BRAIDWOOD STATION 05000456/2014010 AND 05000457/2014010Nov 26
***Three violations shared the common element of being “Legacy Violations”; two of these three involved 10 CFR 50.59 issues. The licensee’s CCA identified several process improvements which appear likely to reduce future 50.59 deficiencies.
Does the NRC have a definition of what a legacy violation is...
Nov 12:
Look at how bad these guys are over the years.
TDAFW pump full flow test following governor replacement on September 13
Licensing Basis and FSAR.
Nuclear power reactors are licensed based on a given set of requirements, depending primarily on the type of plant. This set of requirements is called the plant’s “licensing basis." A principal licensing basis document is the plant’s final safety analysis report (FSAR). The FSAR and the plant‘s NRC license and associated technical specifications are the principal regulatory documents describing how the plant is designed, constructed, and operated. The FSAR is also a key reference document used by NRC inspectors during both plant construction and operation, and it must be sufficiently detailed to permit the staff to determine whether the plant can be built and operated without undue risk to public health and safety.
10 CFR 50.71
Because a plant’s design and operation are not static, certain changes are necessary over the course of a facility’s operating life. Reactor licensees must follow NRC regulations to justify and implement changes in the design basis and licensing basis for their facilities, and they are required to document such changes in the FSAR. 10 CFR 50.71(e) requires the FSAR to be periodically updated. The objectives of 10 CFR 50.71(e) are to ensure that licensees maintain the information in the updated FSAR (UFSAR) to reflect the current status of the facility and address new issues as they arise so that the UFSAR can be used as a reference document in safety analysis.
10 CFR 50.59
NRC has defined the changes that a licensee may make to a licensed facility without prior NRC approval. Pursuant to 10 CFR 50.59 (c)(1), the holder of a license may, without obtaining a license amendment, (1) make changes in the facility as described in the FSAR (as updated), or (2) make changes in the procedures as described in the FSAR (as updated), and conduct tests or experiments not described in the FSAR (as updated) as long as a change to the technical specifications incorporated in the license is not required, and the change, test, or experiment does not meet any of the eight10 CFR 50.59 (c)(2) criteria. if any of the criteria in 10 CFR 50.59 are not met (i.e., the change involves modification to the technical specifications or involves one of the eight criteria), the license holder must apply to NRC for a license amendment and obtain NRC’s approval before implementing the change. NRC staff document their safety analysis of a license amendment request in a safety evaluation providing the technical, safety, and legal basis for NRC's disposition of the license amendment request.
2) The NRC OIG don't have the expertise and experience to make independent judgements on their own. They are all drinking from the same poisoned well.
3) In the opening stages of the SONGs event, the NRC threw the second string NRC players out to the field. What is the nature of time and oversight limitations on updating design and licensing basis documents at Millstone and Regions I? Region IV seems to had a profound lack of training and experience with their policies, guilds and procedures, indeed their policies and procedure were skimpy on overseeing licensing and their bases...has region I overcome this deficiency?
4) I have issues with AIT inspections whose aims to to "understand the event"...with the charter limiting the breadth of the investigation under some unseen agenda.
5)Destructive engineering organizational stove piping, cubby holing and categorization.
6)(Gary J Kline chief engineer at SONGS) All management meetings associated with special inspections and AIT inspections should be recorded and disclosed to the public. This should be the primary means to hold NRC management accountable. As it stands now, management is never made accountable! Something like a NTSB public meeting and testimony?
9) Personally, I think from the 2009 NRC inspection, SONGS maliciously obfuscated information they knew needed a licensing amendment and full blown public hearings. They played the NRC like a fiddle!
10) What is in the interest of the nation versus word games and legalese?
He said that 1O CFR 50.59 specifies that if the licensee departs from the methodology as described in the FSAR, then a license amendment is needed. However, because the FSAR did not contain what was used for the original steam generators, there was no basis to conclude a departure from methodology had occurred.
He said, "if the methodology is not in the FSAR, they didn't depart from it. So legally, by 50.59, they don't meet that criteria."
11) "He said that all inspections are done by sampling."
13) The operators generally consider the FSARs as "comic books"...valuable information is so sporadic and there is so little technical design and licensing information in them. No basic licensing information in them, means less violations over the lifetime of a plant. Some think that was dominant philosophy at plant beginnings.
REPORT 05000336/2014011 AND 05000423/2014011
At 0701, on May 25, 2014, a dual-unit reactor trip occurred at the Millstone Station. Prior to the event, the station had one offsite line out-of-service (OOS) (Line 371) for maintenance. A suspected ground fault on the grid in the Northeast Utilities’ Card substation caused the loss of offsite line 383. Line 310 tripped on instantaneous ground over current which was unexpected. The final line (Line 348) tripped on over current when both units attempted to feed the full power output of both Millstone units through the single remaining line (Line 348).
Dominion concluded in the 10 CFR 50.59 screening that a 10 CFR 50.59 evaluation was not required and therefore, prior NRC approval was not needed to implement this change. However, the team concluded that had Dominion completed a 10 CFR 50.59 evaluation, it was likely that NRC approval would have been required prior to implementation.
The UFSAR further specified operability requirements for SLOD when one transmission line was taken OOS: (1) to have SLOD fully operational, and limit the net station output ≤ 2500 mega-watt (MW) and limit the output of Unit 3 to the Maximum Allowable Millstone Generation Contingency limit, if applicable, or (2) reduce load to a total station output of ≤ 1750 MW (Gross)/1650 MW (Net) within 30 minutes after the element (transmission line) is removed from service.
This condition impacts the reliability of the offsite power sources. SLOD was designed to prevent a total loss of offsite power that is caused by conditions described above, by reducing station electrical generation output. SLOD was designed to detect this condition by monitoring the Millstone total generation output (< 1750 MWe) and monitoring each transmission line for power flow (+/- 10 MWe). In this postulated fault scenario, SLOD initiates a trip signal to the Millstone switchyard breakers 15G-13T-2 and 15G-14T-2 (Unit 3 Generator tie line breakers), resulting in isolation of the Unit 3 generator from the grid (which would result in a load rejection Unit 3 trip), leaving Unit 2 in synchronism with the grid, and maintaining offsite power to both units.
The team determined that if the SLOD SPS had been in service, only Unit 3 would have tripped and Unit 2 would have remained online and providing at least one offsite power source.
