 doc umented industry operating experience regarding EDG excitation system diodes failing at an increased rate and that operating experience was not effectively implemented and institutionalized through changes to station processes, procedures, and equipment. This issue is indicative of current performance because the station did not take effective corrective actions to address the degradation of the EDG excitation system |
| 05000482/FIN-2017003-04 | Wolf Creek | 2017Q3 | Failure to Verify Equipment or Systems are Capable of Performing Their Intended Design Function Following Maintenance | The inspectors reviewed a Green, self-revealed non-cited violation of Technical Specification 5.4.1.a for the licensees failure to ensure that maintenance that can affect the performance of safety-related equipment was properly pre-planned and performed in accordance with written procedures, documented, instructions, or drawings appropriate to the circumstances. Specifically, the licensee failed to verify that the wiring in the transformer 7 primary differential protective relay was landed on the correct termination point, and as a result, the station experienced an unplanned loss of normal offsite power to bus NB01, the train A Class 1E electrical bus.Description. On November 16, 2016, at approximately 9:09 p.m., a fault occurred that isolated the east switchyard bus from the train A safety-related 4160 volt alternating current bus NB01, while the Wolf Creek Nuclear Generating Station was in Mode 5 with the reactor coolant system filled and a bubble in the pressurizer. During refueling outage 21, a modification to transformer 7 allowed the offsite power through transformer 7 to bus NB01 to be fed from either the east or west switchyard busses through two different breakers (345-80 or 345-90). After the loss of the east switchyard bus, the second breaker unexpectedly tripped, which resulted in a loss of offsite power to NB01. An undervoltage condition was detected on bus NB01, which caused the train A emergency diesel generator to start and power bus NB01 as designed. All other systems functioned as expected. Westar, the substation owner, determined that the initial fault was caused by a mouse on the 13-4 circuit at Wolf Creek. The 13-4 relay and breaker cleared the fault and coordinated with all upstream devices. Approximately 5.5 seconds after the initial fault, a second fault occurred in transformer 6. The transformer 7 digital differential relay scheme provides a standard configuration with primary and secondary protective relays, each with the capability of isolating transformer 7. Troubleshooting activities focused on the reason why the primary relay tripped and the secondary relay did not trip. Westar technicians identified a jumper on the transformer 7 primary differential relay current transformer circuit that had been improperly landed. The jumper was designed to run from the neutral circuit of one current transformer to the neutral circuit of the other. However, Westar Energy technicians had incorrectly landed the jumper from the neutral of the first current transformer onto the C phase of the other. This allowed current from the transformer 6 fault event to be detected in the transformer 7 primary differential relay circuit.The inspectors reviewed the cause evaluation completed by the licensee, whichdetermined that the direct cause of this event was the wiring in the transformer 7 primary differential protective relay was landed on the incorrect termination point. This cause is supported by the fact that this incorrect termination allowed additional current to be introduced onto the C phase relay circuit, which initiated the trip circuit actuation.The inspectors also reviewed corrective actions associated with the root cause evaluation for the unplanned plant shutdown, loss of offsite power, and Notification of Unusual Event declaration that occurred on January 13, 2012. An Augmented Inspection Team was chartered to review the circumstances surrounding the loss of offsite power event and Notification of Unusual Event declarationan issue of Yellow safety significance was identified. The event from January 13, 2012, involved equipment owned by Wolf Creek (startup transformer XMR01), with work being performed by Wolf Creek contractors. The November 16, 2016, event involved equipment owned by Westar (transformer 7). While inspectors acknowledge that the two events from January 13, 2012, and November 16, 2016, are not exactly the same, the inspectors noted that they are similar in that they both involved the modification of current transformer wiring associated with transformers that provide power to train A and B engineered safety function transformers (XNB01 and XNB02, respectively), which supply train A and B Class 1E electrical busses NB01 and NB02, respectively. The inspectors did not determine that the 2012 event actions were causal to the 2016 event; however, the inspectors noted similarities between the identified causes. Procedure AP 21C-001, Wolf Creek Substation, establishes responsibilities and defines necessary interfaces and communications for the operational control, coordination and maintenance necessary to ensure Wolf Creek Substation protection, safety and reliability. The inspectors reviewed the licensees assessment associated with the 2016 event and concluded that the substation work control process requirements in procedure AP 21C-001 were not adequately met. Specifically, step 6.2.5.1 states, in part, that following preventive or corrective maintenance work, appropriate post-maintenance inspections, checks, and/or testing shall be performed to verify that affected equipment or systems (primary and secondary differential relay circuitry) are capable of performing their intended design function.The wiring error on the primary differential protective relay was corrected and its functionality was verified. The secondary differential protective relay wiring