Brown Ferry

December 23, 2014: Licensee Event Report 50-259/2014-005-00

On October 29, 2014, during performance of the Browns Ferry Nuclear Plant (BFN) Unit 1 Main Steam Relief Valve (MSRV) Manual Cycle Test, MSRV 1-19 failed to open. Investigation of the failure revealed a misconfiguration of the control air lines to both the MSRV 1-19 and MSRV 1-18 which occurred during installation of the flex hoses in 2006. MSRV 1-19 has an Automatic Depressurization System (ADS) function which was defeated by the air line misconfiguration. The ADS function for MSRV 1-19 has been inoperable since May 2007. This condition would have prevented MSRV 1-19 from performing its specified ADS safety function for longer than allowed by Technical Specifications. The cause of this event was a latent organizational and programmatic gap associated with the BFN Unit 1 Restart Organization. Specifically, the management and organizational infrastructure in place during the BFN Unit 1 restart was inadequate to preclude numerous human performance errors during the 2005-2007 time period, including the multiple human performance errors associated with this event.

It is a incomplete corrective action program...how do they tell the operability of containment air? By detecting pressure and displaying it in the control room. Containment air connects up to the accumulators...drain the air from containment air because of the check valves in the dischage of  the accumulator would remain operable and pressurized. The accumulator would open and shut the SRV/ADS valve. You don't remotely display accumulator air pressure, even if you did...it wouldn't fully detect operability. This is a rather cheap and worthless fix coming out of the lessens of TMI. I hate add on components. Lets say a clump of rust from the interior falls off and collects at the bottom. Rust might weld the check valve shut. So the accumulator might still be filled with air and ADS might not work if the normal air fails.

The only way of verification of the permeability of the accumulator I can think of is a remote isolation valve up stream of the check valves. Have a vent path between the isolation valve and check valve, and another remotely operated valve in the vent like. You would need to display accumulation outside contain. Then shut the main line isolation valve, open the vent path valve...if the accumulator pressure goes down then the accumulator would work. By operation the SRV valve or ADS valve, even if these component opened, it still wouldn't detect the operability of the occumulation/

The big problem is not the mixed up lines...is they couldn't detect it not working it in all these testing and leak rate test over all these years. The non operability is very difficult to detect...you can't detect the non operability.

The corrective action is to revise the MSRV pilot valve installation procedures for all three units to include a step to validate the ADS-MSRVs are connected to the appropriate ADS accumulator.

Plant Operating Conditions Before the Event

Browns Ferry Nuclear Plant (BFN) Unit 1 was in Mode 1 at approximately 20 percent power.

So they were

II. Description of Event

A. Event:

On October 29, 2014, at 2225 hours Central Daylight Time (CDT), during performance of the BFN Unit 1 Main Steam Relief Valve (MSRV) Manual Cycle Test, MSRV [RV] 1-19 failed to open. Investigation of the failure on October 30, 2014, revealed the failure of MSRV 1-19 to stroke was due to the control air root valve, 1-SHV-032-2519, being

It is much worst than you can imagine. They found the mix up by accident. Here is the first error, the air root valve was found shut. Then they found the mixed up. So one ADS valve didn't work and a regulate SRV didn't. This raise two questions...were they decking prior testing of these valves.

inappropriately isolated by a separate, and unrelated, human performance error that occurred during the fall 2014 BFN Unit 1 Refueling Outage (RFO). Control air root valve 1-SHV-032-2519 is the control air header shutoff for MSRV 1-18. Further investigation revealed a misconfiguration of the control air lines to both MSRV 1-19 and MSRV 1-18. MSRV 1-19 has an Automatic Depressurization System (ADS) [SB] function.

BFN Unit 1 has 13 MSRVs. All 13 MSRVs can be opened manually from the main control room or are self-actuated to limit reactor pressure. The ADS consists of 6 of the 13 MSRVs and is designed to provide depressurization of the reactor during a small break loss of coolant accident if the High Pressure Coolant Injection System (HPCI) [BJ] fails or is unable to maintain required water level in the reactor. Each of the MSRVs used for ADS is equipped with an air accumulator [ACC]. The accumulator provides the pneumatic power to actuate the valves. These accumulators are provided to assure that the valves can be held open following failure of normal air supply.

The misconfiguration would have prevented MSRV 1-19 from performing its specified ADS safety function for longer than allowed by Technical Specifications (TS) Limiting Condition for Operation (LCO) 3.5.1 ECCS - Operating, actions due to a loss of backup control air supply from an accumulator.

The misconfiguration event occurred on December 7, 2006, during preparation for BFN Unit 1 restart from an extended outage, when the air hoses were installed incorrectly on MSRV 1-19 and MSRV 1-18 in a swapped configuration. Review of the work order determined the instructions were adequate to achieve successful installation of the hoses.

