This is my example of the NRC is managing the decline of Pilgrim. This should have been a lot bigger violation.
Personally I think this comes from all the hard starts these DGs have undergone in recent years in "Loss of Offsite Power" accidents. They are wearing them out. I predicted next LOOP, both DGs started up needing to supply the plant, one would fail on premature wear.
***Any little corrupt trick to get onto the other side of the surveillance-"Entergy staff determined that the X-107B EDG had been and remained operable because the volume of fluid that had been discharged would not have produced a hydraulic lock on cylinder 9L and therefore would not have prevented the engine from starting. Entergy staff exited TS 3.5.F at 2:30 AM.
General incompetence-"In discussions with the inspectors, Entergy staff stated that the condition did not render the EDG inoperable, but that they were entering voluntary LCOs for the purpose of investigation and troubleshooting only."
***Bet you for months they have been adding water to the expansion tank. Have they been getting low level alarms when operating. They log filling the expansion tank...this is first thing the inspectors should have done is get the long term trend on filling the expansion and fill tanks.
***From identification of the issue through correction of the problem by replacement of the 9L cylinder head, Pilgrim staff maintained that the condition had not caused the X-107B EDG to be inoperable.
***"Entergy staff stated that their EDGs were capable of operating with one cylinder removed from service; however, were unable to provide the inspectors with any design documents or engineering calculations showing that the EDGs would be capable of supplying design basis loads under such conditions."
***"Entergy procedure EN-OP-104, “Operability Determination Process,” Revision 9, states that, for an immediate operability determination, “if a piece of information material to the determination is missing or unconfirmed, and cannot reasonably be expected to support a determination that the SSC [structure, system, or component] is OPERABLE, the SM (shift manager) should declare the SSC INOPERABLE.”
I still think Entergy massaged this into a non cited violation from a required shutdown...
August 11, 2015
SUBJECT: PILGRIM NUCLEAR
POWER STATION - INTEGRATED
Pg 17
1R15 Operability
Determinations and Functionality Assessments (71111.15 – 6 samples)
Description. On March 18,
2015, at 2:15 AM, operators entered TS 3.5.F, “Minimum Low Pressure Cooling and
Diesel Generator Availability,” to perform pre-startup checks of the X-107B EDG
in accordance with procedure 8.9.1, “Emergency Diesel Generator and Associated
Emergency Bus Surveillance,” Revision 129. TS 3.5.F provides a 72 hour limiting
condition for operation (LCO) that can be extended to 14 days provided that all
low pressure core and containment cooling systems, and the SBO diesel generator
are determined to be operable. When the engine was rolled over with air to
verify that no fluid was present in any of the cylinders, engine coolant was
instead observed to spray out of the open cylinder test cock on cylinder 9L.
Entergy staff estimated that approximately six ounces of fluid was discharged.
This issue was entered into the CAP as CR-2015-02109. Entergy staff determined
that the X-107B EDG had been and remained operable because the volume of fluid
that had been discharged would not have produced a hydraulic lock on cylinder
9L and therefore would not have prevented the engine from starting. Entergy
staff exited TS 3.5.F at 2:30 AM.
On March 18, 2015, at 9:16
AM, Entergy staff determined that an inspection of cylinder 9L should be
performed, and entered TS 3.5.F. Initial troubleshooting was inconclusive as to
where the leak was coming from, leading Entergy staff to exit TS 3.5.F and
prepare additional troubleshooting plans. At 4:00 PM, Entergy staff entered TS
3.5.F to continue troubleshooting and perform additional inspections of the
cylinder head. The scope of this activity subsequently expanded to include
replacement of the associated cylinder head. In discussions with the
inspectors, Entergy staff stated that the condition did not render the EDG
inoperable, but that they were entering voluntary LCOs for the purpose of
investigation and troubleshooting only. Entergy staff performed surveillance procedure
8.9.16.1, “Manually Start and Load Blackout Diesel via the Shutdown Transformer,”
Revision 48, at 5:40 PM, to extend the TS 3.5.F allowed outage time to 14 days.