The team identified that in 2012 and 2013, Northeast Utilities, the transmission entity and the owner of the Millstone switchyard, modified transmission circuits at the Millstone switchyard to eliminate the existence of the simultaneous double circuit fault scenarios, which as discussed previously, existed due to the physical placement of two transmission lines on a common tower. This modification by Northeast Utilities installed two new transmission paths going out of the Millstone switchyard. The new offsite transmission line configuration consisted of four, single 345 kV transmission lines each located on a single circuit tower and transmission path, which is illustrated in Figure 3 of Attachment 4, of this inspection report.
The team also noted this modification included removal of the SLOD SPS, based on a belief by Northeast Utilities and Dominion that it was no longer required. At the time, Dominion believed that the removal of the DCT configuration eliminated the credited fault scenarios contained in the design and licensing bases of both units. The team noted that on December 20, 2012, Northeast Utilities disabled the active trip function of the SLOD SPS at the Millstone switchyard. The elimination of SLOD also resulted in physical modifications to switchyard supervisory panel CRP 909 in the Millstone Unit 1 control room, and required updates to various Millstone documents, including the UFSAR and operating procedures. These modifications and document updates were performed through implementation of a design change process in accordance with Dominion fleet and Millstone-specific procedures. These design change documents included a 10 CFR 50.59 screening and applicable safety analysis report (SAR) change notices for both the Millstone Unit 2 and 3 UFSARs.
The team noted that Dominion’s 10 CFR 50.59 screening for the SLOD SPS design change concluded that a full 10 CFR 50.59 evaluation was not required, because it incorrectly concluded that the SLOD system had no safety functional requirements that were credited in the safety analysis. Therefore, removal of SLOD did not have an adverse effect on any UFSAR-described design function. However, the team identified that not only is SLOD described in the UFSAR, but also documented a specific design function to prevent a dual-unit trip and total LOOP and maintain the stability of the electric grid under certain analyzed fault scenarios.
As previously discussed, one of the credited fault scenarios described in the UFSAR, was the simultaneous loss of two transmission circuits on a common structure, which occurs while one of the remaining transmission circuits is OOS. The SLOD SPS design change attempted to eliminate this credited fault scenario by routing all four 345 kV transmission lines on separate towers and transmission paths. The team identified that the new design lacked physical independence from the other transmission lines, in that the physical separation or distance between the newly-installed towers and the existing towers was not adequate (illustrated in Figure 3 of Attachment 4). Specifically, the team determined that under specific circumstances, the credited mechanical tower failure could still result in the simultaneous loss of two transmission circuits based on the 75 foot distance between the original double-circuit tower and the newly-installed tower. The team concluded that this new design configuration of the transmission towers and offsite lines is not completely different from the original configuration, in regards to the credited fault scenario that results in the loss of three of the four transmission lines. Moreover, the team determined that the separation of the transmission lines onto individual towers, and the use of this assumption as a basis for removal of the SLOD SPS results in adverse effects on the specified UFSAR described design function of maintaining a stable electric grid.
As a result, the team determined that this automatic function could not have been substituted with human interaction (i.e., manual action within 0.30 seconds (18 cycles), the specified design function), and therefore, prior NRC approval was likely required.
Removal of the SLOD SPS may have caused more than a minimal increase in the likelihood of occurrence of a malfunction of the offsite power system. Removal of the SLOD SPS without development of procedural guidance to direct operator action to reduce power in the event of the loss of transmission lines, did not minimize the probability of losing electric power from any of the remaining offsite lines as a result of loss of power from the transmission network.
...Dominion should have implemented the combined-unit output limitations such that given the event of May 25, 2014, neither unit would have experienced a LOOP.
...The major difference in risk being that the Unit 2 turbine-driven auxiliary feedwater (TDAFW) pump does not automatically start and the preferential use of the station blackout (SBO) EDG for Unit 3 during a dual-unit SBO event. inopHere the NRC says Dominion failed to notify the NRC through the 50.59 screening process they need no 50.59. See how contradictory and confused the agency is. I would consider Dominion maliciously and corruptly didn't fill out the paperwork to hide they were talking out the safety circuit on the transmission system. I'll bet you the ultimate motivation of Dominion, was we will yank out this safety circuit towards the ends of preventing unnecessary plant trips of the circuit fails or shorts.
Remember NRC allegations said repeatedly (the regional ISI guy at the plant submitted it to allegations and they immediately called me) said to me the inspectors our overwhelmed with 50.59 documents.. the inspectors can't possibly review each 50.59 or screen. I am tired of the officials making blind assertions without the evidence to back up their statement. Like how many 50.59s a year occur at Millstone. Does it seem reasonable the inspectors are overloaded with screenings and 50.59s? As I told the Allegation inspector, if the NRC was really a learning organization, they would transparently questions why they didn't see the screening documents and intervene on the design change to prevent removing the FSAR transmission safety circuits and withdrawing the site's power limitations that would have prevented the LOOP. A good regulator are supposed to see these accidents before they occur.
Remember, the 50.59 screening document is important. If there was no screening document, then Dominion was trying to obstruct the oversight of the regulators. If there was a 50.59 screening document, then the NRC has no excuse in not preventing this LOOP. The inspectors and higher officials are required to inspect all 50.59s and their screenings. If these inspector and managers don't have manpower(womenpower)to carry out their statutory and procedural requirement, then then they should be raising the roof of the NRC and commissioners itself, in they don't have enough resources to carry out their job according to NRC policy. I contend this is systemic upper level intimidation to the low level inspectors and managers that they can't raise issues that they can question if they have adequate resources to carry out their jobs according to NRC policy! Remember also, the nuclear utilities and the NEI inself contend, if the NRC inspectors and their managers had adequate funding for all their policies and rules, then the industry would be severely overregulated and then be put at a disadvantage to all the other grid energy sources.
...These components, removal of SLOD and installation of the two transmission paths, were accomplished without direct supervision from Dominion. However, due to the elimination of SLOD, physical modification to the switchyard supervisory panel CRP 909, in the Millstone control room and updates of various Millstone documents, the UFSAR and operating procedures, were required. Dominion prepared and implemented a design change (MPG-12-01018) to accomplish these actions.
- (Enforcement)Dominion allowed a design change to the offsite power system (removal of the severe line outage detection system), a system described in the UFSAR, and failed to conduct a written evaluation or provide a basis for the determination that the change did not require a license amendment in accordance with 10 CFR 50.59 (c)(2).