The misconfiguration was subsequently discovered by Operations on April 29, 2007, as part of the System Preoperability Checklist walkdown. A work order was initiated to correctly align the MSRV air lines. However, the lines were not swapped and remained misconfigured. A review of the work steps revealed a substitution error that essentially directed the workers to remove the lines and reinstall them in the same orientation.

On May 22, 2007, BFN Unit 1 was brought on-line with the misconfiguration still in place. This date represents the beginning of MSRV 1-19 inoperability.

On November 7, 2014, a temporary modification was implemented to restore operability of the ADS safety function. The ADS control air accumulator intended for MSRV 1-19 remains connected to MSRV 1-18. The controls and logic for the two valves were swapped to ensure the ADS circuitry from MSRV 1-19 opens MSRV 1-18. This temporary modification will remain in place until the condition can be corrected during the next refueling outage.

B. Status of structures, components, or systems that were inoperable at the start of the event and that contributed to the event:

The control air root valve 1-SHV-032-2519 was inappropriately isolated by a separate, and unrelated, human performance error, that occurred during the fall 2014 BFN Unit 1 RFO, resulting in the discovery of the ADS control air accumulator misconfiguration between MSRV 1-19 and MSRV 1-18.

C. Dates and approximate times of occurrences:

Dates & Approximate Times

December 7, 2006 Air hoses to MSRV 1-19 and 1-18 were installed in a swapped configuration during BFN Unit 1 restart.

April 29, 2007 Operations identified MSRV misconfiguration. Work that same day failed to correct the condition. Unit 1 restart.

May 22, 2007: BFN Unit 1 was brought on-line with the misconfiguration still in place. Start of MSRV 1-19 inoperability.

October 29, 2014, at 2225 hours CDT: MSRV 1-19 failed to open during the MSRV Manual Cycle Test. BFN Unit 1 entered TS LCO 3.5.1.E.

October 30, 2014 Central Standard Time (CST): Troubleshooting activities identified the misconfiguration of the control air lines to both the MSRV 1-19 and MSRV 1-18.

November 7, 2014, at 1746 hours: Implemented temporary modification to restore ADS function. Operations declared MSRV 1-19 Operable and exited TS LCO 3.5.1.E.

D. Manufacturer and model number (or other identification) of each component that failed during the event:

There were no failed components associated with this event.

E. Other systems or secondary functions affected:

There were no other system or secondary functions affected.

F. Method of discovery of each component or system failure or procedure error:

During performance of the BFN Unit 1 MSRV Manual Cycle Test, MSRV 1-19 failed to open. Investigation of the failure on October 30, 2014, revealed the failure of MSRV 1-19 to stroke was due to the control air root valve, 1-SHV-032-2519, being inappropriately isolated by a separate human performance error. Further investigation revealed a misconfiguration of the control air lines to both MSRV 1-19 and MSRV 1-18.

G. The failure mode, mechanism, and effect of each failed component, if known:

There were no failed components associated with this event.

H. Operator actions:

MSRV 1-19 failed to open during the MSRV Manual Cycle Test when Operations took the handswitch to the open position. Operations declared MSRV 1-19 inoperable and entered TS LCO 3.5.1.E.

Ill. Cause of the Event / Problem Statement

A. The cause of each component or system failure or personnel error, if known:

The direct cause of this condition was MSRVs 1-18 and 1-19 were initially installed with swapped control air supplied due to a latent human performance error made during BFN Unit 1 restart in 2006.

Contributing to this event was that there are no requirements to verify the ADS-MSRVs are connected to ADS accumulators.

B. The cause(s) and circumstances for each human performance related root cause:

The cause of this event was a latent organizational and programmatic gap associated with the BFN Unit 1 Restart Organization. Specifically, the management and organizational infrastructure in place during the BFN Unit 1 restart was inadequate to preclude numerous human performance errors during the 2005-2007 time period, including the multiple human performance errors associated with this event.

IV. Analysis of the event:

The Tennessee Valley Authority is submitting this report in accordance with Title 10 of the Code of Federal Regulations (10 CFR) 50.73(a)(2)(i)(B), as any operation or condition which was prohibited by the plant's Technical Specifications.

The BFN Unit 1 TS LCO 3.5.1, ECCS - Operating, requires the ADS function of 6 MSRVs to be Operable, during Mode 1, and Modes 2 and 3, when the steam dome pressure is greater than or equal to 150 pounds per square inch gauge (psig). With one BFN Unit 1 ADS valve inoperable, TS 3.5.1 Required Action E.1 requires the ADS valve to be returned to Operable status in 14 days. If the ADS valve cannot be restored to Operable status in the required time period, TS 3.5.1 Required Actions G.A and G.2 require the unit to be in Mode 3 in 12 hours and to reduce reactor steam dome pressure to less than or equal to 150 psig in 36 hours.

