Semantic search

Jump to: navigation, search
Search

Edit query Show embed code

The query [[Category:Finding]] [[System::Reactor Protection System]] was answered by the SMWSQLStore3 in 0.5209 seconds.


Results 1 – 50    (Previous 50 | Next 50)   (20 | 50 | 100 | 250 | 500)   (JSON | CSV | RSS | RDF)
 SiteQuarterTitleDescription
05000298/FIN-2018011-01Cooper2018Q2Failure to Correct Extent of Condition of Surge Suppression Varistor FailuresAn NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion XVI, Corrective Action, occurred when the licensee failed to correct conditions adverse to quality associated with the corrective actions identified in Condition Report RCR 2002-1665 to verify that installed surge suppressor varistors were appropriately sized and that design information was correctly reflected in controlled drawings for the reactor protection system, diesel generator control circuits, and high pressure coolant injection control circuits.
05000331/FIN-2018002-01Duane Arnold2018Q2Inappropriate Procedural Guidance Resulted in Loss of Scram Function and Failure to Enter Technical Specification Limiting Condition for OperationThe inspectors identified a finding of very low safety significance (Green) and a non-cited violation of 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the failure to have procedures appropriate to the circumstance for testing the main steam isolation valve (MSIV) and turbine stop valve (TSV) closure functions. Specifically, STP 3.3.1.117, MSIV Functional Test, and STP 3.3.1.119, Main Turbine Stop and Combined Intermediate Valves Test, directed the use of a reactor protection system test box which disabled the MSIV and the TSV closure automatic reactor scram functions while testing specific combinations of MSIVs and TSVs and failed to require entry into appropriate Technical Specification Limiting Condition for Operation action statements.
05000390/FIN-2018010-01Watts Bar2018Q1Potential Failure to Request NRC Approval to Increase the OPT and OTT Response TimesThe reactor trips that protect from fuel damage that could result from departure from nucleate boiling around the fuel are identified as over-temperature-change-in-temperature (OTT) and over-power-change-in-temperature (OPT). The trips use the temperature from the reactor coolant systems hot legs as inputs into complex equations. In 1991, the licensee requested a license amendment to upgrade the Temperature Averaging System (TAS) and protection system to digital technology (Eagle 21 protection system). The Westinghouse topical reports (TR) for the TAS and Eagle 21 was reviewed and the TAS was approved with conditions for the RTD response times, electronic delay times, and surveillance test uncertainties in NUREG 847, the Safety Evaluation Report (SER), Supplement 8 dated January 1992. The SER specified, that the overall response time (RTD response time plus electronics delay) for the new RdF RTDs is 0.5 second longer (6.5 vs. 6.0 seconds) than the former Rosemount RTDs. This leaves a margin of 0.5 second (7.0-6.5) between the analysis and overall RTD response time. The breakdown of components used to arrive at the overall response time is 5.5 seconds for the RTD/thermowell and a conservative electronics delay of 1.0 second. The applicant stated that it will use the loop current step response (LCSR) test to measure RTD response time. A 10-percent allowance for LCSR test uncertainty will be used to ensure an overall channel response time of 7.0 seconds or less. ...During initial startup testing, actions will be taken to correct any resistance temperature detector (RTD) channel with an overall response time of greater than 7.0 seconds including electronics delay and a 10-percent allowance for loop current step response test uncertainty. After any such corrective action, the channel will be retested to verify an overall response time of 7.0 seconds or less (the value assumed in pertinent safety analyses). In 1997, licensee Design Change Notice (DCN) 39293 was implemented to increase the RTD response time. It stated, the response time requirement for OPT reactor trip was increased from 7 seconds to 8 seconds. This time includes RTDs, electronic processing, and trip circuit delays. As a result, the allowance for the sensor response time can be increased from 5.5 to 6.5 seconds. The Reactor Protection System Description, N3-99-1003, and the Technical Requirements Manual (TRM) were revised to reflect the change in response time for this channel. The change appeared to account for the 1.0 second electronic delay, but did not appear to account for the 10-percent allowance for LCSR test uncertainty, which would be derived from the RTD/thermowell delay. The uncertainty margin would appear to increase from 0.5 to 0.6 seconds. This change was implemented without NRC review and approval. In 2015, during hot functional testing of Unit 2 TAS RTDs, the RTD/thermowell delay did not meet the 6.5s required by the TRM from the change in 1997. On May 23, 2015, DCN 66327 was implemented to increase the response time again. The DCN stated, this DCN increases the total Narrow Range RTD response time from 8 to 9 seconds while changing the sensor response time from 6.5 to 8 seconds. Westinghouse has evaluated this change in letter WBT-D-5476 and determined that existing analyses are not impacted by this change. In this new response time the 1.0 second electronic delay and 8 second RTD/thermowells delay appeared to be accounted for, but not the margin for LCRS test uncertainty. If the 10-percent allowance for LCSR test uncertainty were accounted for, the total response time would appear to increase to 9.8 seconds. Westinghouse used a total response time of 9.0 seconds for their analyses at the direction of TVA, per WBT-TVA-3027, Revision 0, (5.10) PIN ELICB-055 Evaluation to Support a 9.0-second Total RTD Response Time, August 2015. The 10 percent LCSR uncertainty does not appear to have been included. Westinghouse letter LTR-TA-15-92, Transient Analysis Evaluation of an Increased RTD Delay Time for Watts Bar Unit 2, Rev. 0, stated, in part, due to the limiting nature of the (Steam Line Break) SLB w/ (Rod Withdrawal at Power) RWAP event, in which no margin currently exists to the departure from nucleate boiling ratio (DNBR) safety analysis limit (SAL), the inclusion of a 9.0-second total RTD response time resulted in a 0.55% DNBR penalty. For the feed water event, defined as a reduction in feedwater temperature, the Westinghouse letter stated, in part, key event results for both of the multiple-loop cases were impacted by the delay in receiving the OPT trip. While substantial margin was maintained to the DNBR limit of 1.38, the peak core heat flux values slightly exceeded the limit value of 121%. The letter concluded that the slower responding RTDs did not significantly impact the non-LOCA transient analyses and that the acceptance criteria for the events continued to be met, with the exception of the SLB w/ RWAP. However, generic DNB margin will be allocated to offset the 0.55% DNBR penalty associated with the evaluation. As such, the non-LOCA transient analyses can support operation of Watts Bar Unit 2 with a total RTD delay time of up to 9.0 seconds. The inspectors questioned the licensee to understand why the 10-percent allowance for LCSR test uncertainty was not accounted for in the Westinghouse analyses, and to what extent it could have affected the results. In addition, the inspectors questioned whether the 10-percent uncertainty was adequate in the current installation configuration. The inspectors also questioned how the LCSR test could account for increased thermal resistance between the RTDs and the thermowells. The test may not measure the actual delay time from the hot leg across the thermowell thermal resistance to RTD. The original installations relied on specific RTD thermowell bonding to establish a predictable thermal resistance and initial response time. It is unclear how this was performed for this installation to determine the actual response time. The 10 CFR 50.59 evaluation was performed May 22, 2016. This issue has been captured in the Corrective Action Program (CAP) as CR 1398934, Potential failure to request lic. amendment to change OPdT/OTdT response time
05000254/FIN-2018001-03Quad Cities2018Q1Half Scram Due to Low Voltage on 24/48 Vdc SystemA finding of very low safety significance (Green) and a Non-Cited Violation of Technical Specification 5.4.1, Procedures, was self-revealed on January 11, 2018, for the licensees failure to perform an equalizing charge on the Unit 1B 24/48 Vdc battery prior to returning the 24/48 Vdc battery to a normal configuration following a test discharge, which was required by station procedures. The failure to follow procedures led to a low voltage condition and caused a Unit 1B channel half scram in the reactor protection system.
05000220/FIN-2018001-01Nine Mile Point2018Q1Potential Failure to Submit an 8-Hour Event Notification for a Valid Actuation of HPCOn March 18, 2018,at 1:18 a.m., during the Unit 1maintenance outage while the unit was in cold shutdown, operators received multiple low level alarms on the GEMAC 11 and 12 level indications. Operators responded by adjusting reactor water cleanup reject flow and the feedwater minimum flow control valve to raise reactor water level. Upon the operators making the adjustment to reactor water level, the feedwater low flow control valve was slow to respond, but eventually opened more rapidly, and the increased flow from feedwater resulted in a rapid rise in reactor water level. At 1:28 a.m., indicated reactor water level rose to the 95-inch trip setpoint for the 11 and 12 Yarway level indication instruments, resulting in a turbine trip and HPCI initiation signal. The HPCI pumps were tagged out and thus did not inject, and the turbine was offline for the shutdown. The 11 and 12 Yarway level indication instruments provide reactor protection system logic inputs for reactor vessel water level; however, the Yarway level indication instruments are not density compensated. Therefore, under cold shutdown conditions, actual reactor vessel water level was lower than indicated water level on the 11 and 12 Yarways. During cold shutdown conditions, the GEMAC level instruments, which are calibrated to cold shutdown conditions, provide an accurate indication of actual reactor vessel water level. The GEMAC instruments both indicated well below the trip setpoint of 95 inches (indicated ~72 inches) when the turbine trip and HPCI initiation signal were received. Exelon determined that this event was not reportable under 10 CFR 50.72.Title 10 CFR 50.72(b)(3)(iv)(A) states, Any event or condition that results in valid actuation of any of the systems listed in paragraph (b)(3)(iv)(B) of this section, except when the actuation results from and is part of a pre-planned sequence during testing or reactor operation. (B) The systems to which the requirements of paragraph (b)(3)(iv)(A) of this section apply are: 10 (5) BWR reactor core isolation cooling system; isolation condenser system; and feedwater coolant injection system. Planned Closure Action(s): The inspectors requested the 10 CFR 50.72 subject matter experts at the Office of Nuclear Reactor Regulation (NRR) and Office of General Council (OGC) to review whether this was a valid actuation and thus reportable. The inspectors are opening an unresolved item (URI) to determine if a performance deficiency exists.Licensee Action(s): Licensee entered the concern into their corrective action program, and communicated with NRC Region I and NRR Staff. Exelons position is that the event was not reportable. Corrective Action Reference:IR 04116336 NRC Tracking Number: 05000220/2018001-01
05000263/FIN-2018001-02Monticello2018Q1Licensee-Identified ViolationViolation: Title 10 CFR 50.59(d)(1) requires, in part, that the licensee maintain records of changes to the facility, of changes in procedures, and of tests and experiments made pursuant 10 CFR 50.59(c).These records must include a written evaluation which provides the bases for the determination that the change, test, or experiment does not require a license amendment pursuant to Paragraph (c)(2) of this section.Title 10 CFR 50.59(c)(2)(ii) requires that a licensee shall obtain a license amendment pursuant to 10 CFR 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the Final Safety Analysis Report (FSAR) (as updated).Technical Specification (TS) 3.3.1.1, Reactor Protection System (RPS) Instrumentation, states the RPS instrumentation for each function in Table 3.3.1.11 shall be operable. As specified in Table 3.3.1.11, Function 5, Main Steam Isolation Valve (MSIV) - Closure (8 channels) and Function 8, Turbine Stop Valve (TSV) Closure (4 channels) are required to be operable in Mode 1. TS 3.3.1.1, Condition C.1 states with one or more functions with RPS trip capability not maintained, to restore RPS trip capability in 1 hour and was applicable to both the MSIV and TSV RPS logic functional testing.Contrary to the above, on March 7, 2009 and July 11, 2009, the licensee failed to perform and maintain a written evaluation as required by 10 CFR 50.59(d)(1) to demonstrate a change to its facility did not require a license amendment. Specifically, the licensee incorrectly concluded in its 10 CFR 50.59 evaluation SCR080319, dated September 29, 2008, that no license amendment was required prior to implementing two surveillance test procedures; 0009 Turbine Stop Valve Closure Scram Test Procedure, Revision 16 on March 7, 2009 and; 0008 Main Steam Line Isolation Valve Closure Scram Test Procedure, Revision 20 on July 11, 2009. The test fixture was applied during quarterly surveillance testing through September 16, 2017.Implementation of procedures 0008 and 0009, respectively, resulted in the loss of RPS trip Function 5 (MSIV) and Function 8 (TSV) by bypassing more than the TS minimum allowed inputs per channel to maintain functionality, thereby violating the requirements of TS 3.3.1.1. Loss of these functions resulted in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the FSAR (as updated) as specified by 10 CFR 50.59(c)(2)(ii).On November 14, 2017, the licensee generated CAP 501000005391 after conducting an operating experience evaluation of a similar event at another station concluding the event was applicable to the Monticello Plant. The surveillance procedures were immediately quarantined and subsequently revised on December 8, 2017 and December 11, 2017, to remove the use of the RPS test fixture.Significance/Severity Level:Using IMC 0609, Appendix A, Exhibit 2, the inspectors determined this finding was of very low safety significance (Green) because it did not affect a single RPS trip signal to initiate a reactor scram and the function of other redundant trips or diverse methods of reactor shutdown.The ROPs significance determination process does not specifically consider the regulatory process impact in its assessment of licensee performance. Therefore, it is necessary to address this violation which impedes the NRCs ability to regulate using traditional enforcement to adequately deter non-compliance. In accordance with Section 6.1.d.2 of the NRC Enforcement Policy, this violation was categorized as Severity Level IV The disposition of this violation closes LER 05000263/201700600.Corrective Action Reference: 501000005391