The below is the old decentralization model where they allow all their nuclear plants to make up on their own codes and rules. Entergy and Palisades went through this "libertarian model" phase of corporate decentralization and obfuscation of high corporate control on their property and accountability.
- (Inspection team)The elimination of SLOD also resulted in physical modifications to switchyard supervisory panel CRP 909 in the Millstone Unit 1 control room, and required updates to various Millstone documents, including the UFSAR and operating procedures. These modifications and document updates were performed through implementation of a design change process in accordance with Dominion fleet and Millstone-specific procedures. These design change documents included a 10 CFR 50.59 screening and applicable safety analysis report (SAR) change notices for both the Millstone Unit 2 and 3 UFSARs.
One wonders if the same libertarian model of decentralization (contempt for standards of behavior, government and a higher authority) is going on between the NRC inspectors and their middle and upper managers. It is old high level executive protection racket! In other words, abandon the plant inspectors to the raging storm all around them, so they have to fight for survival on their own.
...These components, removal of SLOD and installation of the two transmission paths, were accomplished without direct supervision from Dominion. However, due to the elimination of SLOD, physical modification to the switchyard supervisory panel CRP 909, in the Millstone control room and updates of various Millstone documents, the UFSAR and operating procedures, were required. Dominion prepared and implemented a design change (MPG-12-01018) to accomplish these actions....The team determined that Dominion’s failure to implement their design change process procedure was a performance deficiency. Dominion did not follow their design change process in evaluating the impact of the design on the offsite power requirements. This performance deficiency was more than minor because it was associated with design control attribute of the initiating events cornerstone and affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions during shutdown and power operations.
...The May 25, 2014, event was outside of the Millstone licensing basis, because the sequence of occurrences that resulted in a dual-unit LOOP, was attributed to a fault on a transmission line that was properly cleared by relay operations at Millstone switchyard, but the same fault was sensed by a distance relay located in a substation several miles from the Millstone, which caused a loss of second transmission line.
The regulatory scheme is set up to alway reactive. They don't give the NRC inspectors and the NRC enough horsepower in the anticipatory mode! It is called being crazy, the control of the of the SLOD not being under NRC enforcement. There goes that libertarian (government hating) and decentralization model again? It is god damn pathetic when government employees favor the libertarian model...but it makes their jobs easier!
Enforcement: This finding does not involve enforcement action because no violation of regulatory requirements was identified, as SLOD was a non-safety related system, and therefore, not subject to 10 CFR Part 50, Appendix B requirements. Dominion entered this performance deficiency into their corrective action program (CR 553968). Because this finding does not involve a violation of regulatory requirements and is of very low safety significance (Green), it is identified as a finding. (FIN 05000336, 423/2014011-02, Inadequate Implementation of Dominion’s Design Change Process).NRC Oversight of Licensee’s Use of 10 CFR50.59 Process To Replace SONGS’ Steam Generators Case No. 13-006
Findings
Issue 1. Missed Opportunities During
NRC Region IV 2009 I
OIG found that NRC missed an opportunity during
a 2009 triennial baseline
inspection
of
SONGS' implementation of the 10 CFR 50.59
process to identify weaknesses in the SONGS steam generator 50.59 screening and evaluation package.
While a Region IV inspection team selected the SONGS
Unit 2 steam generator 1O CFR 50.59 screening and evaluation package as one of 35 items sampled
during a 2009 triennial baseline ROP inspection at SONGS,
the inspection team did not identify various shortcomings noted more recently by NRC subject
matter experts who reviewed the steam generator screening and evaluation package
subsequent to SONGS'
shutdown due to problems with steam generator design.
The 2009 inspection
team concluded from its review of the 35 items sampled that SONGS had correctly determined that the changes
SONGS made could be made without a license amendment. However, the NRC subject matter
experts who reviewed the Unit 2 steam generator
screening and evaluation package following
SONGS' shutdown identified questions
pertaining to the Unit 2 steam generator 1O CFR 50.59 screening and evaluation, some of which NRC says cannot now be answered based on available information. The questions
raised by the subject matter experts pertain
to (1) insufficient support
for 10 CFR 50.59 evaluation conclusions that contributed to the decision that a license amendment was not needed
and (2) methodology changes that should have been considered for screening but were not listed in the screening
documentation. OIG found
that (1) without knowing whether everything that should have been screened
was screened, and the outcomes
of these screenings, and (2) without reviewing additional
information concerning the evaluation conclusions, there is no assurance that NRC reached
the correct conclusion in its 2009 inspection
that SONGS did not need a license amendment
for its steam generator replacement.
OIG found that the primary inspector who reviewed the SONGS Unit 2 steam
generator 10 CFR 50.59 screening
and evaluation package
during the 2009 baseline
inspection (at approximately the same time installation of the Unit 2 steam generators commenced) described
conducting a review that aligned
with inspection guidance, buts aid that in hindsight, with the experience he now has, he
might have probed further into certain aspects of the screening and evaluation package.
This inspector, and others interviewed during the investigation, identified a need
for improvement in training and guidance
to inspectors for the 50.59
inspection. Although several senior
managers acknowledged some of the shortcomings in the SONGS screening
and evaluation package, they supported
NRC's inspection approach, which relies on sampling and judgments made by inspectors with different backgrounds and experience levels. One senior manager expressed confidence in the 50.59
inspection process, and noted that the purpose
of NRC's 50.59 inspection
is not to identify design flaws, but rather to determine whether licensees are correctly
implementing the 50.59 rule and reaching the correct conclusions as to the need
for NRC preapproval. At the same time, senior managers, subject matter
experts, and inspectors expressed general agreement that NRC needs to improve its 10
CFR 50.59 inspection
training and guidance.
Issue 2. AIT Review of SCE's
10 CFR 50.59 Evaluation
OIG found
that although an NRC Region IV2 Augmented Inspection Team (AIT), established to assess the circumstances surrounding the tube leak and unexpected wear of tubes in the
Unit 3 steam generators, included
a review of the SONGS 50.59 steam generator package
to determine whether
SONGS needed a license amendment prior to installing the new steam generators,
the AIT did not document an answer to this question. In its initial July 18, 2012, inspection report,
the AIT communicated that the
Office of Nuclear Reactor
Regulation (NRR) Project
Manager assigned to perform the review identified
one unresolved item (URI number
10, "Change of methodologies associated with 10 CFR 50.59 review'') for which additional information was needed to determine if performance deficiencies exist or if the issues constituted violations of NRC requirements. The URI described two instances that failed to adequately address whether
the change involved a departure of the method
of evaluation described
in the UFSAR. Although
NRC's November 9, 2012, AIT followup
report documented the closure of this URI, and stated
that neither change would have required
a license amendment, it did not answer the overall question
of whether a license amendment was required.