Inoperability of MSRV 1-19 began on May 22, 2007, when BFN Unit 1 was brought on-line after an extended shutdown and ended on November 7, 2014, at 1746 hours CST, when the ADS function was declared operable following a temporary modification to MSRVs 1-19 and 1-18. Therefore, BFN Unit 1 operated with one inoperable ADS valve for longer than allowed by TS 3.5.1 Actions.

BFN Unit 1 LCO 3.0.4 prohibits Mode changes when an LCO is not met except under certain conditions that were not applicable to this event. Since it was not recognized that one BFN Unit 1 ADS valve was inoperable from May 22, 2007, until November 7, 2014, BFN changed Modes in violation of LCO 3.0.4 on multiple occasions. This event was the result of multiple, and latent, human performance errors at all levels of the organization during BFN Unit I restart. Specifically, human performance errors were introduced when flex hoses were initially installed incorrectly in 2006, when preparing the flawed corrective maintenance work order after the condition was identified in 2007, when the work order was approved with the flaw, when the work order was performed without identifying the error, and when the organization failed to verify the identified misconfiguration had been corrected.

Human performance issues during the BFN Unit 1 Restart were previously identified and evaluated by Problem Evaluation Report (PER)137614 in 2008 to investigate the five BFN Unit 1 scrams following BFN Unit 1 restart. The investigation identified three common root causes including an inadequate BFN Unit 1 management and organizational infrastructure, less than adequate risk management, and a lack of first line supervision and management oversight. Consistent with these findings, the cause of this event was a latent organizational and programmatic gap associated with the BFN Unit I Restart Organization.

Contributing to this event was that there are no requirements to verify the ADS-MSRVs are connected to ADS accumulators. During each outage, testing is performed as part of pre-startup activities to verify the ADS valves can be cycled from the control room. The MSRV solenoid pilot valves are removed and replaced with lab verified, refurbished pilot valves that have certified set points, and the ADS accumulators are checked for soundness. However, the connection of the ADS-MSRVs to the correct ADS accumulators is not verified. This missing requirement, in part, allowed this misconfiguration condition to exist undetected for approximately seven years.

 The likelihood of the MSRV control air lines being swapped in the future is unlikely because the flex hoses connecting control air to the MSRVs cannot be physically manipulated to interface with an adjacent MSRV because the interface is welded and this union is not broken during normal valve maintenance. To ensure this condition does not exist for the other BFN units, walkdowns will be performed on the BFN Units 2 and 3 MSRV control air lines during each units upcoming refueling outage. To preclude this condition from recurring, the MSRV pilot valve installation procedures will be revised to verify ADS-MSRVs are connected to the correct accumulator.

Assessment of Safety Consequences

ADS serves as a backup to the HPCI System under certain loss of coolant accident conditions. During the last three years, one ADS valve has been inoperable, and the HPCI and low pressure ECCS have been out service for maintenance along with the inoperable ADS valve. Evaluations provided by General Electric and AREVA have shown that the bounding scenario plus the loss of the ADS valve does not result in failure to meet 10 CFR 50.46 and Primary Containment acceptance criteria.

A Probabilistic Risk Analysis (PRA) of this condition concluded that the unavailability of the MSRV 1-19 to perform an ADS function or to be backed by an accumulator would have an insignificant impact on overall plant risk. The PRA concluded that there was no plant configuration which would present a significant increase in risk over normal test and maintenance due to the unavailability of a single ADS valve.

Based on the discussion above, the safety significance of this condition is minimal and did not pose a threat to the health and safety of the public or plant personnel.

A. Availability of systems or components that could have performed the same function as the components and systems that failed during the event:

Five of the six ADS valves remained available. Although the ADS function for MSRV 1-19 was unavailable, the valve would have performed within the tolerance of the mechanical setpoint of 1135 psig during an overpressurization event.

B. For events that occurred when the reactor was shut down, availability of systems or components needed to shutdown the reactor and maintain safe shutdown conditions, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident:

The ADS is not required to perform its safety function when the reactor is shut down.

C. For failure that rendered a train of a safety system inoperable, an estimate of the elapsed time from discovery of the failure until the train was returned to service:

Inoperability of MSRV 1-19 began on May 22, 2007, when BFN Unit 1 was brought on-line after an extended shutdown and ended on November 7, 2014, at 1746 hours CST, when the ADS function was declared operable following a temporary modification to MSRVs 1-19 and 1-18.

VI. Corrective Actions

Corrective Actions are being managed by TVA's corrective action program under Problem Evaluation Report (PER) 952082.

Immediate Corrective Actions

A temporary modification was implemented to restore operability of the ADS safety function. This temporary modification will remain in place until the configuration can be corrected during the next refueling outage.