05000410/FIN-2018001-02Nine Mile Point2018Q1Potential Inadequate 50.59 Evaluation for TS 3.3.1.1 Bases ChangeOn February 23, 2018, Exelon personnel performed a 50.59 Screening for a change to Unit 2 TS Bases 3.3.1.1, Reactor Protection System (RPS) Instrumentation, for MSIV and TSV surveillance testing. Exelon personnel performed this activity to address operating experience associated with the use of a test box that prevents a scram signal during RPS surveillance testing for TS 3.3.1.1 Function 5 MSIV Closure and Function 8 TSV Closure. TS Bases B 3.3.1.1, C.1, Revision 1 was revised to state, in part, For Function 5 (MSIV Closure), this would require both trip systems to have at least one channel associated with the MSIVs for each main steam line in one Trip Logic Channel (not necessarily the same main steam lines for both trip systems), Operable or in trip (or the associated trip system in trip). For Function 8 (Turbine Stop Valve Closure), this would require both trip systems to have the channels for one Trip Logic Channel, Operable or in trip (or the associated trip system in trip).The inspectors questioned whether the change to TS Bases B 3.3.1.1 resulted in a change to the implementation of TS 3.3.1.1. A licensee is permitted to make changes to their Technical Specification Bases documents without NRC review and approval. However, in certain cases, such as a change to the Technical Specification Bases that would change how the associated Technical Specification is applied, NRC review and approval would be required.Planned Closure Action(s): The inspectors sent written questions to request assistance from NRR to determine whether this change to the TS Bases reasonably would have required NRC review and approval. The inspectors are opening a URI to determine if this is violation of 10 CFR 50.59 and if it is more than minor. Licensee Action: Documented NRCs concern as AR 04055602. Exelons position is the change would not affect how TS 3.3.1.1, or its note, is applied and therefore NRC review was not required.Corrective Action Reference: AR04055602 NRC Tracking Number: 05000410/2018001-02
05000335/FIN-2017004-01Saint Lucie2017Q4Inadequate Reactor System Trip Process for Inoperable Channel Results in Operation in a Condition Prohibited by Technical SpecificationsA Green, self-revealing NCV of 10 Code of Federal Regulations (CFR) Part 50, Appendix B, Criterion V, Instructions, Procedures and Drawings, was identified for the licensees failure to have an adequate procedure for reducing the trip setpoint of the B channel of the reactor protection system (RPS) high startup rate (HSUR) bistable. The licensees failure to establish an adequate procedure, as required by 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, to place the "B" channel wide range nuclear instrument in a tripped condition was a performance deficiency (PD). This deficiency resulted in a violation of Technical Specification (TS) Limiting Condition for Operation (LCO) 3.3.1.1. Following discovery of the condition, the licensee initiated immediate corrective actions to place the B channel RPS HSUR in trip, meeting the TS requirement. The inspectors determined that the finding was more than minor because it was associated with the Mitigating Systems cornerstone attribute of procedural quality and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, there was no procedure to perform the setpoint reduction method as identified in 1-AOP-99.01. The only direction was to Contact I&C in the step. The Instrumentation and Control (I&C) processes used to implement the HSUR reduced setpoint reduction method were inadequate, in that, they did not evaluate all potential failure conditions when setting the HSUR bistable. The finding did not screen as greater than Green because while the degradation affected a single RPS trip signal, it did not affect the function of other redundant trips; and the finding did not involve control manipulations that unintentionally added positive reactivity; and finally the finding did not result in a mismanagement of reactivity by operators. Using IMC 0310, Aspects Within the Cross-Cutting Areas, the inspectors determined that the finding had a cross-cutting aspect in the area of human performance. Specifically, the cross- cutting aspect of resources (H.1) was assigned to the finding because the licensee did not ensure an adequate procedure was available to implement the HSUR setpoint reduction.
05000321/FIN-2017003-01Hatch2017Q3Installation of Non-Conforming RPS EquipmentAn NRC-identified non-cited violation (NCV) of 10 CFR 50, Appendix B, Criterion III, Design Control was identified for failure to translate regulatory requirements and the design basis of the scram discharge volume (SDV) thermal probes into the System Evaluation Document, which resulted in the installation of a nonsafety-related terminal board in the reactor protection system (RPS). As an immediate corrective action the licensee installed fully qualified equipment. The failure to classify reactor protection system components as safety-related in accordance with design documents was a performance deficiency. The violation was entered into the licensee's corrective action program as CR 10344772.The performance deficiency was more than minor because it affected the design control attribute of the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the ensured reliability of the RPS system wasadversely affected because the installed components were not qualified for the application. The team used IMC 0609, Attachment 4, Initial Characterization of Findings, issued June 19, 2012, for Mitigating Systems, and IMC 0612, Appendix A, The Significance Determination Process for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green), because the finding was a deficiency affecting the design or qualification of a mitigating SSC, and the SSC maintained its operability. The inspectors determined that this finding did not have an associated cross-cutting aspect because this finding did not occur within the previous three years and is not reflective of current licensee performance.
05000255/FIN-2017003-02Palisades2017Q3Cause of 422/RPS Breaker Failure to OpenIntroduction: The inspectors identified an URI associated with the failure mechanism of the 42 -2/RPS control rod clutch breaker failure to open. Specifically, at the end of the inspection period the licensee was working to understand the cause of the breaker failure and determine the actions required to address the failure mechanism. Description : On May 17, 2017, the licensee conducted a shutdown to complete emergent repairs to a leaking seal identified on control rod drive mechanism 40. In accordance with GOP 8, Power Reduction and Plant Shutdown to Mode 2 or Mode 3 525 F, the operators depressed the reactor trip pushbutton from the EC 06, reactor protection system panel. When the pushbutton was depressed, the reactor did not trip as expected. The operators successfully tripped the reactor using the reactor trip pushbutton on the EC 02, primary process and reactor controls console. The licensee identified that the 42 1/RPS breaker tripped as expected when the reactor trip pushbutton on the EC 06 panel was depressed, however, the 42 2/RPS breaker did not trip as expected. This resulted in the reactor trip not occurring as expected when the reactor trip pushbutton on the EC 06 panel was depressed as both breakers a re required to open to result in a reactor trip. The licensee performed troubleshooting activities to determine the cause of the 42 2/RPS breaker failure. The direct cause of the breaker failure was found to be the 42 2/RPS breaker undervoltage release mechanism failing to provide enough downward force to fully depress the trip plunger. This resulted in a physical failure of the breaker to open. At the end of the inspection period, the cause of this physical failure mode was unknown. The licensees equipment failure evaluation identified that it could be age- related degradation or a physical degradation of the breaker. As a corrective action, a failure analysis of the breaker was planned. Once the failure analysis i s complete, the licensee plans to re-assess the failure mechanism and determine any additional corrective actions that are required to address the issue. This item is considered unresolved, pending the inspectors review of the failure analysis and any changes made to the equipment failure evaluation, to determine if this issue constitutes a performance deficiency and/or violation of NRC requirements. (URI 05000255/2017003 02, Cause of 42 2/Reactor Protection System Breaker Failure to Open)
05000397/FIN-2017003-02Columbia2017Q3Failure to Report Unplanned Valid Reactor Protection System ActuationThe inspectors identified a Severity Level IV, non- cited violation of 10 CFR 50.72(b)(3)(iv)(A) for the licensees failure to submit an event notification to the NRC 3 within 8 hours of occurrence of an unplanned valid reactor protection system actuation of the reactor protection system. Specifically, the licensee did not report are actor protection system Level 3 scram actuation when reactor vessel level dropped below +13 inches until prompted by the inspectors. The licensee subsequently restored compliance and reported the event in accordance with 10 CFR 50.72(b)(3)(iv)(A) on August 24, 2017, as an update to Emergency Notification System Report 52918 and entered the issue into their corrective action program as Action Request 370529 . The licensees failure to submit the event notification was a violation that impacted the regulator y process and warrants treatment using traditional enforcement . In accordance with Section 2.2.4 and the example in Section 6.9.d.9 of the NRC Enforcement Policy, dated November 1, 2016, the violation was determined to be a Severity Level IV violation. Traditional enforcement violations are not assessed for cross- cutting aspects.
05000250/FIN-2017007-10Turkey Point2017Q3Potential failure of 125 Vdc Bus 3B Class 1E componentsUFSAR Section 8.2.2.3.1 stated that the emergency power for vital instrumentation and controls is supplied by a station DC power system which contains five safety related 125Vdc batteries and four DC distribution panels. 125 Vdc distribution panel 3B supplies safety related power to several safety-related equipment including sequencers, reactor trip switchgear, inverter 3Y06, and control power to 480Vac load centers 3B and 3D and 4160 Vac switchgears 3AB01 and 4AB20. UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279- 1968. Section 4.5 of IEEE 279-1968, Channel Integrity, requires all protection system channels be designed to maintain necessary functional capability under extremes of conditions relating to malfunctions. During the review of calculation 5177-265-EG-22, Circuit Breaker/Fuse Coordination Study, Rev. 8, the team questioned if there were instances where class 1E cables associated with DC Bus 3B (3D23) would not be adequately protected given a short circuit on the load side of the breakers. The failure to ensure the Class 1E protective devices would not allow the maximum available short circuit to permanently damage cabling to safety-related equipment associated with DC Bus 3B could result in additional loss of Class 1E equipment. Unresolved Item (URI) 05000250/2017007-01 and 05000251/2017007-01, Potential failure of 125 Vdc Bus 3B Class 1E components,) is opened for additional review to determine if the Class 1E cables on DC Bus 3B can withstand the maximum possible short circuit and to determine if a performance deficiency exists.
05000416/FIN-2017002-05Grand Gulf2017Q2Licensee-Identified ViolationTitle 10 CFR 50.72(b)(2)(iv)(B) requires, in part, the licensee shall notify the NRC as soon as practical , and in all cases within 4 hours of the occurrence, of any event or 24 condition that results in actuation of the reactor protection system (RPS) when the reactor is critical. Contrary to the above, on April 4, 2017, the licensee did not notify the NRC within 4 hours of the occurrence of any event or condition that resulted in actuation of the RPS when the reactor was critical. Specifically, the licensee failed to notify the NRC within 4 hours after they performed a manual scram of the reactor due to a failure in the condensate system. The NRCs significance determination process is not designed to assess the significance of violations that impact or impede the regulatory process. Therefore, the issue of an untimely notification was assessed using the traditional enforcement process in accordance with the Enforcement Policy. The inspectors determined the violation to be at Severity Level IV in accordance with Enforcement Policy Section 6.9.d.9. Since this issue was entered into the licensees corrective action program as Condition Report CR -GGN -1-2017 -03331, compliance was restored within a reasonable period of time, the violation was not repetitive, and the violation was not willful, this violation is being treated as a non-cited violation (NCV), consistent with Section 2.3.2.a of the Enforcement Policy. Traditional enforcement violations are not assigned a cross -cutting aspect.