The AIT Team Leader and the current Region IV Deputy
Regional Administrator told OIG that based on what NRC reviewed during
its inspections, the conclusion
was that a license amendment was not needed,
although each allowed that the sampling approach used to perform this assessment could have missed
something. The Acting
NRR Director said he could not determine if an amendment
was needed or not due to the gaps that may exist regarding items that may require
screening and/or evaluation. The current Region IV Deputy Regional Administrator said additional inspection would be required to answer
whether a license
amendment was required, and questioned whether it would be a prudent use of resources
to go back and accomplish that. The former Region IV Deputy Regional
Administrator said that in hindsight, he believes that SONGS should have requested a license amendment from NRC prior to making the change. He also believes the steam generator design was fundamentally flawed and would not have been approved
as designed. He said the AIT discussed
a potential 50.59 criteria violation because of the design issues;
however, the AIT ultimately identified a design
control violation.
OIG found
that NRC's justification for closing out URI number 1O does not align with specific language in 10 CFR 50.59 concerning NRC approval for a change in methodology, but was based instead on Region IV's interpretation (in consultation with NRR) of the rule. 10 CFR 50.59 (a)(2)(ii) reflects
that changes from a method described in the UFSAR to another method
are permissible without
NRC preapproval if that method has already been approved
by the NRC for the "intended" application. In closing out the URI, however,
the AIT followup
report determined the change of methods would not have required
a license amendment based on NRC's
approval for the use of the method
at other nuclear
power plants in "similar'' applications. OIG notes that while the AIT characterized the issue as a change in methodology, it justified closing the matter based on approval for a "similar'' application rather than the "intended" application as stated
by the rule.
OIG also notes that while the AIT inspection report identified an unresolved issue pertaining to the SONGS 10 CFR 50.59 screen
and evaluation package,
the NRR technical specialist
who reviewed the package
used a sampling approach and did not identify
many of the shortcomings described under issue 1 of this report.
Issue 3. NRC Oversight of SONGS UFSAR
OIG found that NRC does
not consistently use one of its primary oversight methods to assess whether licensees
are keeping their power plant licensing basis documentation up to date as required by 10 CFR 50.71(e). Although licensees are required,
per 10 CFR 50.71(e), to biannually submit UFSAR updates reflecting the current status
of the facility so that the document
can be used as a reference document
in safety analysis, the NRR project managers
tasked to review these submittals
do not always conduct the reviews within the required
90-day timeframe. Moreover,
although licensees
also must biannually submit, per 10 CFR 50.59(d)(2), information concerning changes
made under 10 CFR 50.59 without NRC prior approval,
NRR project managers
- who are instructed to consider this information during their review
of 10 CFR 50.71(e) submittals - do not always
take the 1O CFR 50.59(d)(2) information into consideration during their reviews. OIG found that while NRC expects a plant's UFSAR to accurately reflect a plant's licensing basis, the former Region IV Deputy
Regional Administrator said that during the SONGS AIT, Region IV staff
noted the licensee had made many changes
to the steam generators over a 25-year period that were not reflected in the UFSAR or consistent with the original
Safety Analysis Report (SAR.).
OIG reviewed documentation of project manager reviews in two NRR branches and found project managers reviewed only 5 of the 21 most recently
received licensee UFSAR submittals within the 90-day timeframe, while 7 were reviewed between 90 days and a year after receipt,
and 9 reports more than a year after receipt. Moreover, only two of the project
manager reviews contained
a reference to review of 10 CFR 50.59 documentation submitted
by licensees even though project
manager guidance
directs that this occurs.
OIG also found that over a 10-year period,
NRC staff documented two
reviews of changes to SONGS' UFSAR, although the licensee
submitted six UFSAR updates during
this period as required, and neither
NRC review mentioned consideration of 10 CFR 50.59
changes.
Although senior
NRC managers expect
the project managers
to conduct the reviews within the required
timeframe, and to consider changes made under 10 CFR 50.59 as part of that review, two NRR project managers
interviewed said the reviews
are considered a low priority. Neither
of the project managers
included the 10 CFR 50.59 information in their reviews
of 50.71(e) submittals; one thought
this review was conducted by a different NRR group and the other thought
the 10 CFR 50.59 information was used by regional inspectors for a different
purpose.
In contrast, the Deputy
Executive Director for Reactor Preparedness Programs considers NRC's oversight of 10 CFR 50.71(e) to be critical for enabling
NRC to know
whether a plant is in compliance with its licensing
basis, and considers the project manager review of 50.71(e) submittals to be a priority. While
the former NRR Director also expected project managers to conduct
the required reviews to assess whether changes made by the
licensees have generally been updated
into the FSAR, he viewed the project manager's review as a bookkeeping exercise
that is based on the experience of the project
manager. He noted
that the FSAR review
is a self-imposed requirement and if NRC is not meeting its own internal guidance, then it should either meet the requirement or change the guidance based on safety
significance.
SamplingNuclear reactor licensees have used the 10 CFR 50.59 process thousands of times to make changes without NRC preapproval. Licensees conduct about 475 1O CFR 50.59 screenings per unit per year, and about five 10 CFR 50.59 evaluations per unit per year for a nationwide total of about 49,000 screenings and evaluations per year.
As noted in NRC Inspection Manual Chapter 2515, "Light-Water Reactor9 10 Inspection Program - Operations Phase," the NRC inspection program covers only small samples of licensee activities in any particular area. The sample sizes specified in the inspection procedures are based on the relative importance of the area covered by the procedures to the other areas inspected by the program. They are also based on the inspectors choosing a "smart" sample instead of a statistically based random sample because the risk-informed nature of the inspection program requires the inspections to be focused on those aspects of plant operations and licensee activities that could pose the greatestrisk to public health and safety.
...The four-page 2008 inspection procedure directed inspectors to (a) triennially review 6 to 12 licensee evaluations required by 10 CFR 50.59 and 12 to 25 changes, tests, or experiments that were screened out by the licensee and (b) triennially review 5 to 15 permanent plant modifications. The overall resource estimate was 172 to 212 hours for the entire inspection, which "should be performed by engineering specialists knowledgeable in the affected subject areas."