Corrective Actions that Reduce Probability of Similar Events Occurrinq in the Future "

* BFN will perform walkdowns of the BFN Units 2 and 3 MSRV control air lines during each units upcoming refueling outage to ensure proper configuration.

* BFN will revise the MSRV pilot valve installation procedures for all three units to include a step to validate the ADS-MSRVs are connected to the appropriate ADS accumulator.

VII. Additional Information:

A. Previous similar events at the same plant:

A search of the Corrective Action Program and BFN Licensee Event Reports for Units 1, 2, and 3, for approximately the past three years did not identify any similar events.

B. Additional Information:

There is no additional information.

C. Safety System Functional Failure Consideration:

In accordance with the Nuclear Energy Institute (NEI) 99-02, "Regulatory Assessment Performance Indicator Guideline," this event is not considered a system functional failure because the minimum number of ADS valves remained available to perform their safety function in the event of an accident.

D. Scram with Complications Consideration:

This event did not result in a reactor scram.

VIII. Commitments

There are no commitments.

ANO Stator Drop Accident: The NRC Stove Piping Risk?

Update

So basically ANO and Entergy got three yellow findings. 

January 22, 2015 SUBJECT: ARKANSAS NUCLEAR ONE, UNITS 1 AND 2 - FINAL SIGNIFICANCE DETERMINATION OF YELLOW FINDING AND NOTICE OF VIOLATION; NRC INSPECTION REPORT 05000313/2014010 AND 05000368/2014010

Above all else, these flooding problems weren't discovered by an effective process of Entergy and the NRC. I bet you effectively Entergy is paying the dead and injured employees mere pennies in compensation and punishment. After all, it Arkansas you know. It took Entergy not following procedures and then dropping a 550 ton stator killing a employee to uncover the flooding flaws. The punishment levels get derived through a grossly politically assumption system...perceived through a process and calculation system nobody understands. Nobody gets a penalty or punishment including the NRC for not having a effective organization before the stator dropped. Nobody got fired here or gone to jail. They are just paper whipping the violation. Both these plants should have paid the price of the plants being prohibited from starting up for a year or two.    

It got to be noted, as you go down the emergency operating procedures the complexity massively increases and they increasingly depend on less quality components and procedures. Complexity and uncertainty levels just skyrockets as you increasingly depend on not fully designed and engineered systems and procedures. At some level of complexity and stress, an outcome can never be assured. As the accident strips massively the redundant safety systems away from the plant, the consequence of a error drastically increase the risk of damaging the core. I hate add on systems or component because usually they aren't fully tested and all the uncertainties aren't fully washed out. I like a holistically designed plant...all these components in on plant first design.   

The NRC take on these cooling paths to be valid should be, you have to demonstrate flow up to the first containment isolation valve. If you depend on service water flow or temporally diesel generator, then you have to demonstrate flow up to the first containment isolation valve and you measure flow and pressure. Make believe flow paths are not approved. You really need periodic, yearly or every two years...the troops getting on the ground and pressurizing the alignment up to the first isolation valve to be even considered as a safety system. 

Basically in this day and age, a double fail safe, push a button and the system aligns and fills up and SG level is controlled...

This is basically the Fukushima dilemma...not having a diesel generator 100 feet up the ocean bluff and hard wired to the plant. The philosophy with the Japanese in a Tsunami, of having to fight the battle to save the plant in the flood waters within the plant. 

So how about a big tank way outside the flood zone. It hard piped into the plant right up to the steam generators. Starting the diesel generator, push a button and open up and valve or two...everyone safe. An access road to the tank...with the fire department cycling their trucks in a out to fill the tank. You could have constructed a sturdy cement cauldron out in the river and hard piped to near this tank. Then a fire truck could continuously fill the tank from the river.

Then the other Japanese dilemma...would you damage the steam generator in order to cool the core.

I didn't hear about the flex system coming in to save Entergy's butts.                 

A not recognized risk, if the staff and licensed operators think the mitigating strategies or flow paths are too star treky(not believable)...it is going to impact the safety culture. I'd like to see if the licensed operators accept the cooling paths.

Basically risk perspectives is a Abracadabra campaign monied system where the NRC and Entergy go into dark smoke filled rooms to negotiate a paper cut punishment and violation.   

You get it, the community has no say in it. 

So why isn’t the NRC recalculating the so call electrical yellow finding violation. It seems the flooding yellow finding was active just prior to the  first yellow finding. Two cases: 

1) ANO stator electrical yellow finding with the flooding barriers all according to regulations. 

2) ANO stator electrical yellow finding with the flooding barriers according to an inadequate flooding barrier in this second ANO yellow finding. 

Once can legitimately surmise the second example contains a lot more risk than the first example, and justified a lot bigger violation. 

This would be my contention that the disposition of risk perspective is riddled with fraud and corruption.   

