February 27, 2007

I&C: Cook request (to allow reactor trip system and ESFA system instrumentation to be tested in bypass) in danger of failing acceptance review

DC Cook wants to allow reactor trip system (RTS) and engineered safety feature actuation system (ESFAS) instrumentation to be tested in bypass. The plant submitted an application about this to NRC, requesting amendment to tech specs, on September 15, 2006. NRC staff reviewed the application, and determined that insufficient information was provided. The following details are from an email from NRC to Cook, proposing that a conference call be scheduled for Cook to discuss the issues with NRC reviewer Hukam Garg.

The most notable omission, NRC told Cook, was the lack of information on the changes to the RTS and ESFAS systems to include the bypass capability. Page 5 of the submittal, titled Technical Analysis, states that: "Hardware changes necessary to be made to the NIS and Foxboro analog/digital protection system to facilitate testing in bypass will be implemented in accordance with 10 CFR 50.59." Standard Review Plan, Chapter 7, states that the review should include an evaluation of the protection system design against the requirements of ANSI/IEEE Std 279, or Reg. Guide 1.153, which endorses IEEE Std. 603, depending upon the applicant/licensees commitment regarding design criteria. The RTS review should address all topics identified as applicable by Table 7-1. Major design considerations that should be emphasized in the review of the RTS are:
* Design basis
* Single failure criterion
* Quality of components and modules
* Independence
* Defense-in-depth and diversity
* System testing and inoperable surveillance
* Use of digital systems

The same requirements are also applicable to ESFAS instrumentation. NRC noted that the application does not provide information showing how the bypass system capability meets all of the above guidance. Also, the application does not state that Cook has done the failure mode and effects analysis to determine if the failure of bypass system will not have any impact on accident analyses, or would not create new potential accidents. The current DC Cook licensing basis does not include any mass addition transients or accidents. As such, a change in the ESFAS or RTS system that creates the possibility for an inadvertent injection of water into the reactor coolant system (such as the inadvertent start of a charging pump), would require the licensing basis to include mass addition transients in the DC Cook licensing basis. If the licensing basis did not include these transients, neither the licensee nor the NRC could conclude that the proposed change poses no safety concern. There was no discussion on the brand and type of system, or the method used for the qualification of this system.

The email from NRC to DC Cook, dated February 15, 2007, is available as ADAMS ACN ML070460159.

December 28, 2005

* Ft Calhoun - TSC filtered vent system found rendered ineffective (an access cover had been removed)

April 22, 2005

* Arkansas - valve maintenance failure risked overfeed; a unique motor on Limitorque feedwater block valve didn't get manufacturer-recommended preventive maintenance despite procedural mention which had been appropriately applied by workers to less unique designs

March 22, 2004

* Perry - test of manual scram channel caused breakers to trip, many valves to close

* Limerick-1 - HPCI inoperable due to hand switch broken after successful system test

* Susquehanna - bucket truck work at cooling tower shorted 230KV line, injuring workers there and in plant

* Calvert Cliffs-1 - reactor trip due to short or ground during chart recorder maintenance

December 9, 2003

Nine Mile - several recurring and longstanding maintenance issues

... [S]ome recurring and long-standing issues remain to be resolved [at Nine Mile Point]. These issues included valve packing leaks, control rod drive pump failures, high pressure coolant injection system problems, feed pump clutch problems, and quality issues associated with maintenance procedures. The [NRC inspection] team independently evaluated the above items, and concluded that none of the items mentioned above resulted in an adverse safety or operability consequence.

[Source: Thomas R. Hipschman et al., "Inspection at Nine Mile Point October 6-10, and October 20-24, 2003", NRC Inspection Report 50-220-2003-11, December 1, 2003, p. 2]

September 1, 2003

Braidwood - lack of exercise hardened grease in (most) circuit breakers

Braidwood has a lot of circuit breakers, including about 3,000 of a "molded case" design known as Westinghouse adjustable magnetic HFB style, many of which are used on safety-related systems. The plant established a formalized testing program for these breakers some years ago, and identified that many of the breakers were failing the tests. In fact, of the 90 tested between June 2002 and June 2003, more than half failed. The problem appears to be that the grease inside the circuit breakers hardens over time. Westinghouse recommends cycling the breaker every month to move the grease around. This helps extend the operational life of the breaker. If left undisturbed, the grease will become quite like cement after as few as six or so years. Most of Braidwood's MCCBs were manufactured in 1970s-1980s. A recent NRC fire protection team evaluated the problem, and the plant's follow-up. The inspectors concluded that the plant should have had the grease problem under control long ago. NRC put out an information notice ten years ago describing the importance of exercising these breakers. The violation was categorized by NRC as a Non-Cited Violation. For more on this story, click here.

Source: Z. Falevits (Senior Reactor Inspector, NRC Region III), et al., Braidwood inspection report 50-456-2003-5, August 21, 2003

August 22, 2003

Perry - breaker problems mistakenly assessed as inapplicable to some types

A non-cited violation at Perry involved condition of 5kv cell switches. Rather than closing out the matter, the plant's corrective actions prompted NRC to find additional violation -- a mistaken assessment of the similar equipment -- auxiliary and 15kv breakers -- affected by the root cause identified. This finding was considered "more than minor because the failure to adequately identify extent of condition and take corrective actions to address degraded conditions could reasonably be viewed as a precursor to a significant event." Although the 15kv breakers are categorized as non-safety-related, the inspector noted "the risk significant loads which could have been adversely impacted included the 13.8kV bus L10 which supplies the Class 1E 4.16kV buses, the motor driven feedpump, and the recirculation pump motor fast speed supply breaker". The inspection report suggests that Perry should have been more curious as to why some 20% of the auxiliary switches inspected (by the same switch expert who inspected the cell switches) were found to require adjustment. Had this opportunity not been missed, the misanalysis of the 15kv breaker problem might have been identified. [full report, in pdf]

August 18, 2003

MSIV LLRT approach - potential generic issue at BWRs

NRC inspectors questioned Columbia Generating Station's practice of using instrument air to close main steam isolation valves (MSIVs) before local leak rate testing (LLRT). The instrument air system provides more pressure than the safety-related air accumulators that serve as design basis for MSIV operation, so the seal tightness conditions being tested weren't the same conditions desired to be tested. Calls to five other BWRs revealed that none of them actually tested the design basis conditions. Columbia's MSIVs did pass proper test when performed. For more info, see Columbia - MSIV LLRT had never been done right, and error may be pervasive at BWRs.

* Columbia - MSIV closure tests since 1989 used inadequate GE SIL instead of required ASME method [note: this is different than the LLRT story described above]

* Columbia - Turbine trip/reactor scram due to chafed wires on non-safety-related transformer prompts replacement of similar wiring, as it should have when the same problem caused trip 3 years ago

August 4, 2003

Lightning damage looked for, but missed

BWX-Lynchburg took steps to protect their criticality monitors during lightning storm, and checked them after the weather cleared. Six of them were damaged in such a way that they appeared to operate normally, but the alarm function did not work. NRC Information Notice 2003-10 was issued to describe some details -- read it here.

July 26, 2003

* McGuire-1 - wrong cable cut caused LCO, power down to 45% before repair complete 5-1/2 hours later (May 2, 2003)