...First, OIG compared the SONGS' Unit 2 steam generator 10 CFR 50.59 screening and evaluation against the UFSAR that would have been available to the 2009 inspection team and identified at least 14 changes in methods of evaluation used to test the new design in the UFSAR that were not listed in the SONGS screening.
...The Team Leader thought existing 10 CFR 50.59 guidance could be improved. She said she attended a November 2011 counterpart meeting for alignment between the regions on implementation of the 50.59 inspection procedure. She recalled that each region interpreted the inspection procedures differently. Additionally, the Team Leader said there was no specific training for 50.59. She thought NRC has a good 50.59 inspection program, but it needs to be revamped to eliminate these discrepancies.
...However, he said his approach would be to go through each UFSAR chapter and "Google search steam generator. Every time steam generator comes up, I'm going to read the pertinent information."
So the question from the lessons learned...why didn't the Millstone interviened before they took out the SLOD and change the transmission system.
See, the NEI is tasked with advocating for the economic interest of a licensee. They do a good job for the utilities. From a public safety perspective, you should be thinking look at how close to the new delay relay time is from the actual start time and the legal limit. Then you are moving the new relay time right up to the safety limit of 12 seconds...you have to be thinking what safety limit and sensitivities are you getting closer too. You should be thinking what is the accuracy is of the new relay and its quality. You should be asking at what time limit pass 12 sec do you get core damage and the possibility containment failure. You would have to be think, this delay is moving right up to the safety limit, both DGs, I got to throw this into the full fledge 50.59 in order to cover my our asses. This isn't really a technical limit or legal limit, this is how we use our intelligence to protect of safety limits or protect our margin of safety. The idea of moving a DG start time really right up to its legal limit and then dumping it out of the 50.59 through a screening process is repugnant and nauseating.
Pg 33:To further illustrate the distinction between 10 CFR 50.59 screening and evaluation, consider the example of a change to a diesel generator-starting relay that delays the diesel start time from 10 seconds to 12 seconds. The UFSAR-described design function credited in the ECCS analyses is for the diesel to start within 12 seconds. This change would screen out because it is apparent that the change will not adversely affect the diesel generator design function credited in the ECCS analyses (ECCS analyses remain valid)
DOMINION NUCLEARCONNECTICUT, INC. (DNC) MILLSTONE POWERSTATION UNITS 2 AND 3 RESPONSE TO AN APPARENT VIOLATION IN NRC SPECIALINSPECTION REPORT 05000336/2014011AND 05000423/2014011; EA-14-12
Apparent Violation
As stated in the summary section of NRC Special Inspection Report,05000336/2014011 and 05000423/2014011, during an NRC team inspection conducted between June 2 and July 15, 2014, "the NRC identified a Severity Level Ill Apparent Violation (A V) of Title 10 of the Code of Federal Regulations (10 CFR) 50.59, "Changes, Tests, and Experiments," for Dominion's failure to complete a 10 CFR 50.59 evaluation and obtain a license amendment for a change made to the facility as described in the Updated Final Safety Analysis Report (UFSAR). Specifically, ... a special protection system (SPS), known as severe line outage detection (SLOD), [was removed] which was described in the UFSAR. Dominion concluded in the 10 CFR 50.59 screening that a full 10 CFR 50.59 evaluation was not required and, therefore, prior NRC approval was not needed to implement this change. The team concluded that prior NRC approval likely was required because the removal of SLOD may have resulted in more than a minimal increase in the likelihood of occurrence of a malfunction of the offsite power system as described in the UFSAR."
Response to the Apparent Violation
Dominion Nuclear Connecticut, Inc. (DNC) submits the following information in response to NRC Special Inspection Report 05000336/2014011 and 05000423/2014011 which was issued by the NRC on August 28, 2014. DNC chooses to respond in writing to AV 05000336/2014011 and 05000423/2014011 and declined the opportunity for a Pre-decisional Enforcement Conference (PEC) and the opportunity to request Alternative Dispute Resolution (ADR) during a phone call on September 8, 2014, between Lori Armstrong of DNC and Raymond McKinley, Chief, Division of Reactor Projects Branch 5, NRC Region I.
1) The reason for the Apparent Violation (AV) or, if contested, the basis for disputing the violation DNC does not contest the apparent violation.
NRC's review and approval of the change to the Millstone Power Station Unit 2 (MPS2) and 3 (MPS3) licensing basis for the removal of SLOD was not requested by DNC because of an inadequately prepared 10 CFR 50.59 screen. In the 10 CFR 50.59 screen, Engineering personnel failed to consider that the removal of SLOD was an adverse change relating to DNC's compliance with General Design Criteria (GDC) 17, and therefore did not conclude that a 10 CFR 50.59 evaluation was needed.
The root cause evaluation for this AV identified the direct cause as a lack in proficiency and skill in performing 10 CFR 50.59 screens. The root cause for this AV was determined to be that continuing training was not adequate to maintain the proficiency and skills for consistent, accurate screens. Corrective actions were needed to address the screening deficiency identified in the apparent violation.
The complexities associated with the technical issue, multiple responsible entities involved, and understanding of the MPS2 and MPS3 licensing basis are also relevant to understanding the contributing factors for the AV. During review of this AV, it was determined that DNC's error of not performing a 10 CFR 50.59 evaluation occurred during the design development for the removal of SLOD by the transmission owner, Northeast Utilities (NU). During the design development, DNC did not recognize that NU's removal of SLOD resulted in a change in the method of compliance with GDC 17 that required DNC to perform a 10 CFR 50.59 evaluation. This matter is further addressed in the Additional Information provided below.
2) The corrective steps that have been taken and the results achieved
With removal of SLOD, and as discussed in the Additional Information provided below, the station no longer met the method for compliance with GDC 17 approved by the NRC at the time of original licensing of MPS3. As documented in NRC Special Inspection Report 05000336/2014011 and 05000423/2014011, DNC implemented a compensatory measure by issuing an Operations standing order for interim guidance on future offsite line outages and plant generation output. In March 2014, prior to the NRC Special Inspection, DNC had separately implemented improvements in the procedural guidance for performing 10 CFR 50.59 screenings.