The flooding issue is another example with inspector activities and the ROP is severely inadequate to know the true conditions at a power plant…the NRC selectively enforces tech specs and the licensing conditions at these power Plants. Why isn’t it a slam dunk that ANO employees are going to jail? Why isn’t there some serious soul searching going on in the NRC with why their inspection  and inspector activities didn’t undercover these violation at the first opportunity many years and decades ago?   

*I am looking for this answer: What is the generic  “Loss of offsite power” accident rate used in all NRC risk calculation and within coming up with a plant violation level?  I am told it is 2, 3 or 5 LOOPs per 100 years. Could the answer be in the once per hundred year terms?  

Mike Mulligan

Hinsdale, NH

NRC Finalizes Violations for Arkansas Nuclear One

     Posted by on January 23, 2015

The Arkansas Nuclear One power plant, in Russellville, Ark., is coming under increased NRC focus as a result of flood protection problems.


Beginning in 2013, Entergy Operations officials and the NRC began extensive inspections of the flood protection program at ANO. Many problems were discovered and are described in a Sept. 9, 2014, NRC inspection report.

All told, more than 100 previously unknown flood barrier deficiencies creating flooding pathways into the site’s two auxiliary buildings were found. These included defective floor seals, flooding barriers that were designed, but never installed, and seals that had deteriorated over time. In one case, a special hatch that was supposed to be close a ventilation duct in the Unit 1 auxiliary building in the event of flooding had never been installed.

In the unlikely event of extreme flooding – a kind not seen since weather records have been kept for the area – significant amounts of water could have entered the auxiliary buildings. This could have submerged vital plant equipment, as well as the emergency diesel generator fuel vaults. The licensee has replaced degraded seals, installed new flood barriers and adopted new measures to better protect the site from flooding.
NRC held a regulatory conference with Entergy officials on Oct. 28, 2014. After considering information provided by the company, NRC determined violations related to flood protection have substantial safety significance, or are “yellow.” (The NRC evaluates regulatory performance at nuclear plants with a color coded process that classifies inspection findings as green, white, yellow or red, in order of increasing safety significance.)

The NRC divides plants into five performance categories, or columns on its Action Matrix. ANO Units 1 and 2 received yellow violations in June 2014 because electrical equipment damaged during an industrial incident increased risk to the plant. Workers were moving a 525-ton component out of the plant’s turbine building when a temporary lifting rig collapsed on March 13, 2013, damaging plant equipment. Those violations moved both units from Column 1 to Column 3 of the NRC’s Action Matrix. The agency increases its oversight of plants as performance declines.

The new violations will lead NRC to reassess whether even more inspection resources need to be focused on ANO. The NRC will determine the appropriate level of agency oversight and notify Entergy officials of that decision in a separate letter.

Millstone Special Inspection: My Analysis On The Delayed Starting Of The TDAFW pump

The NRC has no proof the degraded and broken components in the TDAFW make the pump reliable to operate in a nuclear plant in 15 to 20 minutes.

I contend the normal training of the control room staff would lockout operation of the pump. The staff would put the pump in "pull to lock" fearing the failed-to-start pump is dangerous and too erratic for safety operation. So it wouldn't start at all. 

Big picture, the NRC's staff is teaching the Dominion staff that the licencing conditions of the plant is optional.       

January 15, 2015: MILLSTONE POWER UNIT 3 – NRC SPECIAL INSPECTION REPORT 05000423/2014013

If the TDAFW pump had been called upon in response to a plant transient, between May and September 2014, it likely would have performed as it did on July 15 and September 10, failing initially to start, but starting successfully after approximately 15 to 20 minutes. This protracted start would have permitted the pump to supply water to the steam generators within sufficient time to limit the significance of the initial failure. Specifically, the Team verified that the delayed start would not have prevented the pump from meeting its safety function for a limiting case station blackout event.

This is astonishing pernicious form of regulatory and corporate fraud and corruption. It effectively is telling lies deep in the bowels of engineering and science.

Excerpts from yesterday’s attachment and the Millstone’s new special inspection. I honestly don’t understand why the NRC doesn't reevaluated this risk, the violation level…assuming the TDAFWP wasn't operable in the two plant LOOP. Conservatism would call the TDAFP pump inop prior to 2013 till the recent upgrade of all faulty components. That would help jack up the violation level...where Dominion and the nuclear industry would fear the backlash with the public's full knowledge of the safety condition inside Millstone.   

I recent talked to the senior resident at Browns Ferry over the accumulator flex tubing to a SRVs (ADS valve) being switched around making the SRV inop since 2007. You get what is going on, the accumulators nationwide are untestable…all SRVs throughout the nation should have conservatively called all their SRVs/ADS system inop because there is no way to test if the accumulators are operable.