was also verified to be correct. The east switchyard bus, transformer 7, and its differential relays were all restored to service. The licensee documented the event in LER 2016-002-00 and Condition Reports 109467 and 116849. The licensee also updated procedure AP 21C-001 to include additional detail and steps that require work instructions for post maintenance testing of current transformer wiring to ensure independent verification of wiring terminations.Analysis. The licensees failure to verify that the primary and secondary differential relay circuitry is capable of performing its intended design function following maintenance was a performance deficiency. The performance deficiency was more than minor because it affected the design control attribute of the Mitigating Systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the licensee failed to verify that the wiring terminations for the primary differential protective relay for transformer 7 were installed correctly, leading to the isolation of transformer 7, resulting in an unplanned loss of offsite power to NB01, the train A Class 1E electrical bus. The inspectors evaluated the finding using Exhibit 3, "Mitigating SystemsScreening Questions," of Inspection Manual Chapter 0609, Appendix G, Attachment 1, "Shutdown Operations Significance Determination Process Phase I Initial Screening and Characterization of Finding," and Appendix G, "Shutdown Operations Significance Determination Process," both issued May 9, 2014. The inspectors determined this finding is a deficiency affecting the design or qualification of a mitigating SSC, and the SSC maintained its operability or functionality. Therefore, the inspectors determined the fi nding was of very low safety significance (Green). The inspectors determined that the finding has a human performance cross-cutting aspect in the area of resources because leaders did not ensure that personnel, equipment, procedures, and other resources are available and adequate to support nuclear safety. Specifically, leaders did not ensure adequate procedures were available to support successful work performance including necessary standards for verifying wiring circuitry terminations such that the loss of power to the NB01 Class 1E electrical bus would not have occurred. This issue is indicative of current performance because the issue occurred in the last three years (H.1). |
| 05000528/FIN-2017003-02 | Palo Verde | 2017Q3 | Loss of Refrigerant Failure of Essential Chiller Unit due to Installation of Incorrect Parts | The inspectors reviewed a self-revealed, Green, non-cited violation of Technical Specification 3.7.10 Condition A for exceeding the allowed outage time of 72 hours to restore one inoperable train of essential chilled water system to an operable status. Specifically, the Unit 1 essential chiller B was inoperable from April 11, 2017, to April 18, 2017, due to a refrigerant leak. The licensee entered this issue into their corrective action program as Condition Report 17-05605. The licensees corrective actions included: isolating the automatic purge unit, thereby stopping the leak; refilling the essential chiller with refrigerant; and retesting the essential chiller unit to return it to an operable status on April 18, 2017. Additionally, the licensee checked the other five essential chillers across the station and found no additional material deficiencies.The inspectors determined that the failure to ensure the correct Swagelok fitting was being installed in accordance with station procedure is a performance deficiency. The performance deficiency is more than minor and a finding because it is associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, on April 18, 2013, the licensee installed the incorrect Swagelok fitting during maintenance on the essential chiller. When the licensee placed the auto purge system in service, this resulted in the refrigerant leaking out of the Swagelok fitting rendering the essential chiller inoperable.The inspectors performed the initial significance determination using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, Step A.3 which required a senior reactor analyst to perform a detailed risk evaluation because essential chiller B was incapable of performing its safety function for greater than its technical specification allowed outage time. A regional senior reactor analyst performed a detailed risk evaluation and determined that the finding was of very low safety significance (Green). Essential Chiller 1B was assumed to be unavailable for 8 days and the potential for common cause failure on the remaining essential chiller was assumed. This resulted in a change in core damage frequency of 3.6E-7 per year. Losses of offsite power comprised the most dominant core damage sequences. The emergency diesel generators and the emergency feed water systems remained available for mitigation of the dominant sequences.The inspectors determined this finding had a cross-cutting aspect in the area of human performance, avoid complacency, in that the licensee failed to recognize and plan for the possibility of latent issues or mistakes. Specifically, the licensee failed to provide an appropriate post-maintenance testing procedure as required by station procedure. The work order executed on April 11, 2017, gave no direction to test for leaks on the filter assembly (H.12). |