05000263/FIN-2017002-01Monticello2017Q2Low Reactor Water Level During Shutdown of 11 Reactor Feedwater PumpA self-revealed finding of very-low safety significance and a Non-Cited Violationof Technical Specification 5.4.1.a occurred on April 15, 2017, due the licensees failure to establish, implement and maintain procedures regarding shutdown operations. Specifically, Operations Manual B.06.05-05 did not account for the state of the opposite train of feedwater when shutting down the 11 Reactor Feedwater Pump. Licensee use of the inadequate procedure placed equipment in a configuration where no condensate flow path to the reactor existed causing reactor water level to lower to a point where trip/isolation set-points were reached. This caused an unplanned Reactor Protection System (RPS) trip and Partial Group II Isolation. The licensee initiated Corrective Action Program (CAP) 1555785 to document the reactor water level transient, RPS trip and Partial Group II Isolation. Immediate corrective actions includedopening the 11 Reactor Feedwater Pump discharge valve to restore reactor water level allowing reset of the Group II isolation and RPS trip. Subsequent licensee actions included development of expectations via an Operations Memo and revision to Operations Manual B.06.0505 as well as Procedure 2204 and Procedure 2167 to ensure abnormal equipment lineups are addressed such that unexpected procedure interactions are avoided.The inspectors determined the failure to establish, implement and maintain procedures regarding shutdown operations as required by Technical Specification 5.4.1.a was a performance deficiency that required an evaluation. The inspectors assessed the significance of this finding using IMC 0609, Attachment 4, and IMC 0609, Appendix A, Exhibit 1, Section B, and determined a detailed risk evaluation was required because the finding caused a reactor trip and loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition (e.g., loss of feedwater). A Senior Reactor Analyst performed a detailed risk evaluation using bounding assumptions and the change in Core Damage Frequency was calculated to be 9E7/year (Green). The inspectors determined that the contributing cause that provided the most insight into the performance deficiency was associated with the cross-cutting area of Human Performance, Change Management aspect, because licensee leaders did not use a systematic process for evaluating and implementing change so that nuclear safety remains the overriding priority.
05000352/FIN-2017002-03Limerick2017Q2Licensee-Identified ViolationLER 05000352/2017-003-00 Condition Prohibited by Technical Specifications Due to an Inoperable Rod Position Indication System. TS 3.1.3.7 requires, in part, with one or more control rod position indicators inoperable, within 1 hour, determine the position of the control rod by using an alternate method, or otherwise, be in at least hot shutdown within the next 12 hours. Contrary to the above, on March 16, 2017, a power supply for the Unit 1 rod position indication system rendered position indication for 83 control rods inoperable for approximately 19.5 hours until the power supply was replaced. Exelon incorrectly used the full core display to verify control rod position for 81 of the 83 rods. The power supply failure rendered the full core display incapable of updating in response to a rod position change and was, therefore, not a valid means to determine rod position. Exelon initiated condition report IR 3988302 to document the TS violation. The inspectors evaluated the significance of this finding using IMC 0609 Appendix A, Significance Determination Process for Findings at Power, Exhibit 2, Mitigating Systems Screening Questions. The inspectors determined that this finding was of very low safety significance (Green) because the issue did not affect a single reactor protection system trip signal or the function of the other redundant trips or diverse methods of reactor shutdown, did not involve addition of positive reactivity, and did not result in mismanagement of reactivity by operators. Because this issue was of very low safety significance (Green) and Exelon entered the issue into the corrective action program (IR 3988302), this finding is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy.
05000341/FIN-2017002-03Fermi2017Q2Licensee-Identified ViolationTitle 10 CFR 50.59(d)(1) requires, in part, that the licensee maintain records of changes to the facility, of changes in procedures, and of tests and experiments made pursuant 10 CFR 50.59(c). These records must include a written evaluation which provides the bases for the determination that the change, test, or experiment does 38 not require a license amendment pursuant to Paragraph (c)(2) of this section. 10 CFR 50.59(c)(2)(ii) requires that a licensee shall obtain a license amendment pursuant to 10 CFR 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the FSAR (as updated). Technical Specification (TS) 3.3.1.1, Reactor Protection System Instrumentation, states the RPS instrumentation for each function in Table 3.3.1.1 1 shall be operable. As specified in Table 3.3.1.1 1, Function 5, Main Steam Isolation Valve - Closure (8 channels) and Function 9, Turbine Stop Valve - Closure (4 channels) are required to be operable in Mode 1. TS 3.3.1.1, Required Action C.1 states with one or more functions with RPS trip capability not maintained to restore RPS trip capability in 1 hour. Condition C was applicable to both the main steam isolation valve and turbine stop valve RPS logic functional testing. Contrary to the above, on or about August 19, 2016, the licensee failed to perform and maintain a written evaluation as required by 10 CFR 50.59(d)(1) to demonstrate a change to its facility did not require a license amendment. Specifically, the licensee incorrectly concluded no license amendment was required in its 10 CFR 50.59 evaluation prior to implementing surveillance test procedures 24.110.05, RPS Turbine Control and Stop Valve Functional Test, Revision 44 and 24.137.01, Main Steam Line Isolation Channel Functional Test, Revision 40. The revised procedures incorporated a change that resulted in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the FSAR (as updated) as specified by Section (c)(2)(ii). Specifically, the use of the test box resulted in the loss of two RPS trip functions by bypassing m ore than the TS minimum allowed inputs per channel to maintain functionality, violating the requirements of TS 3.3.1.1 during testing on September 22 and 23, 2016. In accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, Table 3, SDP Appendix Router, the inspectors determined this finding affected the Mitigation Systems Cornerstone, specifically the Reactivity Controls Systems contributor , and would require review using IMC 0609, Append ix A, The Significance Determination Process (SDP) for Findings At -Power, June 19, 2012. The inspectors performed a Phase 1 SDP review of this finding using the guidance provided in IMC 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions, and determined this finding was a licensee performance deficiency of very low safety significance ( Green ) because it did not affect a single RPS trip signal to initiate a reactor scram AND the function of other redundant trips or diverse methods of reactor shutdown. Violations of 10 CFR 50.59 are dispositioned using the traditional enforcement process because they are considered to be violations that potentially impede or impact the regulatory process. This violation was also associated with a finding t hat has been evaluated by the SDP and communicated with a SDP color reflective of the safety impact of the deficient licensee performance. The SDP, however, does not specifically consider regulatory process impact. Thus, although related to a common regulatory concern, it is necessary to address the violation and finding using different processes to correctly reflect both the regulatory importance of the violation and the 39 safety significance of the associated finding. In accordance with Section 6.1.d.2 o f the NRC Enforcement Policy, this violation was categorized as Severity Level IV. This violation was entered into the licensees corrective action program as CARD 17 20163.
05000298/FIN-2017001-06Cooper2017Q1Failure to Install Correct Mechanical Stop and Verify Proper OperationThe inspectors reviewed a self-revealed, non-cited violation of Technical Specification 3.0.4 for the licensees failure to install the correct reactor core isolation cooling pressure control valve, RCIC-AOV-PCV23, mechanical stop and verify proper operation of the system prior to entering a mode of applicability for Technical Specification 3.5.3. This condition resulted in RCIC-AOV-PCV23 going fully open during surveillance testing following Refueling Outage 29, causing a pressure transient. This transient caused a failure of the reactor core isolation cooling turbine lube oil cooler gasket, lifting of a pressure relief valve, and a water leak. The licensee immediately shut down the reactor core isolation cooling system and declared it inoperable. The immediate corrective actions were to restore RCIC-AOV-PCV23 from the closed mechanical stop to the required open mechanical stop and to replace the turbine lube oil cooler gasket to restore operability of the system. The licensee entered this deficiency into the corrective action program as Condition Report CR-CNS-2016-08122 and initiated a root cause evaluation to investigate this condition. The licensees failure to install the correct reactor core isolation cooling pressure control valve, RCIC-AOV-PCV23, mechanical stop and verify proper operation of the system prior to entering a mode of applicability for Technical Specification 3.5.3, in violation of Technical Specification 3.0.4, was a performance deficiency. The performance deficiency was determined to be more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events. Specifically, the licensee installed RCIC-AOV-PCV23 with the incorrect mechanical stop, and proper valve operation was not verified after installation during Refueling Outage 29, which caused the reactor core isolation cooling system to lose function during surveillance testing. This transient caused a failure of the reactor core isolation cooling turbine lube oil cooler gasket and an associated water leak. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, the inspectors determined that the finding required a detailed risk evaluation because it represented a loss of system and/or function. In the detailed risk evaluation, the analyst assumed the reactor core isolation cooling system was unavailable for 50 hours. The analyst used the Test/Limited Use Version COOPER-DEESE-HCI03 of the Cooper SPAR model run on SAPHIRE, Version 8.1.5. The analyst updated the initiating event frequencies for transients, losses of condenser heat sink, losses of main feed water, grid related losses of offsite power, and switchyard centered losses of offsite power to the more recent values from the 2014 update to the industry data found in INL/EXT-14-31428, Initiating Event Rates at U.S. Nuclear Power Plants, 1998-2013, Revision 1. From this, the finding was determined to have an increase in core damage frequency of 8.4E-8/year and to be of very low safety significance (Green). Transients, losses of condenser heat sink, and losses of main feed water were the dominant core damage sequences. The automatic depressurization system and the reactor protection system remained to mitigate these sequences. The finding had a cross-cutting aspect in the area of human performance associated with documentation because the licensee failed to create and maintain complete, accurate, and up-to-date documentation associated with RCIC-AOV-PCV23 design drawings and the maintenance procedure for setting and testing the mechanical stop (H.7).
05000416/FIN-2017001-02Grand Gulf2017Q1Grand Gulf Unplanned Power Changes per 7000 Critical Hours Performance IndicatorThe inspectors identified an URI associated with the unplanned power changes per 7000 critical hours performance indicator related to events that occurred on June 17, 2016. Description. On June 17, 2016, during turbine stop valve testing, stop valve B was to be cycled closed. Upon performing that action, stop valve B closed as expected; however, stop valve D unexpectedly closed. In response to the unexpected valve closure, the electro-hydraulic control trip fluid pressure fluctuated at an increased rate which caused the turbine control valves to cycle. This valve cycling resulted in numerous unplanned reactor pressure and power changes for approximately 42 minutes. During this time, operations personnel repeatedly performed troubleshooting activities by attempting to reset the stop valves, which caused additional system instability and increased the magnitude of the power oscillations. Ultimately, operations personnel decided to insert control rods in an attempt to stabilize the power and pressure oscillations. The operator action to insert control rods failed to stabilize the power and pressure oscillations, and approximately 1 minute later, an automatic reactor scram occurred due to a valid oscillating power range monitor input to the reactor protection system. This event was documented in Licensee Event Report 05000416/2016004-00, and NRC Inspection Reports 05000416/2016002 and 05000416/2016003. The unplanned power changes per 7000 critical hours performance indicator measures the rate of unplanned power changes per year of operation at power and provides an indication of initiating event frequency. The licensee did not include any unplanned power changes as inputs into this performance indicator for the second quarter of 2016. The inspectors questioned whether any unplanned power changes should have been reported with this performance indicator, and the licensee submitted a frequently asked question (FAQ) to the NRC reactor oversight process working group (ADAMS Accession No. ML17100A235, 03/23/2017 Reactor Oversight Process Working Group Public Meeting). This FAQ (FAQ 17-01) is currently under review to determine whether the above events should be captured as inputs to the unplanned power changes performance indicator. The inspectors concluded that additional inspection would be required to assess whether the unplanned power changes should have been reported in the unplanned power changes per 7000 critical hours performance indicator. This issue was identified as URI 05000416/2017001-02, Grand Gulf Unplanned Power Changes per 7000 Critical Hours Performance Indicator.