Do you get what I am saying, three big safety systems broken simultaneously when the accident happened is a hell of a bigger problem than the identical components being broken at seperate time and exposed to the same accident. It is the mass defect problem with risk and multiple components being broken at the same time and in the same accident. This plays out in Millstone this summer.

1) The TDAFW pump problems. I'd call that inop prior to 2013.(exposure time) 

2) The inappropriately sized containment feed water isolation valve hydraulic actuators not fixed until recent outage. I' call them inop since 2007. It is extraordinarily dangerous to allow a prolonged exposure time of the flaw because it is exposed to many accidents with a component design and operability defect 

3) Dominion removing the SLOD safety circuit secretly and without permission since maybe 2012. 

4) The two plant LOOP.

Individually any one of these components and organizational failures are bad...but it is horrendous the flaws being available in the same event. The risk collectively together should have driven the violation to the yellow and more likely a red finding. That way Dominion would have gotten all the NRC and public attention they really deserved. It would have driven Millstone into a much deeper corrective action and they would have had to explained their selves much deeper and in their own word to the public. We are worried the agency is inventing another Palisades or Pilgrim. The NRC are repeating their failures coming out of their 2007 feedwater isolation valve actuators being too small...to not accurately disposition risk in the LOOP and the third TDAFW pump inoperability to the proper violation that would get Dominion to change their tune.     
     

So I asked the Browns Ferry resident, as example, the inoped RHR injection red finding and all the other safety component who were found to be degraded and inop (HPIC bearing installed backwards and wouldn't have met its mission time)…so why don’t the agency reevaluate the risk of the inopped injection valve now with recently discovered inoped SRV/ADS valve, and how about throwing in all the other the ADS valves whose accumulators who wasn't operability testable. The NRC only looks at apparent risk, with say evaluating the risk of backward installed bearing in the HPCI pump. The ADS system is the back-up system for HPCI. Conservatism would demand you call HPCI inop upon the improper installation of the bearing. The time it was inoped is from installation til it discovered and the repair job. The risk penalty is siloed, say in the HPCI inop, in that the other safety system found to be broken at the same time aren't included in HPCI risk calculation. It is like with the emergency brakes in your car being non functional. Any dope with a brain could see if the main brakes failed, the risk of a accident is jacked up and the severity of the accident increased if the emergency brakes didn't work just prior to the main brake failure. The real risk, say in the era of the red finding broken injection valve, is the combination and simultaneously with the red finding injection valve was broken, HPCI inop backward bearing and the individual SRV/ADS valve.

The risk and magnitude of an accident with the combination of these three important components being broken at the same time is way bigger than the risk of separately calculated risk and the isolated risk of component failures(3 or more) and then the seperate risk of the component totaled together. The NRC very seldom calculates multiple component risk who become simultaneously broken.      

The Browns Ferry inspector paused for a minute to think about the question. This inspector is a good guy and I like him. He said the rules of the agency force us to calculate risk on issue by issue or case by case manner. I said, so there is real risk and then there is apparent calculated risk dictated by rules of the agency?

Terry, there is widespread corruption and fraud with how the agency calculates and uses risk. It going to bite the agency in the ass one day!

***Excerpts: 

Endemic Engineering Corruption at McGuire and in NRC?

*"The slippage of the VSI"...isn't it hilarious this choice of words. Engineering language...language or word understanding disruption...the real possibility of the operability destruction of the dg through touristy and flowery words and language." 

 *"Are just the facts a lie in the big story? What evidence does the NRC have these defective inserts could remained stable in the worst case mission time? What evidence does the NRC infer that the insert cracks are stable and the failure is predictable? See how the NRC always throws the engineering and assumption uncertainties to whatever advantages a licensee. They only caught these cracked inserts by chance…they caught the cracks when another cylinder choked on a lose insert. The NRC can only punish the licensees on what the agency can see and measure...can't incentivize for a  licensee for having cracks on inserts risking a future failure of the machine when much needed in a accident. 

This is how the NRC frames it. I need triplicate proof to a make a safety concern...the NRC gets to make unsubstantiated and fragile assumptions mitigating the risk imposes on the community from the poor behavior of a licencee. The level of the violation becomes too small and insignificant as to get a change of behavior out of the licencee. The NRC not evidence based assumptions drives the level of the violation! 

I can make a case with the licencee and the NRC burying the magnitude of  the violation (2007) levels within the too small containment feed water isolation valve hydraulic actuators naturally led to a "lack of attention" for plant conditions in the current spate of plant problems.   

 January 15, 2015: SUBJECT: MILLSTONE POWER STATION UNIT 3 – NRC SPECIAL INSPECTION REPORT 05000423/2014013
 If the TDAFW pump had been called upon in response to a plant transient, between May and September 2014, it likely would have performed as it did on July 15 and September 10, failing initially to start, but starting successfully after approximately 15 to 20 minutes. This protracted start would have permitted the pump to supply water to the steam generators within sufficient time to limit the significance of the initial failure. Specifically, the Team verified that the delayed start would not have prevented the pump from meeting its safety function for a limiting case station blackout event.