These improvements were the result of DNC identified gaps in performance of 10 CFR 50.59 screenings. Improvements included a major rewrite and expansion of the guidance for completing 10 CFR 50.59 screens using a more user-friendly format. The procedure now includes more detailed guidance for responses to each section of the screen form including direct references to NEI 96-07, Guidelines for 10 CFR 50.59 Implementation.
In August 2014, training was provided on an expedited basis to a select population (the majority) of 10 CFR 50.59 screeners. The training included discussion on the fundamentals of GDC compliance and the importance of identifying and reviewing the impacts of design changes upon the licensing basis, including the FSAR. Only personnel who have received the training are presently qualified to perform 10 CFR 50.59 screens.
Design changes scheduled for implementation in the remainder of 2014 have been reviewed by Design Engineering to determine whether adequate licensing basis reviews were conducted as part of the 10 CFR 50.59 screenings. No 10 CFR 50.59 screens were identified which should have concluded a 10 CFR 50.59 evaluation was required.
3) The corrective steps that will be taken
To become qualified to perform 10 CFR 50.59 screens, future training will include a discussion of the fundamentals of GDC compliance and the importance of identifying and reviewing the impacts of design changes upon the licensing basis, including the FSAR.
A review of the 10 CFR 50.59 screens for FSAR changes processed in the past three years will be conducted by April 1, 2015 to determine whether adequate licensing basis reviews were conducted.
DNC is evaluating options for addressing compliance with GDC 17. To complete this work, engineering analysis, including consideration of potential design modifications, is necessary. Upon completion, a License Amendment Request (LAR) will be submitted to the NRC requesting review and approval of a licensing basis change to the MPS2 and MPS3 FSAR that addresses the removal of SLOD. DNC will keep the senior resident inspector informed of the status and schedule for resolution.
4) The date when full compliance will be achieved
Full compliance was achieved when training was provided in August 2014. To ensure future continued compliance, the 10 CFR 50.59 training module will be updated to include a discussion of the fundamentals of GDC compliance and the importance of identifying and reviewing the impacts of design changes upon the licensing basis, including the FSAR.
Additional Information:
The SLOD system was owned by the transmission system owner, NU. Removal of SLOD was a result of a major transmission line upgrade project to improve grid reliability by separating lines and towers leaving the MPS switchyard. This separation allowed NU to eliminate SLOD, which they no longer considered reliable or secure. The upgrade, as it was presented, reduced risk to MPS and improved grid reliability to MPS. Representatives of DNC and NU participated in multiple Nuclear Plant Interface Meetings (NPIMs) coordinated by ISO New England (the transmission system operator). These meetings, which began several years in advance of the actual physical modifications, included discussions of proposed changes to the transmission system.
The transmission upgrade project by NU involved rerouting the transmission lines from four lines on two towers to four lines on four separate towers. The removal of SLOD was presented in the aggregate as an improvement in grid reliability, conforming to present transmission system standards. According to the North American Electric Reliability Corporation standard on special protection systems (SPSs), SPSs such as SLOD carry with them unique risks including, risk of failure on demand and inadvertent activation, and risk of interacting with other SPSs in unintended ways. Thus, at the time, DNC, ISO New England, and NU believed that separation of the towers/lines removed the vulnerability which SLOD was installed to mitigate and represented an improvement in grid reliability. Therefore, following tower line separation, SLOD was disabled and eventually removed. DNC recognizes that during the design development for the modified transmission circuits, there were opportunities to understand that the Millstone licensing basis was impacted by the removal of SLOD and that a 10 CFR 50.59 evaluation would be required. DNC accepted the changes proposed and approved by NU, ISO New England, and the Northeast Power Coordinating Council without adequately considering the impact to the MPS licensing basis. The complexities associated with the specific technical issue, multiple responsible entities involved, and understanding of the licensing basis all played a part in the failure to recognize the impact of the change on the licensing basis.
The 10 CFR 50.59 screen failed to consider that the removal of SLOD was an adverse change relating to DNC's compliance with GDC 17, and therefore did not conclude that a 10 CFR 50.59 evaluation was needed. It was the belief that the tower and line separation project, including SLOD removal, was undertaken by NU for the sole reason to enhance grid stability and reliability, providing a more stable source of offsite power to MPS. That belief resulted in the DNC mindset that the removal of SLOD references from the FSARs did not require further evaluation. Following the May 25, 2014 event, DNC recognized that SLOD was credited for GDC 17 compliance and its removal should have been considered an adverse change requiring a 10 CFR 50.59 evaluation.
Extensive engineering analysis, including consideration of potential design modifications, is ongoing to address DNC's compliance with GDC 17. Upon completion of this work, a LAR will be submitted to the NRC requesting review and approval of licensing basis changes to the MPS2 and MPS3 FSARs for GDC 17.
As noted in the response to Question 3, improving sensitivity to the license basis and the 10 CFR 50.59 requirements is being addressed by training to prevent future similar situations.
Issue 1. Missed Opportunities During NRC Region IV 2009 I Inspection
OIG found that NRC missed an opportunity during a 2009 triennial baseline inspection of SONGS' implementation of the 10 CFR 50.59 process to identify weaknesses in the SONGS steam generator 50.59 screening and evaluation package. While a Region IV inspection team selected the SONGS Unit 2 steam generator 1O CFR 50.59 screening and evaluation package as one of 35 items sampled during a 2009 triennial baseline ROP inspection at SONGS, the inspection team did not identify various shortcomings noted more recently by NRC subject matter experts who reviewed the steam generator screening and evaluation package subsequent to SONGS' shutdown due to problems with steam generator design.
The 2009 inspection team concluded from its review of the 35 items sampled that SONGS had correctly determined that the changes SONGS made could be made without a license amendment. However, the NRC subject matter experts who reviewed the Unit 2 steam generator screening and evaluation package following SONGS' shutdown identified questions pertaining to the Unit 2 steam generator 1O CFR 50.59 screening and evaluation, some of which NRC says cannot now be answered based on available information. The questions raised by the subject matter experts pertain to (1) insufficient support for 10 CFR 50.59 evaluation conclusions that contributed to the decision that a license amendment was not needed and (2) methodology changes that should have been considered for screening but were not listed in the screening documentation. OIG found that (1) without knowing whether everything that should have been screened was screened, and the outcomes of these screenings, and (2) without reviewing additional information concerning the evaluation conclusions, there is no assurance that NRC reached the correct conclusion in its 2009 inspection that SONGS did not need a license amendment for its steam generator replacement.