05000293/FIN-2017001-01Pilgrim2017Q1Concern Regarding Ability to Declare EALs during Loss of Control Room Air ConditioningInspection Scope The inspectors reviewed the samples listed below to assess the effectiveness of maintenance activities on structure, system, and component (SSC) performance and reliability. The inspectors reviewed system health reports, CAP documents, maintenance WOs, and maintenance rule (MR) basis documents to ensure that Entergy was identifying and properly evaluating performance problems within the scope of the MR. For each sample selected, the inspectors verified that the SSC was properly scoped into the MR in accordance with 10 CFR 50.65 and verified that the (a)(2) performance criteria established by Entergy staff was reasonable. As applicable, for SSCs classified as (a)(1), the inspectors assessed the adequacy of goals and corrective actions to return these SSCs to (a)(2). Additionally, the inspectors ensured that Entergy staff was identifying and addressing common cause failures that occurred within and across MR system boundaries. HPCI stop valve grease on February 17, 2017 (quality control) Main control room ventilation the week of March 6, 2017 9 b. Findings Introduction. The inspectors identified that Entergy made alterations on February 2, 2017, to procedure 2.4.149, Loss of Control Room Air Conditioning, that had the potential to render several emergency action levels (EALs) ineffective. As a result, the NRC opened an unresolved item related to this concern. Description. The inspectors identified a concern regarding Entergys ability to declare several EALs based on the actions required by site procedure 2.4.149, Loss of Control Room Air Conditioning. Specifically, procedure 2.4.149 directs numerous loads to be shed in order to maintain the main control room temperature below 120 degrees Fahrenheit upon loss of control room air conditioning during extended period of outside temperature of 90 degrees Fahrenheit and above, as per FSAR section 7.1.8. Main control room air conditioning is not consider ed important to safety, based on the ability to control the heat up rate in the main control room, through the actions described in procedure 2.4.149. Upon updating the calculation to determine how much load must be shed to ensure design requirements were met, procedure 2.4.149 was updated with an attachment directing which loads that are required to be shed in order to meet the design calculation S&SA056, Control Room and Cable Spreading Room Heatup Calculations, Revision 6. The main control room is required to remain at or below 120 degrees Fahrenheit to ensure the main control room equipment remains operable. Main control room equipment temperatures above 120 degrees Fahrenheit can result in multiple control equipment failures which could result in misleading indications and inadvertent system actuation. The inspectors questioned how the procedure would be implemented, based on the lack of specific guidance in the procedure. The procedure includes the load shedding of numerous components, including both trains of reactor protection system, average power range monitors, intermediate range power monitors, source range power monitors, and process radiation monitors. Inspectors questioned how the site would declare numerous EALs without supporting equipment that has no redundancy or pre- established compensatory measures, as proceduralized in EN-AD-270, Equipment Important to Emergency Response. Inspectors questioned at what point would the operators be required to shed equipment that is required to support the HOT (greater than 212 degrees Fahrenheit) condition EAL classifications. The inspectors questioned whether or not operators would be able to verify that the plant conditions were consistent with applicable EALs at the time the components were removed from service. Entergy is reviewing the calculations to determine when load shedding of loads without compensatory measures would have been required and intends to report the results to the NRC by June 2, 2017. Inspectors verified that the procedure was changed to ensure minimum instrumentation requirements were maintained to declare EALs. The inspectors determined that procedure 2.4.149 had the potential to render EALs ineffective and is an unresolved item pending Entergy completing their evaluation of load shedding impact on the main control room heat up and NRC review of the evaluation and procedure implementation. (URI 05000293/2017001-01, Concern Regarding Ability to Declare EALs during Loss of Control Room Air Conditioning)
05000416/FIN-2016007-01Grand Gulf2016Q4Inadequate Technical Specification Surveillance Requirements for Reactor Protection SystemThe team identified a Green non-cited violation of 10 CFR 50.36, Technical Specifications, which requires that surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met. Contrary to this requirement, from June 24, 2014, until November 3, 2016, the licensee failed to include in its technical specification a surveillance requirement to assure that the facility operation will be within safety limits. Specifically, after modifying its reactor protection system to remove turbine first stage pressure instrumentation, the licensee failed to adjust the interval at which it calibrates the average power range monitor channels during surveillance tests to ensure the signals were accurately indicating the true core average power and that reactor protection system trips were enabled when required to assure the facility will be within safety limits. The licensees failure to ensure surveillance requirements relating to calibration to ... assure that ... facility operation will be within safety limits, and that the limiting conditions for operation will be met was a performance deficiency. In response to this issue, the licensee implemented compensatory actions to ensure the reactor protection system trips would be enabled when required, and documented the condition in its corrective action program as Condition Report CR-GGN-2016-08297. This performance deficiency was more-than-minor because it was associated with the thermal limit design control attribute of the Barrier Integrity Cornerstone objective to provide reasonable assurance that physical design barriers (fuel cladding, reactor coolant system, and containment) protect the public from radionuclide releases caused by accidents or events. Specifically, the surveillance requirements did not assure calibration of the average power range monitors to ensure an accurate measurement of reactor power such that the reactor protection system trips were enabled at 35.4 percent power. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At- Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding had a cross-cutting aspect in the area of human performance associated with change management because the licensee failed to use a systematic process for evaluating and implementing changes to the reactor protection system so that nuclear safety remains the overriding priority (H.3).
05000286/FIN-2016004-03Indian Point2016Q4Failure to Provide Indication of a Bypassed RPS Channel During TestingGreen. The inspectors identified a finding of very low safety significance when Entergy conducted testing on the Unit 3 reactor protection system (RPS) that was contrary to the guidance in IEEE standard 279-1968, a standard to which Indian Point Unit 3 was committed. Specifically, Entergy made temporary changes to their Unit 3 reactor coolant temperature channel functional test procedures, pressurizer pressure loop functional test procedures, and nuclear power range channel axial offset calibration procedures to use jumpers to bypass RPS trip functions, without meeting the requirement to have continuous indication in the control room when a part of RPS is bypassed for any purpose. Entergy closed the temporary modification and returned to testing without using jumpers to bypass the tested channel. The inspectors determined the finding was more than minor because this finding was associated with the procedure quality attribute of the Mitigating Systems cornerstone and affected its objective to ensure the reliability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the new test method reduced the reliability of the RPS tripping the unit under conditions requiring an overtemperature delta temperature (OTDT) trip. The inspectors evaluated this finding using IMC 0609, Attachment 4, Initial Characterization of Findings. The inspectors determined that the finding affected the Mitigating Systems cornerstone and evaluated the finding using Appendix A, Exhibit 2, Mitigating Systems Screening Questions. The finding is of very low safety significance (Green) because it did not affect both the RPS trip signal to initiate a reactor scram and the function of other redundant trips or diverse methods of reactor shutdown. The inspectors identified a cross-cutting aspect in the area of Human Performance, Conservative Bias, because Entergy did not determine the test method was safe in order to proceed. Specifically, Entergy staff rationalized that the use of jumpers was allowable because they were focused on completing the required surveillance testing. (H.14 Conservative Bias)
05000250/FIN-2016004-01Turkey Point2016Q4Unrecognized Inoperable Reactor Protection System Instrument ChannelA self-revealing NCV of Technical Specification (TS) Limiting Condition for Operation (LCO) 3.3.1 was identified for the licensees failure to input the correct Eagle 21 resistance temperature detector (RTD) coefficients into the Eagle 21 reactor protection system (RPS) which resulted in channels being inoperable for longer than their allowed outage times. Immediate corrective actions to restore compliance included inputting the correct RTD coefficients into the Eagle 21 RPS. Planned corrective actions to prevent recurrence included revising engineering procedures to include validation that the RTD coefficients were derived via the correct methodology. This issue was entered into the licensees corrective action program as action request (AR) 02129632. The licensees failure to input the correct RTD coefficients into the Eagle 21 RPS was a performance deficiency. The performance deficiency was more than minor because it was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage) because the specified safety function of each functional unit was not met. The inspectors evaluated the significance of this finding and determined the finding was of very low safety significance (Green) because the finding did not affect the function of other redundant or diverse methods of reactor shutdown. The NRC assigned a cross cutting aspect associated with the Resources element of the Human Performance area because the licensee failed to ensure that procedures related to RTD replacement contained adequate information for verifying and inputting correct RTD coefficients (H.1).
05000247/FIN-2016004-04Indian Point2016Q4Failure to Follow RPS Logic Train B Actuation Logic TestGreen. A self-revealing NCV of Technical Specification (TS) 5.4.1(a), Procedures, was identified because Entergy did not follow procedure 2-PT-2M3A, Reactor Protection System Logic Train B Actuation Logic Test and Tadot, required by NRC Regulatory Guide 1.33, Appendix A, during planned testing on July 6, 2016, resulting in a Unit 2 reactor trip. Specifically, Entergy positioned key #183 in the channel B reactor logic key lock switch to the defeat position without procedural guidance and prior to commencing 2-PT-2M3A. 2-PT-2M3A requires that the reactor trip bypass breaker B be racked in when the channel B reactor protection logic key lock switch is taken to defeat to prevent a reactor trip. Entergy entered this issue into the corrective action program (CAP) as CR-IP2-2016-04320. The corrective actions include procedure enhancements, operations work challenges, and a site all hands meeting. This finding was determined to be more than minor because it is associated with the human performance attribute of the Initiating Events cornerstone and affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, Entergy operated plant equipment without direction from procedural guidance which resulted in an unplanned reactor trip. This finding was determined to be of very low safety significance (Green) because it did not cause the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition, high energy line-breaks, internal flooding, or fire. This finding had a cross-cutting aspect in the area of Human Performance, Field Presence, because Entergy leaders did not reinforce standards and expectations with regard to procedure use and adherence. Specifically, Entergy did not have sufficient urgency for changing worker behaviors through the work observation program. (H.2 Field Presence)
05000293/FIN-2016004-01Pilgrim2016Q4Failure to Promptly Perform an Operability Evaluation for a Recirculation Flow ConverterGreen. The inspectors identified a Green NCV of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, because Entergy did not perform a prompt operability determination and adequately evaluate the operability of a recirculation flow converter in a timely manner in accordance with procedure EN-OP-104, Operability Determination Process. As a result, Entergy allowed this flow converter to remain in service, without reasonable assurance of its capability to perform its required safety function, from the time the adverse condition was discovered on October 3, 2016, until the component was declared inoperable and replaced on October 21, 2016. Entergy entered the initial equipment failure into the CAP as CR 2016-07622 and CR 2017-0854. Entergy took corrective actions to replace the inoperable flow converter. The inspectors determined that this performance deficiency was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and it adversely affected the cornerstone objective of ensuring the reliability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). The issue is also similar to the more than minor example in IMC 0612, Appendix E, Examples of Minor Issues, issued August 11, 2009, Example 3j because the flow converters capability to perform its required safety function could not be reasonably assured. The inspectors screened this finding in accordance with IMC 0609, Appendix A, The Significance Determination Process for Findings At- Power, issued June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, and determined that this finding was of very low safety significance (Green) because the finding affected a single reactor protection system (RPS) trip signal to initiate a reactor scram, but did not affect the function of other redundant trips or diverse methods of reactor shutdown, did not involve control manipulations that unintentionally added positive reactivity, and did not result in a mismanagement of reactivity by operator. The inspectors determined that this finding had a -cutting aspect in the area of Human Performance, Conservative Bias, because Entergy did not use decision makingpractices that emphasize prudent choices over those that are simply allowable. Specifically, Entergy did not take a conservative approach in making the decision to keep the A recirculation flow converter in service when available information regarding its operability was incomplete. Operators continued to act based on the assumption that the flow converter would remain operable, without reasonable assurance. Management did not adequately prioritize the completion of the operability evaluation for this safetyrelated component. Instead, the completion of the evaluation was delayed due to a heavy workload on the available staff who were qualified to provide the necessary input. (H.14)
05000416/FIN-2016007-02Grand Gulf2016Q4Failure to Obtain NRC Approval For Changes to the Reactor Protection SystemThe team identified a Severity Level IV non-cited violation of 10 CFR 50.59(c)(2), Changes, Tests, and Experiments, for the licensees failure to obtain a license amendment prior to implementing a proposed change, test, or experiment that would result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the final safety analysis report. Specifically, from June 24, 2014, until November 3, 2016, the licensee modified its reactor protection system to remove turbine first stage pressure instrumentation to measure reactor power, which resulted in a more than minimal increase of the likelihood of a malfunction. The failure to obtain a license amendment prior to implementing a change that resulted in a more than a minimal increase in the likelihood of occurrence of a malfunction of a system important to safety was a performance deficiency. In response to this issue, the licensee implemented compensatory actions to ensure the reactor protection system trips would be enabled when required, will either prepare a new evaluation under current regulatory guidelines, or submit a license amendment request to the NRC, and documented the condition in its corrective action program as Condition Report CR-GGN-2016-08298. This performance deficiency was more-than-minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the elimination of the turbine first stage pressure instruments increased the likelihood of a malfunction of the reactor protection system. Additionally, the violation was similar to the more-than-minor examples in the NRC Enforcement Manual Appendix E, Minor Violations Examples, dated September 9, 2013. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. Since the violation was determined to be Green in the significance determination process, the traditional enforcement violation was determined to be a Severity Level IV violation, consistent with the example in paragraph 6.1.d(2) of the NRC Enforcement Policy. Traditional enforcement violations are not assessed for cross-cutting aspects.