So gaming “certainty” and “uncertainty” for the favored side is pernicious engineering fraud. The uncertainty with the TDAFW operability there is no real engineering data and a library worth of documentation proving the degraded mechanical and electrical  components  would continue to behave in the 15 to 20 minutes span. They are damaged, out of it lifespan, worn components…there is no reliable way to predict how they will operate next time.  I know there is no proof, but conservatism would demand you call that machine inop. Can you even imagine the complexity in the control room in  blackout accident, the complexity the operator would be facing in a blackout.  

So the uncertainty is because of the component are not up the regulations and licensee’s procedures/ processes, basically the machine would operate as intend next time is unknowable because of the degradation and it is too complex a problem to be estimated. Until recently Dominion didn’t understand the uncertainty in knowing the true condition of the machine…the NRc is not disclosing the engineering evidence uncertainty floating under the surface of their 15 to 20 minute possible startup the pump after the was called to start-up.  The inspectors are grossly over estimating the past component reliable startups history from just a few data points. In other words, if the TDAFW pumps were started up 100 times; do you honestly think the machine would startup 100% (100 times) within 15 to 20 minute? At what point would the machine not work?

Basically the inspectors are using the stature and power of the agency to back up the weak assumption the degraded machine would positively startup on the next call minus any real evidence. There is utterly no engineer proof it would start up the next time.

It is mind boggling fraud going on here. The agency just threw out the licensing conditions of the plant…the TDAFWP would be required to startup within the time frame of the UFSARs.  The NRC is teaching  the staff of dominion the licensing conditions  “aren’t” the bible of public safety,. The staff of the plant only has to conform to the poorly informed agency assumption based on a  few historical data points with no real engineering or science proof or evidence.

Big picture on the NRC’s staff in the this special inspection and their recent interaction with Dominion: The agency is teaching Millstone the plant licensing and tech specs are just optional today with accepting the delayed startup of the TDAFWP and the penalty of violating the licensing conditions is insignificant.   

“This is all bs. The operators don't know what is wrong with the pump in this type of accident. The component unreliability is nothing but a diversion for the staff in the control room. It is in the emergency procedures to take a second shot at the start-up or waiting around with hands in their pockets? They would be way too busy to try to restart the pump and just abandon it. Not knowing the failure mechanism, the control room would assume upon restart the latent failure would emerge in as a way to make their precarious situation worst, like a steam leak, water leak or fire. I’ll bet you they would put it in “pull to lock” so it wouldn’t bite them in the ass later. Why waste invaluable control room resources on a machine that has been demonstrated as unreliable. Once starting up the machine, waiting for the machine to come up to speed, it would divert control room attention as they would worry it would fail and further erratic operation. So why isn’t the assumption in the control room, ok this pump didn’t startup as required and if it did startup later the operation of the pump would be so erratic as to be useless.

Waiting the 20 minutes for the pump to be able to restart would further dilute precious control room resources. Honestly the staff has no idea the machine would restart in 20 minutes…has there been simulator validation the control room would act as the NRC predicted? I suppose the staff has been trained hundreds of time on just such a TDAFWP style failure. They got any scientific or engineering evidence or testing these failed and degraded electronic and mechanical devices would work reliable with restarting the pump in 20 minutes. This is ridiculous. Remember they are talking about a blackout…this first time the plant ever went into this kind of accident.

"If the TDAFW pump had been called upon in response to a plant transient, between May and September 2014, it likely would have performed as it did on July 15 and September 10, failing initially to start, but starting successfully after approximately 15 to 20 minutes. This protracted start would have permitted the pump to supply water to the steam generators within sufficient time to limit the significance of the initial failure. Specifically, the Team verified that the delayed start would not have prevented the pump from meeting its safety function for a limiting case station blackout event."”

The green non site violation constitutes a NRC cover-up. The violation level isn’t high enough such that Dominion isn’t requiring to publically explain their bad behavior that got them to this inspection report. Now Dominion can’t contradict the NRC.

Endemic Engineering Corruption at McGuire and in NRC?

'Who is on first"? 

Basically Duke-McGuire with full knowledge of the NRC shapes an inspection finding of the NRC. In order to keep a plant up a power and making money, as in this case, they will falsely shape their engineering disclosures to the NRC and the NRC willing accept any incorrect testimony and document falsification from the licensee.

I consider any defects in the valve inserts as immediately inoping the DG and all similar DGs. Especially if the insert can get sucked into the cylinder and get chewed up by the piston-cylinder "Waring blender". A lose diesel insert could damage a DG such it couldn't perform its intended function. It is common knowledge for years McGuire-Nordberg has too small diameter valve inserts and susceptible to inoping and damaging the machines. Basically the inserts should be hard attached to the head or cylinder by a set screw or threaded…a secure attachment of some kind. 