Testing of the replaced head showed the source of the leakage to have been from
the area of the cylinder exhaust valves. Entergy’s immediate corrective actions
included replacement of the X-107B EDG 9L cylinder head and sending out the
damaged cylinder head for analysis by a vendor. The completion of the analysis
by the vendor is being tracked by CR-2015-2109. Entergy staff exited TS 3.5.F
following successful post maintenance testing at 6:11 AM on March 21, 2015. From
identification of the issue through correction of the problem by replacement of
the 9L cylinder head, Pilgrim staff maintained that the condition had not
caused the X-107B EDG to be inoperable. Entergy staff stated that their EDGs
were capable of operating with one cylinder removed from service; however, were
unable to provide the inspectors with any design documents or engineering
calculations showing that the EDGs would be capable of supplying design basis loads
under such conditions.
The inspectors reviewed
CR-2015-02109 and the associated apparent cause evaluation (ACE). While the
inspectors agreed that the as-found condition would not have prevented the
X-107B EDG from starting, they did not conclude that the EDG remained operable.
Although the source of the engine coolant leak was unknown at the time of discovery,
it could reasonably have been due to a crack in the cylinder head. Such a leak
would have the possibility of worsening during engine operation. Although
hydraulic locking of the cylinder would not be a realistic concern during
engine operation, increased engine coolant leakage into the cylinder would result
in water intrusion into the crankcase and lubricating oil sump, which would
eventually cause the engine to fail to operable after
engine coolant had been identified in cylinder 9L.
Entergy
procedure EN-OP-104, “Operability Determination Process,” Revision 9, states that,
for an immediate operability determination, “if a piece of information material
to the determination is missing or unconfirmed, and cannot reasonably be
expected to support a determination that the SSC [structure, system, or
component] is OPERABLE, the SM (shift manager) should declare the SSC
INOPERABLE.” In this case, at the time of discovery, although the cause of the
leak had not been established, it could reasonably have been due to a crack in
the cylinder head. For the reasons discussed above, it could be concluded that
this condition would not support a determination that the X-107B EDG remained
operable. Additionally, an operability determination example presented in
Attachment 9.1, “Operability Classification Guide,” of this procedure indicates
that an EDG that cannot run for the duration assumed in the current licensing
basis should be considered inoperable. SDBD-61, “Design Basis Document for
Emergency Diesel Generator (EDG),” states, “The ‘mission time’ for the design
basis Loss-of-Coolant- Accident (LOCA) is 30 days for the long term containment
cooling analysis, as described in TDBD100 “Design Basis Document for Design
Basis Accidents, Transients and
Special Events
(DBATS).” Therefore, the inspectors further concluded that Pilgrim staff also should
reasonably have concluded that the X-107B EDG should have been declared
inoperable after engine coolant had been identified in cylinder 9L.
TS 3.5.F, “Minimum
Low Pressure Cooling and Diesel Generator Availability,” provides a 72 hour
allowed outage time for one EDG, provided the remaining EDG is demonstrated to
be operable per TS SR 4.5.F.1. TS SR 4.5.F.1 requires that, within 24 hours, a determination
be made that the operable EDG is not inoperable due to a common cause failure,
or that the monthly TS-required surveillance test be performed for the operable
EDG, and that, within 1 hour and every 8 hours thereafter, correct breaker
alignment and indicated power availability for each offsite circuit be verified.
If these requirements cannot be met, TS 3.5.F further requires that the reactor
be placed in cold shutdown within 24 hours. Since Entergy staff did not declare
the X-107B EDG inoperable as a result of the engine coolant leakage issue, but
instead entered what Entergy staff considered to be voluntary LCOs for the
purpose of investigation, only the portion of TS SR 4.5.F.1 for offsite breaker
verification was performed. Therefore, the inspectors additionally concluded
that Entergy staff’s failure to perform the required determination that the
operable EDG was not inoperable due to common cause failure constituted a violation
of TS 3.5.F.