UNIT 2 LICENSEE EVENT REPORT 2014-004-00
So basically in Unit 2, the ‘B' Motor Driven Auxiliary Feedwater (MDAFW) Pump was inop from May 2000 to at least April 10, 2014. Catch the overlap of increased risk with removing SLOD in 2012 and the inop of the pump until Apil 2014?
Think about the prolong unreliability of Unit 3's Turbine Driven Auxiliary feedwater pump
While de-terminating the motor leads for the 'B' Motor Driven Auxiliary Feedwater (MDAFW) Pump motor, foreign material (ty-wraps and a plastic bag) were found inside the cable environmental seal (Raychem boot) of the 'A' phase.This motor was last re-terminated In May 2000.Since the Raychem boot was not in the as tested environmentally qualified (EQ) configuration the 'B' MDAFW pump was considered inoperable.Plant Technical Specifications (TS) 3.7.2.1 Action d, requires, if two AFW pumps are inoperable in operating MODES 1, 2, and 3, the plant must be placed in at least HOT STANDBY within six hours and in HOT SHUTDOWN within the following 12 hours.A review of the control room logs for the past three years determined there were 4 occasions where there were two AFW pumps inoperable for longer than allowed by TS. The direct cause was an historical inappropriate maintenance practice which rendered the MDAFW pump inoperable. The 'A' phase motor lead was subsequently properly re-terminated.
So basically in Unit 2, the ‘B' Motor Driven Auxiliary
Feedwater (MDAFW) Pump was inop from May 2000 to at least April 10, 2014. Catch
the overlap of increased risk with removing SLOD in 2012 and the inop of
the pump until Aril 2014?
While de-terminating
the motor leads for the 'B' Motor Driven Auxiliary Feedwater (MDAFW) Pump
motor, foreign material (ty-wraps and a plastic bag) were found inside the
cable environmental seal (Raychem boot) of the 'A' phase.
This
motor was last re-terminated In May 2000.
Since
the Raychem boot was not in the as tested environmentally qualified (EQ) configuration
the 'B' MDAFW pump was considered inoperable.
Plant
Technical Specifications (TS) 3.7.2.1 Action d, requires, if two AFW pumps are
inoperable in operating MODES 1, 2, and 3, the plant must be placed in at least
HOT STANDBY within six hours and in HOT SHUTDOWN within the following 12 hours.
A
review of the control room logs for the past three years determined there were
4 occasions where there were two AFW pumps inoperable for longer than allowed
by TS. The direct cause was an historical inappropriate maintenance practice
which rendered the MDAFW pump inoperable. The 'A' phase motor lead was
subsequently properly re-terminated.
See, the NEI is tasked with advocating for the economic interest of a licensee. They do a good job for the utilities. From a public safety perspective, you should be thinking look at how close to the new delay relay time is from the actual start time and the legal limit. Then you are moving the new relay time right up to the safety limit of 12 seconds...you have to be thinking what safety limit and sensitivities are you getting closer too. You should be thinking what is the accuracy is of the new relay and its quality. You should be asking at what time limit pass 12 sec do you get core damage and the possibility containment failure. You would have to be think, this delay is moving right up to the safety limit, both DGs, I got to throw this into the full fledge 50.59 in order to cover my our asses. This isn't really a technical limit or legal limit, this is how we use our intelligence to protect of safety limits or protect our margin of safety. The idea of moving a DG start time really right up to its legal limit and then dumping it out of the 50.59 through a screening process is repugnant and nauseating.
Pg 33:To further illustrate the distinction between 10 CFR 50.59 screening and evaluation, consider the example of a change to a diesel generator-starting relay that delays the diesel start time from 10 seconds to 12 seconds. The UFSAR-described design function credited in the ECCS analyses is for the diesel to start within 12 seconds. This change would screen out because it is apparent that the change will not adversely affect the diesel generator design function credited in the ECCS analyses (ECCS analyses remain valid)
DOMINION NUCLEARCONNECTICUT, INC. (DNC) MILLSTONE POWERSTATION UNITS 2 AND 3 RESPONSE TO AN APPARENT VIOLATION IN NRC SPECIALINSPECTION REPORT 05000336/2014011AND 05000423/2014011; EA-14-12
Apparent Violation
As stated in the summary section of NRC Special Inspection Report,05000336/2014011 and 05000423/2014011, during an NRC team inspection conducted between June 2 and July 15, 2014, "the NRC identified a Severity Level Ill Apparent Violation (A V) of Title 10 of the Code of Federal Regulations (10 CFR) 50.59, "Changes, Tests, and Experiments," for Dominion's failure to complete a 10 CFR 50.59 evaluation and obtain a license amendment for a change made to the facility as described in the Updated Final Safety Analysis Report (UFSAR). Specifically, ... a special protection system (SPS), known as severe line outage detection (SLOD), [was removed] which was described in the UFSAR. Dominion concluded in the 10 CFR 50.59 screening that a full 10 CFR 50.59 evaluation was not required and, therefore, prior NRC approval was not needed to implement this change. The team concluded that prior NRC approval likely was required because the removal of SLOD may have resulted in more than a minimal increase in the likelihood of occurrence of a malfunction of the offsite power system as described in the UFSAR."
Response to the Apparent Violation
Dominion Nuclear Connecticut, Inc. (DNC) submits the following information in response to NRC Special Inspection Report 05000336/2014011 and 05000423/2014011 which was issued by the NRC on August 28, 2014. DNC chooses to respond in writing to AV 05000336/2014011 and 05000423/2014011 and declined the opportunity for a Pre-decisional Enforcement Conference (PEC) and the opportunity to request Alternative Dispute Resolution (ADR) during a phone call on September 8, 2014, between Lori Armstrong of DNC and Raymond McKinley, Chief, Division of Reactor Projects Branch 5, NRC Region I.
1) The reason for the Apparent Violation (AV) or, if contested, the basis for disputing the violation DNC does not contest the apparent violation.
NRC's review and approval of the change to the Millstone Power Station Unit 2 (MPS2) and 3 (MPS3) licensing basis for the removal of SLOD was not requested by DNC because of an inadequately prepared 10 CFR 50.59 screen. In the 10 CFR 50.59 screen, Engineering personnel failed to consider that the removal of SLOD was an adverse change relating to DNC's compliance with General Design Criteria (GDC) 17, and therefore did not conclude that a 10 CFR 50.59 evaluation was needed.