05000341/FIN-2016003-01Fermi2016Q3Failure to Perform an Operability Determination for Division 1 RPV Reference Leg Backfill System Not Providing Adequate FlowThe inspectors identified a finding of very low safety significance with an associated non-cited violation of Title 10 of the Code of Federal Regulation (10 CFR) 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," for the licensees failure to complete an operability determination as required by plant procedures. Specifically, the licensee failed to perform an operability determination for a degraded/non-conforming condition described in CARD 1625608, Division 1 RPV (Reactor Pressure Vessel) Reference Leg Backfill System Not Meeting Minimum Recommended Flow, to assess the impact on affected RPV level and pressure instrumentation when the minimum reference leg backfill flow rate could not be maintained. The licensee entered this violation into its CAP for evaluation and identification of appropriate corrective actions. An operability determination was subsequently documented in CARD 1625608. The finding was of more than minor safety significance because it was related to the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to perform an operability determination for the degraded/nonconforming condition could potentially have led to inoperable RPV level and pressure instruments without the licensees knowledge. In this case, during an event involving a rapid depressurization of the RPV, the affected instruments may have caused later than expected initiation of the required automatic actuation signals for the reactor protection system and emergency core cooling system and may have provided operators with erroneous indications. The finding was determined to be of very low safety significance because it did not represent an actual loss of function of a single train for greater than its Technical Specification (TS) allowed outage time nor did it represent a loss of function of a non-TS train designated as high safety significant in accordance with the licensees Maintenance Rule Program. The inspectors determined this finding affected the cross-cutting area of problem identification and resolution and the cross-cutting aspect of evaluation. The licensee did not thoroughly evaluate the problem after it was identified with respect to the effect the degraded/non-conforming condition would have on operability of the RPV level and pressure instruments commensurate with their safety significance (IMC 0310 P.2)
05000346/FIN-2016003-02Davis Besse2016Q3Inadequate Modification Design Control Measures Result in Reactor Protection System InoperabilityA self-revealed finding of very low safety significance and an associated NCV of Title 10, Code of Federal Regulations (CFR), Part 50, Appendix B, Criterion III, Design Control, were identified for the licensees failure to have adequately prepared and implemented a permanent plant modification associated with steam generator (SG) replacement during the units 18th RFO in 2014. Specifically, in conjunction with SG replacement the licensee had also replaced a significant amount of reactor coolant system (RCS) piping and instrumentation, including all RCS hot leg resistance temperature detectors (RTDs). The RTD housings were improperly insulated during the modification, such that over the ensuing reactor operating cycle the RTD wiring insulation degraded to the extent that nearly all the RTDs were rendered inoperable. This issue was entered into the licensees CAP. Corrective actions by the licensee included replacement of the degraded RTDs. This finding was of more than minor safety significance because it affected the attribute of design control of the Mitigating Systems cornerstone of reactor safety, and adversely impacted the cornerstone objective of ensuring the availability, reliability, and capability of the units RPS. Specifically, the inspectors determined that the licensees failure to have properly designed and implemented the insulation packages for the RTD housings ultimately resulted in the overheating and degradation of the RTD wiring insulation and inoperability of the RTDs associated with the RCS high temperature and RCS pressure/temperature reactor trips. The finding was determined to be of very low safety significance based on a detailed risk analysis that yielded a change in core damage frequency (CDF) of less than 1E7 events per year. The inspectors determined that the finding had a cross-cutting aspect in the area of human performance. The inspectors assigned the cross-cutting aspect of Field Presence to the finding because the licensees SG replacement project management team failed to reinforce the importance of close communication between responsible engineers with overlapping and interfacing modification packages, and did not adequately promote effective work execution through the use of clearly defined work documents that were written and structured to minimize the likelihood for human error. (H.2)
05000461/FIN-2016003-06Clinton2016Q3Licensee-Identified ViolationThe following violation of very low significance (Green) was identified by the licensee and is a violation of NRC requirements which meets the criteria of the NRC Enforcement policy for being dispositioned as an NCV. Clinton Technical Specification 3.3.2.1, Control Rod Block Instrumentation requires the control rod block instrumentation for each Function in Table 3.3.2.11 shall be operable. If one or more rod withdrawal limiter (RWL) channels is inoperable, the required action is to suspend control rod withdrawal. The completion time for the action is immediately. Contrary to the above, on April 13, 2016, both RWL channels became inoperable and the required action to immediately suspend control rod withdrawal was not completed. Specifically, on April 13, 2016, operations lowered reactor power below the control rod withdrawal limiter high power set point to remove the B turbine driven reactor feed pump from service for repairs. Technical Specification Surveillance Requirement 3.3.2.1.2 requires a functional test of the 4-notch control rod withdrawal limit of the RWL within one hour of resetting the high power set point during power reduction if it has not been completed within the previous 92 days. The surveillance was last performed on April 25, 2015, making the RWL channels inoperable below the high power set point. The licensee subsequently withdrew control rods to restore reactor power above the high power set point with the RWL channels inoperable. The licensee discovered the missed surveillance on April 21, 2016, in preparations for lowering reactor power to place the B turbine driven reactor feed pump into service after repairs. The surveillance was successfully performed after lowering power below the RWL high power set point. The licensee entered the issue into the CAP as AR 02659195. The issue was determined to be more than minor because the performance deficiency affected equipment performance attribute of the mitigating systems cornerstone objective to ensure the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. The finding was screened using IMC 0609, Attachment 4, Initial Characterization of Findings, and Appendix A, The Significance Determination Process for Findings at Power, issued June 19, 2012, the finding was screened against the Mitigating Systems cornerstone and determined to be of very low safety significance (Green) because the finding did not affect a single reactor protection system trip signal to initiate a reactor scram, did not involve control manipulations that unintentionally added positive reactivity or result in a mismanagement of reactivity by operators.
05000266/FIN-2016002-03Point Beach2016Q2Suitability of Reactor Protection System and Engineered Safeguards System ComponentsDuring the review of the Reactor Protection System (RPS), the inspectors identified an Unresolved Item (URI) associated with components in both units RPS and engineered safeguards (ESF) system which contained components known to degrade with age, including electrolytic capacitors. In some cases, these components may have been installed as original plant equipment. During the inspectors review of system health reports associated with both Units 1 and 2 RPS, and ESF system as an extent of condition review, the inspectors identified a URI associated with components in hundreds of safety-related RPS and ESF printed circuit boards, power supplies, amplifiers, transmitters, and other related components that potentially exceeded their design criteria for the time period that the components were installed for which no evaluations existed. The inspectors determined that this was an issue of concern in which more information was needed to determine if the issue constituted one or more violations of NRC requirements. Specifically, the inspectors determined that subcomponents, including but not limited to electrolytic capacitors, were installed in both safety trains of both units RPS and ESF components, in some cases for over 40 years without any documented evaluation of age-related degradation mechanisms. The inspectors needed to evaluate the licensees operability determinations that resulted from this inspection activity, any engineering evaluations to provide justification for suitability with respect to design control, recovery plans, a review of the proposed preventative maintenance activities, current failure rates and drift trending, and any other information provided by the licensee that may provide a technically defensible basis for the continued operation. The issue is unresolved pending further NRC review of the licensees evaluation.
05000250/FIN-2016002-02Turkey Point2016Q2Failure to Correct Conditions Adverse to Quality Associated with the Eagle 21 SystemNRC inspectors identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, for a failure to correct a condition adverse to quality. The licensee identified that the ability to test the Eagle 21 was degraded but failed to take adequate corrective actions to correct the condition. The licensee entered the issue into their CAP as ARs 2023314 and 02145155. The performance deficiency was determined to be more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, not using core operating limits report (COLR) specified time-constants in surveillance requirement (SR) tests to demonstrate operability of the Eagle 21 system adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of the Thermal Over-Power (OPT) and Thermal Over-Temperature (OTT) reactor trip algorithms. The finding was determined to be of very low safety significance (Green) because defense in depth of the reactor protection system (RPS) existed to trip the unit via alternate and diverse means. The inspectors determined the finding was indicative of present licensee performance and was associated with the cross-cutting aspect of human performance, in the area of conservative bias, because individuals failed to evaluate a proposed action to determine if it was safe in order to proceed, rather than unsafe in order to stop (H.14).
05000458/FIN-2016009-03River Bend2016Q1Failure to Implement Corrective Actions to Prevent the Recurrence of a Reactor Scram Due to Grid DisturbancesThe team reviewed a self-revealing, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, for the licensees failure to establish measures to assure that corrective action is taken to preclude repetition of a significant condition adverse to quality. Specifically, following a November 27, 2015, reactor scram, the licensee failed to implement corrective actions associated with the alternate power lineup of the reactor protection system buses to preclude repetition of a significant condition adverse to quality during the January 9, 2016, reactor scram. This issue was entered into the licensees corrective action program as Condition Report CR-RBS-2016-0180. Corrective actions included supplying reactor protection system bus A from the normal power source on January 12, 2016. The failure to assure corrective actions are promptly taken for a significant condition adverse to quality to preclude repetition of a reactor scram associated with both buses being affected by a switchyard voltage transient was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the human performance attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the licensees failed to implement corrective actions to address grid instabilities following the November 27, 2015, reactor scram to preclude the January 9, 2016, reactor scram. The team performed an initial screening of the finding in accordance with NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. Using Inspection Manual Chapter 0609, Appendix A, the team determined that this finding is of very low safety significance (Green) because it did not involve the loss of mitigation equipment or a support system. This finding has an evaluation cross-cutting aspect within the problem identification and resolution area because the licensee failed to thoroughly evaluate the cause of the November 27, 2015, reactor scram and ensure that the resolution addresses causes and extent of conditions commensurate with their safety significance (P.2).
05000458/FIN-2016009-04River Bend2016Q1Failure to Adequately Assess Risk During Motor Generator Set UnavailabilityThe team identified a non-cited violation of 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, for the licensees failure to adequately assess the increase in risk that may result from proposed maintenance activities. Specifically, the team identified that since 2012, the licensee failed to adequately assess the risk of simultaneously powering both reactor protection system buses from the alternate power sources, which resulted in an increased risk of a reactor scram due to grid instabilities. This issue was entered into the licensees corrective action program as Condition Report CR-RBS-2016-3176. Corrective actions included revising Procedure SOP-0079, Reactor Protection System, to include precautions to address the increased risk associated with supplying both reactor protection system buses from the alternate power source. The team determined that the licensees failure to adequately assess the increase in risk associated with simultaneously powering both reactor protection system buses from the alternate power sources was a performance deficiency. The performance deficiency is more than minor, and therefore a finding, because it is associated with the design control attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the performance deficiency resulted in an increased risk of a reactor scram due to grid instabilities. The team performed an initial screening of the finding in accordance with NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. Using Inspection Manual Chapter 0609, Appendix A, Exhibit 1, Initiating Events Screening Questions, a detailed risk evaluation was required since the finding resulted in a reactor scram and main steam isolation valve closure. The finding was evaluated using Inspection Manual Chapter 0609, Appendix K, Maintenance Risk Assessment and Risk Management Significance Determination Process, Flowchart 1, Assessment of Risk Deficit, dated May 19, 2005, to assess the significance of the finding. A senior reactor analyst estimated the incremental core damage probability deficit to be 2.0E-7 and the incremental large early release probability deficit to be 4.0E-8. Since this incremental core damage probability deficit was less than 1E-6 and the incremental large early release probability deficit was less than 1E-7, the analyst used Flowchart 1 to determine the finding was of very low safety significance (Green). This finding has a conservative bias cross-cutting aspect within human performance area because the licensee determined that powering both reactor protection system buses from the alternate source instead of the motor generator sets was safe even though the motor generator sets are the preferred source and provide protection against grid perturbations (H.14).