The TS-required monthly surveillance test was satisfactorily completed on the X-107A EDG on April 2, 2015, approximately two weeks after the X-107B EDG 9L cylinder head coolant leakage event. While this did not eliminate the TS violation discussed above, it did demonstrate that, from a risk perspective, the X-107A EDG had been capable of performing its design safety function during that period.
Analysis. The inspectors determined that Entergy’s inadequate operability determination of the X-107B EDG after engine coolant was found in one of the cylinders, and resultant failure to determine that the X-107A EDG was not inoperable due to a common cause failure, or to perform the complete TS-specified EDG monthly surveillance test, within 24 hours in accordance with TS SR 4.5.F.1, was a performance deficiency that was within Entergy’s ability to foresee and correct, and should have been prevented. The finding was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, Entergy staff inadequately determined that the X-107B EDG was operable, which resulted in the operability of the X-107A EDG not being verified, either through determination that it was not inoperable due to a common cause failure or performing TS SR 4.5.F.1 in its entirety.
In accordance with IMC
0609.04, “Initial Characterization of Findings,” and Exhibit 2 of IMC 0609,
Appendix A, “The Significance Determination Process for Findings At-Power,” the
inspectors determined that this finding was of very low safety significance
(Green) because the performance deficiency was not a design or qualification
deficiency, did not involve an actual loss of safety function, did not represent
actual loss of a safety function of a single train for greater than its TS
allowed outage time, and did not screen as potentially risk-significant due to
a seismic, flooding, or severe weather initiating event.
This finding had a
cross-cutting aspect in the area of Human Performance, Conservative Bias,
because Entergy staff did not use decision making practices that emphasized prudent
choices over those that are simply allowed. Specifically, Entergy staff’s operability
determination for the X-107B EDG was based on the conclusion that the as found condition
would not have caused the engine to be inoperable because it would not have
created a hydraulic lock; they did not consider that the condition would likely
worsen during EDG operation, nor did their operability determination consider
EDG mission time [H.14].
Enforcement. 10 CFR 50,
Appendix B, Criterion V, “Instructions, Procedures, and Drawings,” states, in
part, that “activities affecting quality shall be prescribed by documented
instructions, procedures, or drawings… and shall be accomplished in accordance
with these instructions, procedures, or drawings.” Procedure EN-OP-104, “Operability
Determination Process,” Revision 9, states, in part, that “if a piece of information
material to the determination is missing or unconfirmed, and cannot reasonably
be expected to support a determination that the SSC [structure, system, or component]
is OPERABLE, the SM (shift manager) should declare the SSC INOPERABLE.” Also,
during any period when one EDG is inoperable, TS 3.5.F allows continued reactor
operation during the succeeding 72 hours, provided that the remaining EDG is
demonstrated to be operable in accordance with TS SR 4.5.F.1. TS SR 4.5.F.1 requires
that, within 24 hours, a determination be made that the operable EDG is not inoperable
due to a common cause failure, or that the monthly surveillance test be performed
on the operable EDG in accordance with TS SR 4.9.A.1.a, and that, within 1 hour
and once every 8 hours thereafter, correct breaker alignment and indicated
power availability for each offsite circuit be verified. If this requirement
cannot be met, then the reactor shall be placed in the cold shutdown condition
within 24 hours.
Contrary to the above, on March 18, 2015, Entergy staff performed an inadequate operability determination of the X-107B EDG following indications of engine coolant leakage in cylinder 9L, the X-107A EDG was not demonstrated to be operable in accordance with TS SR 4.5.F.1, in that a determination that the X-107A EDG was not inoperable due to a common cause failure was not made, nor was the monthly surveillance test performed on the X-107A EDG in accordance with TS SR 4.9.A.1.a. Because this violation was of very low safety significance (Green) and Entergy staff entered this issue into their CAP as CR-2015-2109, this violation is being treated as a NCV, consistent with Section 2.3.2 of the Enforcement Policy. (NCV 05000293/2015002-02, Inadequate Operability Determination for the X-107B EDG Results in TS Violation)