The root cause evaluation for this AV identified the direct cause as a lack in proficiency and skill in performing 10 CFR 50.59 screens. The root cause for this AV was determined to be that continuing training was not adequate to maintain the proficiency and skills for consistent, accurate screens. Corrective actions were needed to address the screening deficiency identified in the apparent violation.
The complexities associated with the technical issue, multiple responsible entities involved, and understanding of the MPS2 and MPS3 licensing basis are also relevant to understanding the contributing factors for the AV. During review of this AV, it was determined that DNC's error of not performing a 10 CFR 50.59 evaluation occurred during the design development for the removal of SLOD by the transmission owner, Northeast Utilities (NU). During the design development, DNC did not recognize that NU's removal of SLOD resulted in a change in the method of compliance with GDC 17 that required DNC to perform a 10 CFR 50.59 evaluation. This matter is further addressed in the Additional Information provided below.
2) The corrective steps that have been taken and the results achieved
With removal of SLOD, and as discussed in the Additional Information provided below, the station no longer met the method for compliance with GDC 17 approved by the NRC at the time of original licensing of MPS3. As documented in NRC Special Inspection Report 05000336/2014011 and 05000423/2014011, DNC implemented a compensatory measure by issuing an Operations standing order for interim guidance on future offsite line outages and plant generation output. In March 2014, prior to the NRC Special Inspection, DNC had separately implemented improvements in the procedural guidance for performing 10 CFR 50.59 screenings.
These improvements were the result of DNC identified gaps in performance of 10 CFR 50.59 screenings. Improvements included a major rewrite and expansion of the guidance for completing 10 CFR 50.59 screens using a more user-friendly format. The procedure now includes more detailed guidance for responses to each section of the screen form including direct references to NEI 96-07, Guidelines for 10 CFR 50.59 Implementation.
In August 2014, training was provided on an expedited basis to a select population (the majority) of 10 CFR 50.59 screeners. The training included discussion on the fundamentals of GDC compliance and the importance of identifying and reviewing the impacts of design changes upon the licensing basis, including the FSAR. Only personnel who have received the training are presently qualified to perform 10 CFR 50.59 screens.
Design changes scheduled for implementation in the remainder of 2014 have been reviewed by Design Engineering to determine whether adequate licensing basis reviews were conducted as part of the 10 CFR 50.59 screenings. No 10 CFR 50.59 screens were identified which should have concluded a 10 CFR 50.59 evaluation was required.
3) The corrective steps that will be taken
To become qualified to perform 10 CFR 50.59 screens, future training will include a discussion of the fundamentals of GDC compliance and the importance of identifying and reviewing the impacts of design changes upon the licensing basis, including the FSAR.
A review of the 10 CFR 50.59 screens for FSAR changes processed in the past three years will be conducted by April 1, 2015 to determine whether adequate licensing basis reviews were conducted.
DNC is evaluating options for addressing compliance with GDC 17. To complete this work, engineering analysis, including consideration of potential design modifications, is necessary. Upon completion, a License Amendment Request (LAR) will be submitted to the NRC requesting review and approval of a licensing basis change to the MPS2 and MPS3 FSAR that addresses the removal of SLOD. DNC will keep the senior resident inspector informed of the status and schedule for resolution.
4) The date when full compliance will be achieved
Full compliance was achieved when training was provided in August 2014. To ensure future continued compliance, the 10 CFR 50.59 training module will be updated to include a discussion of the fundamentals of GDC compliance and the importance of identifying and reviewing the impacts of design changes upon the licensing basis, including the FSAR.
Additional Information:
The SLOD system was owned by the transmission system owner, NU. Removal of SLOD was a result of a major transmission line upgrade project to improve grid reliability by separating lines and towers leaving the MPS switchyard. This separation allowed NU to eliminate SLOD, which they no longer considered reliable or secure. The upgrade, as it was presented, reduced risk to MPS and improved grid reliability to MPS. Representatives of DNC and NU participated in multiple Nuclear Plant Interface Meetings (NPIMs) coordinated by ISO New England (the transmission system operator). These meetings, which began several years in advance of the actual physical modifications, included discussions of proposed changes to the transmission system.
The transmission upgrade project by NU involved rerouting the transmission lines from four lines on two towers to four lines on four separate towers. The removal of SLOD was presented in the aggregate as an improvement in grid reliability, conforming to present transmission system standards. According to the North American Electric Reliability Corporation standard on special protection systems (SPSs), SPSs such as SLOD carry with them unique risks including, risk of failure on demand and inadvertent activation, and risk of interacting with other SPSs in unintended ways. Thus, at the time, DNC, ISO New England, and NU believed that separation of the towers/lines removed the vulnerability which SLOD was installed to mitigate and represented an improvement in grid reliability. Therefore, following tower line separation, SLOD was disabled and eventually removed. DNC recognizes that during the design development for the modified transmission circuits, there were opportunities to understand that the Millstone licensing basis was impacted by the removal of SLOD and that a 10 CFR 50.59 evaluation would be required. DNC accepted the changes proposed and approved by NU, ISO New England, and the Northeast Power Coordinating Council without adequately considering the impact to the MPS licensing basis. The complexities associated with the specific technical issue, multiple responsible entities involved, and understanding of the licensing basis all played a part in the failure to recognize the impact of the change on the licensing basis.
The 10 CFR 50.59 screen failed to consider that the removal of SLOD was an adverse change relating to DNC's compliance with GDC 17, and therefore did not conclude that a 10 CFR 50.59 evaluation was needed. It was the belief that the tower and line separation project, including SLOD removal, was undertaken by NU for the sole reason to enhance grid stability and reliability, providing a more stable source of offsite power to MPS. That belief resulted in the DNC mindset that the removal of SLOD references from the FSARs did not require further evaluation. Following the May 25, 2014 event, DNC recognized that SLOD was credited for GDC 17 compliance and its removal should have been considered an adverse change requiring a 10 CFR 50.59 evaluation.
Extensive engineering analysis, including consideration of potential design modifications, is ongoing to address DNC's compliance with GDC 17. Upon completion of this work, a LAR will be submitted to the NRC requesting review and approval of licensing basis changes to the MPS2 and MPS3 FSARs for GDC 17.
As noted in the response to Question 3, improving sensitivity to the license basis and the 10 CFR 50.59 requirements is being addressed by training to prevent future similar situations.