05000440/FIN-2016001-01Perry2016Q1Failure to Properly Implement System Operating Instructions to Maintain Control of Reactor Pressure Vessel LevelA finding of very low safety significance and an associated non-cited violation (NCV) of Technical Specification (TS) 5.4.1., Procedures, was self-revealed on January 24, 2016, when an unplanned automatic reactor protection system (RPS) actuation occurred as a result of the licensees failure to correctly implement the steps outlined in procedure SOIC34, Feedwater Control System, Section 4.2.12.c to balance inservice flow controller outputs. Specifically, while in the process of reducing power to allow for a drywell entry to determine the location of an unidentified leak into the drywell floor drain sump, the operators failed to control reactor pressure vessel water level during shifting of feedwater pumps from a turbine-driven reactor feed pump to the motor-driven reactor feed pump, resulting in a RPS actuation initiated on reactor vessel water Level 8, shutting down the reactor. Following the reactor scram, the licensee took immediate actions to restore and maintain RPV water level in accordance with procedure ONIC711, Reactor Scram, Revision 20. The issue was entered into the licensees corrective action program as CR 201601063. The licensees failure to properly implement the steps in the procedure was a performance deficiency that was determined to be more than minor and thus a finding, because it was associated with the Initiating Events cornerstone attribute of human performance and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. The finding was determined to be of very low safety significance because it did not result in the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition. This finding has a cross-cutting aspect in the area of human performance, resources, because the licensee failed to ensure that personnel, equipment, procedures, and other resources are available and adequate to support nuclear safety. Specifically, the licensee failed to provide adequate, procedural guidance on when to conduct the feedwater pump shift (IMC 0310, H.1).
05000341/FIN-2016001-02Fermi2016Q1Failure to Correctly Interpret and Implement TS Requirements for RPS Trip FunctionsThe inspectors identified a finding of very low safety significance with an associated NCV of TS 5.4, Procedures. Specifically, the licensee failed to enter TS 3.3.1.1, Condition C when the high pressure stop valve (HPSV) closure and high pressure control valve (HPCV) fast closure reactor protection system (RPS) trip functions became inoperable while the main turbine bypass valves cycled open during a plant transient on January 6, 2016. The licensee entered this issue into the corrective action program for evaluation and identification of appropriate corrective actions. As an immediate corrective action, the licensee established an expectation to enter TS 3.3.1.1, Condition C, when the main turbine bypass valves are open above 29.5 percent power and declare the HPSV closure and HPCV fast closure RPS trip functions inoperable pending another resolution. The performance deficiency was of more than minor safety significance because a failure to correctly implement TS Limiting Condition for Operation (LCO) requirements has the potential to lead to a more significant safety concern if left uncorrected. Specifically, a failure to declare an LCO not met, enter the applicable condition(s), and follow the applicable actions could reasonably result in operations outside of established safety margins or analyses. The finding was determined to be of very low safety significance based on a detailed significance determination process review since the delta core damage frequency was determined to be less than 1.0E-6/year. The inspectors concluded this finding affected the cross-cutting aspect of conservative bias in the human performance area. Specifically, the licensee failed to correctly interpret and implement the TS requirements due to a non-conservative interpretation of the TS Bases and a failure to reconcile differences between information in the annunciator response procedure and the TS Bases (IMC 0310, H.14).
05000341/FIN-2016001-03Fermi2016Q1Failure to Satisfy 10 CFR 50.72 and 10 CFR 50.73 Reporting Requirements for Loss of RPS Trip Safety FunctionsThe inspectors identified a Severity Level IV NCV of the 10 CFR 50.72(a)(1), Immediate Notification Requirements for Operating Nuclear Power Reactors, and 10 CFR 50.73(a)(1), Licensee Event Report (LER) System. Specifically, the licensee failed to make a required 8-hour non-emergency notification call to the NRC Operations Center after discovery of a condition that could have prevented the fulfillment of the safety function to shut down the reactor on February 21, 2015, and on January 6, 2016 (two separate occurrences). In addition, the licensee failed to submit a required LER within 60 days after discovery of the event on February 21, 2015. Subsequently, the licensee made an 8-hour notification call on February 25, 2016 to the NRC Operations Center via the Emergency Notification System to report the two events (Event Notices 51755 and 51756). On March 2, 2016, the licensee updated Event Notices 51755 and 51756 to include an additional reporting criterion. The licensee submitted LER 05000341/2015-008-00, Turbine Stop Valve Closure and Turbine Control Valve Fast Closure Reactor Protection System Functions Considered Inoperable Due to Open Turbine Bypass Valve, on March 29, 2016, to report the February 2015 event. The licensee entered this issue into its corrective action program to evaluate the cause for its failure to satisfy the reporting requirements and to identify appropriate corrective actions. Consistent with the guidance in IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Screening, dated September 7, 2012, the inspectors determined that the performance deficiency was of minor significance based on No answers to the more-than-minor screening questions. However, in accordance with Section 6.9.d.9 of the NRC Enforcement Policy, this violation was categorized as Severity Level IV because the licensee failed to report as required by 10 CFR 50.72(a)(1)(ii) and 10 CFR 50.73(a)(1). No cross-cutting aspect is associated with this traditional enforcement violation because the associated performance deficiency was determined to be of minor significance and therefore not a finding.
05000341/FIN-2016001-09Fermi2016Q1Inadvertent Reactor Water Low Level Reactor Protection System Actuation Due to Operator ErrorA finding of very low safety significance with an associated NCV of Technical Specification (TS) 5.4, Procedures, was self-revealed when a valid automatic reactor scram signal and isolation signal for multiple primary containment isolation valves was actuated. A reactor operator, who was maintaining RPV water level and reactor pressure following a plant scram, did not initiate reactor core isolation cooling (RCIC) system flow in time to maintain level above the Level 3 reactor protection system actuation setpoint. As an immediate corrective action, control room operators promptly restored RPV level by manual operation of the RCIC system. The licensee entered this issue into the corrective action program and provided remedial training for the reactor operator in the simulator, communicated lessons learned from this event with other licensed operators, and subsequently implemented improvements for licensed operator training and procedure changes to incorporate a revised strategy for manual control of RPV level and pressure control with main steam line isolation valves closed. The performance deficiency was of more than minor safety significance because it was associated with the Human Performance attribute of the Initiating Events cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the human performance error unnecessarily challenged a plant protection feature, which resulted in a valid automatic reactor scram signal and isolation signal for multiple primary containment isolation valves. In addition, the finding was sufficiently similar to Example 4(b) in IMC 0612, "Power Reactor Inspection Reports," Appendix E, "Examples of Minor Issues," for not of minor safety significance since the error resulted in a valid automatic reactor scram signal and isolation signal for multiple primary containment isolation valves. The finding was determined to be of very low safety significance since it did not cause a reactor scram and a loss of mitigation equipment relied upon to transition the plant to a stable shutdown condition (e.g., loss of condenser, loss of feedwater). The inspectors concluded this finding affected the cross-cutting aspect of resources in the human performance area. Specifically, the licensees evaluation identified the reactor operator had been performing a complicated task for a long period of time without adequate rest/recovery periods (IMC 0310, H.1).
05000286/FIN-2016001-03Indian Point2016Q1Inadequate Screening of Reactor Protection System Test Method ChangeThe inspectors identified that Entergy conducted testing on the Unit 3 RPS that was not described in the UFSAR without performing an adequate 50.59 evaluation, contrary to EN-LI-100, Process Applicability Determination. Specifically, Entergy made temporary changes to the Unit 3 reactor coolant temperature channel functional test procedures, pressurizer pressure loop functional test procedures, and nuclear power range channel axial offset calibration procedures to use jumpers to bypass RPS trip functions. As a result, the NRC opened an URI related to this concern. On October 21, 2014, Entergy implemented temporary procedure changes to three sets of reactor protection system surveillance procedures. These procedures were 3-PT-Q87A, B, and C, Channel Functional Test of Reactor Coolant Temperature Channel 411, 421, and 431; 3-PT-Q95A, B, and C, Pressurizer Pressure Loop P-455, 456, and 457 Functional Test; and 3-PT-Q109A, B, and C, Nuclear Power Range Channel N-41, 42, and 43 Axial Offset Calibrations. Entergy made the temporary procedures changes as an interim corrective action following a trip of Unit 3 on August 13, 2014, during reactor protection system surveillance testing when a spurious actuation signal occurred in the channel that was not being tested. Entergy was initially unable to identify and correct the cause of the spurious over-temperature delta temperature (OTDT) channel trip and, therefore, wanted to perform their TS required surveillances without risking another unit trip should another spurious actuation occur in the degraded channel not under test. In each case, the change was to install a jumper at the beginning of the testing to maintain the trip relay in an energized condition for the tested channel of the OTDT trip circuit thereby effectively bypassing the channel in test. Each quarterly test was performed three or four times over the course of approximately ten months. On July 1, 2015, Entergy determined that they had corrected the cause of the spurious OTDT channel trips and removed the temporary procedure changes from the controlled document system. Despite this, on August 12, 2015, Entergy performed the surveillances 3-PT-Q95A, B, and C, Pressurizer Pressure Loop P-455, 456, and 457 Functional Test, which incorporated the temporary procedure changes that had been discontinued. Operating experience has shown that human error has allowed jumpers to remain installed even after testing is over because there is no obvious indication that the channel is in bypass when a jumper is used. Indian Point is committed to IEEE Standard 279-1971, Criteria for Protective Systems for Nuclear Power Plants. Section 4.13, Indication of Bypass, requires that any channel placed in a bypass configuration for testing shall have continuous indication in the control room that the channel has been removed from service. These standards preclude the use of jumpers for routine testing. This commitment was further documented in the Safety Evaluation Report for TS Amendment 107 that approved the extension of surveillance testing intervals and approved the use of the bypass feature for testing. Although Unit 3 was not originally built with RPS bypass switches, New York Power Authority had planned to install bypass switches, which would comply with IPEEE 279-1971. Entergy terminated the WO for installation of these switches. Normally, during the course of RPS channel surveillance testing, the affected channel of the OTDT trip circuit would de-energize the trip relay. If one of the other three redundant RPS channels spuriously de-energized at the same time, the two of four signal RPS trip logic would be satisfied and Unit 3 would trip, as occurred on August 13, 2015. By putting the jumper in place, the affected channel trip relay would remain energized under all conditions, including actual conditions that would require a plant trip on OTDT. During testing, the use of the jumper did not increase the likelihood of a malfunction of an SSC over that previously evaluated in the UFSAR because Unit 3 had received a license amendment (Agencywide Documents Access and Management System (ADAMS) Accession No. ML003779650) that allowed testing a bypassed channel. However, the safety evaluation report for that license amendment stated that, The licensee further commits that only those instruments whose hardware capability does not require the lifting of leads or installing of jumpers will be routinely tested in bypass. When Unit 3 applied for the license amendment, the intent was to permanently install bypass switches that would allow bypassing a channel and would clearly indicate in the control room that a channel was bypassed. The risk of inadvertently leaving a jumper in place is greater than the risk of inadvertently leaving a channel bypassed using hardware that brings in an alarm in the control room, because the jumper can go unnoticed for a longer period of time since it does not result in clear indication in the control room. Per procedure EN-LI-100, Entergy performed a 50.59 screening review for these temporary procedure changes. In this screening, they incorrectly determined that the temporary procedure changes did not involve a test not described in the UFSAR, and as a result, did not perform a 50.59 evaluation. Although the UFSAR describes reactor protection system testing by bypassing channels, it specifically does not authorize the use of jumpers to do so. The UFSAR for Unit 3, chapter 7, states, Test procedures also allow the bistable output relays of the channel under test to be placed in the bypassed mode prior to proceeding with the analog channel test ... this may only be done for circuits whose hardware does not require the use of jumpers or lifted leads to be placed in bypass mode. Jumpering out the RPS trip relay in an RPS channel under test created an adverse condition because it removed the automatic trip signal from the RPS logic. Entergy was required to fully evaluate the adverse condition rather than authorize the change under an abbreviated 50.59 screening process. The inspectors concluded that not performing an adequate 50.59 evaluation was a performance deficiency that was reasonably within Entergys ability to foresee and correct and should have been prevented. Because Entergy was in the process of performing a retroactive 50.59 evaluation at the end of the inspection period, the inspectors were not able to evaluate if the performance deficiency was more than minor. The inspectors determined that the issues concerning the use of jumpers for RPS testing is an URI pending Entergy completion and NRC review of the 50.59 evaluation.