| 05000272/FIN-2017007-02 | Salem | 2017Q3 | Inadequate PM for the EDG Room Ventilation System | The team identified a Green non-cited violation of Technical Specification (TS) 6.8.1, Procedures and Programs, because since January 2007, PSEG did not establish an appropriate preventive maintenance (PM) schedule for the emergency diesel generator (EDG) ventilation dampers. Specifically, PSEG cancelled a pre-existing 36-month lubrication/clean/inspect PM in 2007 but failed to add the lubrication task to an existing 6-year damper PM as intended. As a result, since January 2007, the intended lubrication PM was cancelled for the inlet, recirculation, and exhaust ventilation dampers on all six Unit 1 and Unit 2 EDG ventilation systems. PSEGs immediate corrective actions included initiating a corrective action NOTF to address the PM inadequacy and extent-of-condition. The issue is more than minor because, if left uncorrected, it had the potential to lead to a more significant safety concern. Specifically, the removal of the EDG ventilation damper lubrication PM had the potential to adversely impact EDG reliability. In accordance with IMC 0609.04, Initial Characterization of Findings, and Exhibit 2 of IMC 0609, Appendix A, The SDP for Findings At-Power, the team determined that this finding was Green because it was not a design or qualification deficiency, did not involve an actual loss of safety function, did not represent the actual loss of a safety function of a single train for greater than its TS allowed outage time, and did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety-significant in PSEGs Maintenance Rule program for greater than 24 hours. The team determined there was no cross-cutting aspect associated with this finding since it was not representative of current PSEG performance. |
| 05000341/FIN-2017002-01 | Fermi | 2017Q2 | Inadequate Work Instructions for Maintenance on EDG 14 | Green . A finding of very low safety significance with an associated Non- Cited Violation of 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, was self -revealed when plant operators were not able to shut down emergency diesel generator (EDG) 14 using the manual emergency stop button during surveillance testing. Consequently, operators shut down the engine and removed it from service. The licensee failed to have work instructions for maintenance on the safety -related EDG appropriate to ensure the emergency overspeed switch (EOS) oil seal was properly installed to prevent oil intrusion into the switch housing. The licensee entered this violation into its corrective action program for evaluation and identification of appropriate corrective actions. The licensee replaced the EOS and revised the maintenance procedure and work order guidance for proper oil seal installation on the EOS. The finding was of more than minor safety significance because it was associated with the Equipment Performance at tribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the EO S failure during surveillance testing due to oil intrusion resulted in unplanned inoperability and unavailability of an onsite emergency power source. The finding was determined to be of very low safety significance because it did not represent an actual loss of function of a single train for greater than its Technical Specification (TS) allowed outage time nor did it represent a loss of function of a non- TS train designated as high safety significant in accordance with the licensees Maintenance Rule Program . The inspectors concluded this finding affected the cross - cutting area of human performance and the cross -cutting aspect of documentation. Plant activities are governed by comprehensive, high- quality, programs, processes and procedures. In this case , the licensee determined its maintenance procedure and work order guidance were not adequate to ensure the EOS oil seal and upper air start distributor gasket were properly installed to prevent oil leakage from the air start distributor from getting into the EOS housing. (IMC 0310, H.7) |
| 05000266/FIN-2017002-01 | Point Beach | 2017Q2 | Failure to Evaluate Operating Experience | Green . A finding of very low safety significance was self -revealed f or the failure to follow program description PI AA 102, Operating Experience Program, Revision 3. Specifically, the licensee failed to evaluate operating experience that applied to Point Beach that identified the potential for cable connectors to disconnect due to machine vibration. PI AA 102, Section 5, Instructions, Step 5.1(3), Screening Operating Experience Items, states, If the initial screening indicates potential applicability to a NextEra Energy nuclear plant, program (including corporate administered programs), policy, process, or procedure; then an evaluation is conducted. Subsequently, a disconnected magnetic speed sensor cable on the G 04 emergency diesel generator caused a failure during a surveillance run attempt. The licensees short -term corrective actions included reconnecting the G 04 emergency diesel generator ( EDG ) magnetic speed senor cable and installing lock -wire to prevent the connector from unintentionally disconnecting. The licensees long- term corrective actions included changing their maintenance procedures to check connector tightness on the diesels periodically. The inspectors determined that the failure to evaluate the external operating experience was contrary to licensee program descript ion PI AA 102 and was a performance deficiency. The finding was determined to be more than minor because the failure to evaluate operating experience was associated with the Mitigating Systems cornerstone attribute of Equipment Reliability and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e. core damage). The inspectors applied IMC 0609, Attachment 4, Initial Characterization of Findings, issued October 7, 2016, to this finding. The inspectors answered Yes to question A within Table 3, Significance Determination Process Appendix Router, and transitioned to IMC 0609, Appendix G , Attachment 1, Shutdown Operations Significance Determination Process Phase 1 Initial Screening and Characterization of Findings, dated May 9, 2014 . The in spectors referenced Exhibit 3Mitigating Systems Screening Questions. The finding screened as of very low safety significance (Green) because the inspectors answered No to the screening questions. The inspectors did not identify a cross -cutting aspect. The cause of the finding occurred in 2012 and was not reflective of present performance. |