05000281/FIN-2015004-04Surry2015Q4Inadequate Procedure Causes Main Turbine and Reactor TripA self-revealing Green NCV of Surry TS 6.4.A.7 was identified because Unit 2 tripped during performance of 2-OP-TM-001, Turbine Generator Startup to 20% - 25% Turbine Power, on July 21, 2015. An inadequate procedure allowed the main turbine (MT) governor valves to open rapidly during MT overspeed protection controller (OPC) testing, increasing MT first stage pressure above the P-2 and P-7 reactor protection system (RPS) permissive step points, and subsequently causing a reactor trip. Specifically, 2-OP-TM-001 did not have the minimum level of information needed to ensure that there was no speed error between MT speed and the setter position before initiating the OPC test. This allowed the test to be conducted with a speed error that caused the governor valves to open rapidly at the end of the test and subsequently cause a reactor trip. This issue was documented in the licensees CAP as CR 1003328. The inspectors concluded that the failure of the licensee to have the minimum level of information needed to ensure task critical actions in 2-OP-TM-001 and for operators to avoid error traps in conducting the MT OPC test, as required by Dominion procedure SPAP-0504, was a PD. Using IMC 0612, Appendix B, Issue Screening, dated September 7, 2012, the inspectors determined that the performance deficiency was more than minor because it was associated with the procedural quality attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset stability and challenge critical safety functions during shutdown as well as power operations. Using IMC 0609.04, Initial Characterization of Findings, Table 2, dated June 19, 2012; the finding was determined to affect the Initiating Events Cornerstone. The inspectors screened the finding using IMC 0609, Appendix A, SDP for Findings at-Power, dated June 19, 2012, and determined that it screened as Green because the deficiency did not involve the complete or partial loss of a support system that contributes to the likelihood, or cause, an initiating event and affected mitigation equipment. This finding has a cross-cutting aspect in the documentation aspect of the human performance area, H.7, because the licensee did not create a complete procedure for testing the MT overspeed protection.
05000272/FIN-2015004-04Salem2015Q4Inadequate Post Maintenance Testing on OTDT ChannelsA self-revealing Green NCV of Title 10 of the Code of Federal Regulations (10 CFR) 50, Appendix B, Criterion XI, Test Control, and associated NCV of TS 3.3.1.1 was identified, with two examples, for not ensuring that all testing required to demonstrate that nuclear instrumentation (NI) would perform satisfactorily in service was identified and performed. As a result, inoperable Over-Temperature Delta-Temperature (OTDT) channels were not placed in the tripped condition within the timeframe required by TS limiting condition for operation (LCO) 3.3.1.1, on January 20 and April 21, 2015, respectively. PSEG entered this issue in their CAP and developed corrective actions to provide improved retest requirements for all maintenance performed on the NI system. The inspectors determined that the failure to ensure the NI channels were operable upon restoration to service was a performance deficiency. The performance deficiency is more than minor because it is associated with the equipment performance attribute of the Mitigating Systems cornerstone and affected its cornerstone objective to ensure the availability of systems that respond to initiating events to prevent undesirable consequences. Inspectors evaluated the findings significance in accordance with IMC 0609, Attachment 4 and Appendix A, and determined that the finding did not affect a single reactor protection system (RPS) trip signal to initiate a reactor scram and the function of other redundant trips or diverse methods of reactor shutdown, did not involve control manipulations that unintentionally added positive reactivity and did not result in a mismanagement of reactivity by operator(s). Therefore, the finding screened to Green, or very low safety significance. The finding has a cross-cutting aspect in the area of Human Performance, Documentation, because PSEG did not ensure that plant activities were effectively governed by comprehensive, high-quality, programs, processes and procedures. Specifically, subsequent to completion of calibration and replacement work and post-maintenance testing (PMT) per Instrumentation and Controls (I&C) surveillance procedures, work packages did not adequately address or specify activities related to verifying potentially affected RPS indications.
05000341/FIN-2015003-01Fermi2015Q3Inadequate Simulator Fidelity Regarding the Ability to Model Thermal-Hydraulic InstabilitiesThe inspectors opened an Unresolved Item (URI) to further evaluate the capability of the Fermi 2 simulator to model core thermal-hydraulic instabilities, to evaluate the adequacy of licensed operator training using the plant simulator for response to the condition, and to determine whether a noncompliance with the regulatory requirements exists. Description: On March 19, 2015, Fermi 2 received an automatic reactor scram signal generated from the oscillation power range monitor (OPRM) logic of the reactor protection system. As discussed in Section 4OA3.1 of this inspection report, following the transition of the unit to single loop operation due to the loss of a reactor recirculation pump, licensed operators failed to stabilize the plant while operating in a region of core thermal-hydraulic instability on the Power-to-Flow Map due to inadequate procedures. The result was a reactor scram. During review of this event, the inspectors questioned whether licensed operator training and the licensees simulator were adequate to prepare the operators to respond to the condition. Currently, the Fermi 2 plant simulator does not model core thermal-hydraulic instability under the high power and low flow conditions experienced on March 19; however, the training staff is able to artificially introduce the instability in the simulator in certain scenarios. The inspectors questioned whether the modeling of thermal-hydraulic instability falls under the requirements of Title 10 of the Code of Federal Regulations (10 CFR) 55.46(c)(1), which requires the simulator to demonstrate expected plant response to operator input and to normal, transient, and accident conditions. This issue of concern is considered a URI pending additional review by the NRCs operator licensing inspectors (URI 05000341/201500301, Inadequate Simulator Fidelity Regarding the Ability to Model Core Thermal-hydraulic Instabilities).
05000263/FIN-2015007-02Monticello2015Q3Failure to Review for Suitability of Application of Safety-Related Relays Installed Beyond Their Service LifeThe inspectors identified a finding of very-low safety significance, and an associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the failure to assure measures were established for the selection and review for suitability of application of materials, parts, equipment and processes that were essential to the safety-related functions of structures, systems and components. Specifically, the licensee failed to review for suitability of application of safety-related Agastat and General Electric relays that had exceeded their service life, a condition non-conforming to their design basis, to justify their continued service considering in-service deterioration. The licensee previously entered this finding into the CAP, and completed corrective actions to replace or evaluate some relays and implemented a program to address the remaining relays in a timely manner The finding was determined to be more than minor because, if left uncorrected, the issue had the potential to lead to a more significant safety concern. Specifically, these safety-related relays were installed in protective circuits such as reactor protection system, etc., and their failure could impact the proper operation of these protective schemes. The inspectors did not identify a cross-cutting aspect associated with this finding as it was not reflective of the licensees current performance.
05000341/FIN-2015003-05Fermi2015Q3Failure to Maintain Adequate Procedures to Respond to Thermal-Hydraulic InstabilitiesA finding of very low safety significance with an associated Non-Cited Violation of 10 CFR 50, Appendix B, Criterion V, "Instructions, Procedures and Drawings," was self-revealed on March 19, 2015, when the reactor automatically scrammed due to an automatic reactor scram signal generated from the oscillation power range monitor (OPRM) logic of the reactor protection system. The licensee failed to maintain response procedures appropriate to the circumstances to direct licensed reactor operators to take timely mitigating actions when the reactor was operating in a condition more susceptible to core thermal-hydraulic instability (i.e., high power and low flow conditions) following the loss of a reactor recirculation pump and transition to single loop operation. Corrective actions include procedure revisions to add steps for timely mitigation actions when the reactor is operating in a condition more susceptible to core thermal-hydraulic instability and training of licensed operators. The finding was of more than minor safety significance because it was associated with the Procedure Quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the failure to have procedures appropriate to the circumstances in response to a thermal-hydraulic instability event resulted in untimely operator action that led to an automatic reactor scram. The finding was determined to be a licensee performance deficiency of very low safety significance. The inspectors concluded that because the changes to the abnormal operating procedure were performed in the year 2000 after the OPRM system was installed at the plant and no opportunity reasonably existed since that time to identify and correct it, this issue was not reflective of current licensee performance and no cross-cutting aspect was identified.
05000335/FIN-2015003-04Saint Lucie2015Q3Failure to Follow Reactor Protection System Surveillance Procedure Resulting in Reactor Plant TripA Green, self-revealing, NCV of TS 6.8.1 was identified for the licensees failure to adequately implement surveillance procedures during reactor protection system (RPS) testing. Specifically, the licensee failed to implement as-written operations surveillance procedure 1-OSP-63.01, RPS Logic Matrix Test, when operators failed to close two trip circuit breakers (TCBs) prior to proceeding to the next section of the procedure. This resulted in an unplanned automatic reactor trip when a second pair of TCBs were opened. Corrective actions completed for this event included a human performance review that was conducted by the shift manager, operations director and plant general manager, initially implementing around the clock management oversite, and revising the RPS logic matrix test procedure to change it from a reader/doer procedure to a procedure with more concurrent verification steps. The licensee entered this issue into their corrective action program as AR 2065821. The licensees failure to follow procedure 1-OSP-63.01, RPS Logic Matrix Test, as written is a performance deficiency. This performance deficiency was more than minor because it was associated with the human performance attribute of the Initiating Events Cornerstone and it adversely affected the associated cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions and resulted in an actual plant trip. The inspectors evaluated the risk of this finding using IMC 0609, Significance Determination Process, Attachment 4, Initial Characterization of Findings and IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power. The inspectors determined that the finding was of very low safety significance because it did not result in both the likelihood of a reactor trip and the likelihood that mitigation equipment or functions would not be available. The finding involved the cross-cutting area of human performance, with an aspect of avoiding complacency (H.12), in that the licensee failed to ensure that personnel effectively used human performance tools during the logic matrix test to ensure procedure steps were completed as required.
05000280/FIN-2015003-04Surry2015Q3Licensee-Identified Violation10 CFR 50, Appendix B, Criterion III requires, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis for those SSCs are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, on January 27, 2015, the licensee discovered that abnormal procedure, 0-AP-37.01, Abnormal Environmental Conditions, used when there is a tornado watch or warning declared for Surry County or when hurricane force winds are expected in Surry County within 36 hours, did not have specific steps to shut the four total sliding missile shield doors on the Unit 1 and Unit 2 MSVHs. The shields are necessary to meet the design function of the MSVH for protection of the equipment inside the MSVH which includes the AFW pumps and other safety-related components in the main steam and AFW systems. This issue was discovered during a procedure revision walk-through. Using IMC 0609.04, Initial Characterization of Findings, Table 2, dated June 19, 2012, and IMC 0609 Appendix A, Significance Determination Process for Findings at-Power, dated June 19, 2012, the inspectors determined that a detailed risk evaluation was required because the finding could involve the total loss of any safety function, identified by the licensee through probability risk analysis (PRA) that contributes to external event initiated core damage accident sequences (i.e., severe weather event). A detailed risk assessment was performed by a regional SRA in accordance with NRC IMC 0609 Appendix A using the NRC Surry SPAR model. The major analysis assumptions included: a one year exposure period, the performance deficiency was modelled as a non-recoverable weather-related loss of offsite power (LOOP) with the Station Blackout DG and all AFW pumps on one unit failed, damage assumed if F2-F5 tornado winds occurred within the 100 square mile radius including the site, and no recovery credit for AFW or for closing the missile shield doors prior to damage. The dominant sequence was a success of the reactor protection system and the electric power system, late failure of AFW and failure of feed and bleed. The risk was mitigated by the low frequency of events requiring use of the sliding missile shields and the remaining mitigation equipment including the AFW unit cross-tie. The result of the risk evaluation was an increase in core damage frequency of <1.0E-6/year, a GREEN finding of very low safety significance. This issue was entered into the licensees CAP as CR 570365 and the abnormal procedure 0-AP-37.01 was revised with the correct operator actions.
05000400/FIN-2015003-05Harris2015Q3Failure to implement EQ Program RequirementsThe inspectors identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion XVI, for the licensees failure to identify and correct a condition adverse to quality affecting the Environmental Qualification (EQ) Program. Specifically, the licensee failed to enter into the CAP the results of the vendor audit of the EQ program which resulted in the licensee blocking open D10 and D11 on June 16, 2015 while the unit was at 100 percent power. The resident inspectors questioned the main control room (MCR) about the doors being open and the licensee immediately closed D10 and D11. The licensee has entered the violation into their CAP as AR 754721, implemented interim guidance as an operations standing instruction (2015-024) not to open D10 or D11 while in mode 1-4. The opening of the tornado door between the main steam tunnel (MST) and the reactor auxiliary building (RAB) was a performance deficiency. The finding was screened in accordance with NRC IMC 0609.04, Initial Characterization of Findings, dated July 7, 2012. The finding was determined to affect the Initiating Events Cornerstone as the MST to RAB tornado door represented a barrier which left RAB systems and components vulnerable to harsh environment conditions should a high energy line break (HELB) occur during the time the doors were open. SDP screening determined that the finding could have affected equipment used to mitigate a LOCA, could have caused a reactor trip, could have resulted in internal flooding conditions, and could have affected equipment relied upon to transition the plant to a stable shutdown condition and required a detailed risk evaluation. A detailed risk evaluation was performed by a regional SRA in accordance with NRC IMC 0609 Appendix A. The major analysis assumptions included: a twenty hour exposure interval, HELBs postulated in all steam and feedwater piping in the MST, pipe break frequency from EPRI Report 1021086, no recovery credit for door closure, and a bounding CCDP value utilized. The CCDP was estimated using the NRC Shearon Harris SPAR model assuming a reactor trip initiator and bounding assumptions that the postulated RAB harsh environmental and flooding conditions would cause failure of the following equipment: auxiliary feedwater system, alternate seal injection system, RAB essential services chillers, component cooling water pumps, charging and safety injection pumps, and the residual heat removal pumps. The dominant sequence was a reactor trip, success of the reactor protection system, and failure of the reactor coolant pump (RCP) seals leading to an unmitigated RCP seal LOCA. The risk was mitigated by the short exposure period and the probability of steam and feedwater HELBs. The analysis determined that the finding represented an increase in core damage frequency of < 1.0 E-6/year, a GREEN finding of very low safety significance. This finding has a cross-cutting aspect in the area of Problem Identification and Resolution in the Corrective Action component because the licensee did not take appropriate corrective actions to address safety issues in a timely manner.
05000341/FIN-2015003-02Fermi2015Q3Failure to Incorporate Operating Experience Into Preventive Maintenance Activities Associated With RPS Timing RelaysA finding of very low safety significance with an associated Non-Cited Violation of 10 CFR 50.65, "Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," was self-revealed on May 24, 2015, when the failure of a reactor protection system (RPS) timing relay caused an invalid half-scram due to loss of power and the resultant closure of multiple containment isolation valves. The timing relay failure occurred, in part, due to the licensees failure to perform preventive maintenance on the component. The licensee replaced the failed timing relay and initiated corrective actions to create preventive maintenance activities for replacing the RPS timing relays. The finding was of more than minor safety significance because it was associated with the Equipment Performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the RPS timing relay failure resulted in the loss of RPS Train B power and caused multiple containment isolation valves to spuriously close. In addition, the finding was sufficiently similar to Inspection Manual Chapter 0612, "Power Reactor Inspection Reports," Appendix E, "Examples of Minor Issues," Example 7(c), in that this violation of 10 CFR 50.65(a)(3) had a consequence "...such as equipment problems attributable to failure to take industry operating experience into account when practicable." The finding was determined to be a licensee performance deficiency of very low safety significance. Although the issue affected the design or qualification of a mitigating system or component, failure of the timing relay and loss of RPS B power did not result in the loss of safety function of any safety-related structure, system, or component. Actuation of the RPS relies on a loss of power, which was not affected by the relay failure. The inspectors concluded this finding affected the cross-cutting area of human performance and the cross-cutting aspect of design margins (IMC 0310, H.6). Specifically, the licensee did not place special attention to appropriately operate and maintain RPS timing relays subject to age-related degradation within design margins with respect to an appropriate service life. Relevant external operating experience was not evaluated by the licensee and factored into an appropriate evaluation of component service life because the relay was not entered into its central component database.
05000348/FIN-2015003-01Farley2015Q3Failure to Evaluate or Test EMI/RFI Effect for Solid State Protection System Power SupplyAn NRC-identified non-cited violation (NCV) of 10 CFR 50, Appendix B, Criterion III, Design Control, was identified for the licensees failure to evaluate or test the Electro Magnetic Interference/Radio Frequency Interference (EMI/RFI) effects of the Solid State Protection System (SSPS) power supplies to ensure adequacy of design. The licensee initiated a Condition Report (CR) 10078615, EMI/RFI Testing for SSPS Power Supplies, to address this issue. The licensee performed an Immediate Determination of Operability (IDO) and Prompt Determination of Operability (PDO) and determined the power supplies were operable but nonconforming. The performance deficiency was determined to be more than minor because it adversely affected the Mitigating Systems cornerstone objective of ensuring availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences and was associated with the cornerstone attribute of Design Control. Failure to evaluate or test the EMI/RFI of SSPS components could cause spurious actuations or failure to actuate. The finding was of very low safety significance (Green) because it did not affect the reactor protection systems tripping signal to initiate a reactor scram because it would be limited to a single channel at a time, did not involve control manipulation that added positive reactivity, and did not result in a mismanagement of reactivity by operators. No cross-cutting aspect was assigned to this finding because it was not indicative of current licensee performance.
05000458/FIN-2015002-01River Bend2015Q2Inadequate Operating Margin for Reactor Protection System A Motor Generator Set for Overvoltage Protection Results in Loss of Shutdown CoolingThe inspectors reviewed a finding for the licensees failure to raise the overvoltage setpoint on the reactor protection system A motor generator set when the output of the generator was raised. This resulted in a reduction of the operating margin between the overvoltage trip setpoint and normal operating voltage. As a result, a spike in the output of the A motor generator on February 24, 2015, exceeded the overvoltage trip setpoint and caused the reactor protection system motor generator set output breaker to open which resulted in a loss of shutdown cooling while the reactor was shut down for refueling operations. With spent fuel in the reactor vessel, reactor coolant temperature increased 6.4 degrees until reactor protection system A was re-energized and shutdown cooling was restored. The licensee entered this issue into their corrective action program as Condition Report CR-RBS-2015-01216. The performance deficiency is more than minor, and therefore a finding, because it is associated with the Initiating Events Cornerstone attribute of configuration control, and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the tripping of the reactor protection system A motor generator set output breaker, resulted in a loss of power to the reactor protection system. This subsequently caused a loss of shutdown cooling and decay heat removal while the plant was shut down for a refueling outage. The inspectors initially screened the finding in accordance with Inspection Manual Chapter 0609, Appendix G, Shutdown Operations Significance Determination Process. The inspectors used NRC Inspection Manual 0609, Appendix G, Shutdown Operations Significance Determination Process, dated May 5, 2014, to evaluate the significance of the finding. The finding did not require a quantitative assessment because adequate mitigating equipment remained available and the finding did not constitute a loss of control, as defined in Appendix G. Therefore, the finding screened as Green. A cross-cutting aspect to this finding is not being assigned as this performance deficiency occurred in 1988 and therefore is not indicative of current licensee performance.
05000261/FIN-2015002-02Robinson2015Q2Failure to Follow Engineering Change Procedure for Modification of RPSA self-revealing Green non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, was identified for the licensees failure to follow EGR-NGGC-0005, Engineering Change, during a modification of the reactor protection system (RPS). This resulted in having inadequate work instructions associated with engineering change (EC) 75690 and EC 86690, which resulted in a cross-tied configuration of independent trains of the RPS and the DC electrical system. The licensee entered this into the corrective action program (CAP) as action request (AR) 729926 and took immediate corrective actions to cut the cable and restore the independence of safety trains for both systems. The failure to have adequate work instructions for engineering changes as required by procedure EGR-NGGC-0005 was a performance deficiency. This finding is more than minor because it is associated with the design control attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the cross-tied configuration rendered the RPS and DC electrical subsystem inoperable because the required independence and redundancy of systems were eliminated. The finding was screened using IMC 0609 Appendix A Exhibit 2.C, Reactivity Control Systems, dated June 19, 2012, and was determined to be of very low safety significance (Green) because the finding did not result in a mismanagement of reactivity by the operators. The performance deficiency had a cross-cutting aspect of teamwork in the area of human performance because the licensee failed to coordinate their activities between the work control planners and engineering to ensure nuclear safety was maintained.
05000338/FIN-2015002-01North Anna2015Q2Failure To Maintain An Adequate Maintenance Procedure For The Turbine Driven Auxiliary Feedwater PumpGreen. A self-revealing NCV of 10 CFR 50 Appendix B, Criterion V, Instructions, Procedures, and Drawings, was identified for the licensees failure to maintain an adequate maintenance procedure to set the governor valve on the Unit 1 Turbine Driven Auxiliary Feedwater (TDAFW) pump to the fully closed position. Specifically, the licensee failed to clarify key measurements in Maintenance Procedure 0-MCM-0412-02, Repair of the Terry Turbine Governor Valve, Revision 11, section 6.4.6, which sets the fully closed position of the governor valve that also adversely impacted the performance of the TDAFW system, and the TDAFW system suction source, the Emergency Condensate Storage Tank (ECST). This issue was entered this into the licensees corrective action program as CR 572803. The licensee failed to maintain an adequate maintenance procedure to set the governor valve on the Unit 1 TDAFW pump to the fully closed position was a performance deficiency (PD). Using Manual Chapter 0612, Appendix B, Issue Screening, dated September 7, 2012, the inspectors determined that the PD was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e. core damage) and is therefore a finding. The finding was screened in accordance with NRC Inspection Manual Chapter (IMC) 0609, Attachment 4, Initial Characterization of Findings, dated June 19, 2012, and was determined to affect the short term secondary system heat removal safety function within the Mitigating Systems Cornerstone. The finding was determined to represent a loss of system function of the auxiliary feedwater (AFW) system as the incorrectly set governor caused the TDAFW pump to run at higher discharge pressure under low flow conditions, lifting the TDAFW discharge relief valve, which bypassed approximately 200 gpm flow to the ground. With the loss of 200 gpm the ECST could not have met its mission time which represented a loss of system function requiring a detailed risk analysis. A detailed risk analysis was performed by a regional senior reactor analyst (SRA) in accordance with the guidance of NRC IMC 0609, Appendix A, The Significance Determination Process (SDP) for ndings At-Power, dated June 19, 2012, using the NRC North Anna SPAR model. The major analysis assumptions included: the ECST failed for a one year exposure period, no additional failure modes from the incorrectly set TDAFW pump governor valve other than the early depletion of the ECST, and no recovery for the condition other than to align to alternate suction source which remained at nominal failure probability. The dominant sequence was a loss of offsite power with success of reactor protection system, success of the emergency power system and late failure of AFW and late failure of feed and bleed leading to core damage. The risk was mitigated by the availability of other suction sources. The result of the analysis was that the PD represented an increase in core damage frequency of < 1.0 E-6/year, a GREEN finding of very low safety significance. The finding has a cross-cutting aspect in the area of human performance associated with resources attribute because leaders failed to ensure that personnel, equipment, procedures, and other resources were available and adequate to support nuclear safety to maintain the ECST inventory during the mission time.