At the end of the day, I expect the NRC to whisper in the ears of the licensees…with the licensees trembling in object fear over the power the agency has over them with the ends of serving the nation's greater interest. I expect the agency to quietly whisper in the licensees’ ears (publicly document it), with then the licensees and vendors “going to the ends of the earth” to comprehensively investigate and fix the problem. One peep or hint from a plant NRC inspector, the incident or component degradation will never happen again. Period! Today the NRC "wets their pants" in terror at the sight of any licencee executive.   

McGuire Nuclear Station, Units 1 and 2

Inspection Report: 50-369, 50-370 NPF-9, NPF-17 50-369/99-07, 50-370199-07

September 12, 1999 -October 23, 1999

McGuire and Brunswick need new nuclear qualified Caterpillar (or USA similar) DGs…

'NRC IRs 50-369,370/98-06, 98-07, and 99-02 documented and assessed previous failures of cylinder head sub-components. In 1997 the cylinder heads were rebuilt by an approved Appendix B vendor at the vendor's facility as part of a 100 percent EDG refurbishment. 

During the inspection period, the inspectors reviewed two recent issues involving degraded conditions of valve seat inserts (VSIs) on EDG 1B. The Nordberg diesel engines used at McGuire have 16 cylinders with one exhaust and one intake valve for each cylinder head.

Each VSI comprises an approximately 5.128 inch diameter ring of steel which is interference fit (friction fit at the walmart auto shop) into its respective cylinder head port.

Partially Dropped VSI (PIP M99-4413)

On October 2, 1999, with Unit 1 defueled, maintenance technicians performed corrective maintenance on EDG 1 B cylinder 4L due to degraded performance that was identified during a 15-minute low load break-in run. Technicians inadvertently over-adjusted an exhaust valve and caused extensive damage to the associated cylinder piston, liner, and head during the next post-maintenance EDG run. A subsequent investigation revealed that the over adjustment was made

See how they turn a design error into an unforeseen technician error. Conservationism also calls for, if you don’t fully and completely understand the failure, you assume the defect is bounded by the worst case assumption. The worst case assumption is the “interference” and the engine design is the problem and now, the repair, replacement parts and the traditional manufacturer engineering servicing is absence. This is only going to get worst in the years to come  

I get that with the NRC now, the unknowables and undetectables…the engineering safety uncertainties…they always go to the towards profit and plant survival interest of Duke instead of the licensee having the available evidence and proof these machines will operated reliably in the plant for their intended duty and all the designed accident.

As a aside, Progress Energy, now Duke, once recently intended to replace their Nordberg emergency diesels over their poor quality and obsolete repair and replacement parts Woodward governors. The magnitude of the recurrent amount of out of specs and out of tolerance repair and replacement parts for their emergency diesels within the no longer manufactured Nordberg line of nuclear diesels at Brunswick nuclear power plants. 

The resulting Chinese, no longer in established manufacturing production lines non pedigree, untraceability and voodoo contractors, the second rate engineering service providers and black-market refurbished and replacement parts vendors.

https://adamswebsearch2.nrc.gov/webSearch2/view?AccessionNumber=ML15005A044

Basically the “stepping down the load” is a corrupt “facilative assumption” to keep the machine operational at all cost without actually spending money on it even if you have to lie to the NRC and public. Nordberg many years back, told Duke to “step down the load” when shutting down the diesels to limit the risk of a dropped valve insert (DVI) because of the insert defect that was known to inop the diesel and was very dangerous to operability.

If stepping down the loads was the fix for the piston inhaling and then choking on the loose valve insert...how in the hell is the machine going to behave with large loads being dropped with the diesels isolated from the grid in a accident? So a dg carrying its load in a terrible accident, then dropping a few large pumps, say caused by shorts? How about the diesel tripping for some reason, but the operator having the capability fix the problem and they try to restart the DG. So how is the operators going to control "stepping down the load" during a LOOP. In other words, what does the loads of the dgs look like in a accident? Let me tell you something, there is a lot of uncontrollable down power maneuvers and tripping and starting up these dgs in the big accidents. They cycle up and down in power on the governor all through these.

It is utterly immoral and unethical, implies the plant staff and NRC lacks a conscience. The idea you control through "stepping down the load" in the testing and maintenance regime to minimize the total destruction of the dgs through an active component flaw. While in the accident scenarios there is no means to control load reduction and protect from a dangerous loose valve insert. Usually the way it goes with with guys, you don't fix the component flaw, make it easier for the operators, you just jack up massively the complexity to the licensed operators dealing with the operation of the plant in accident to save a few pennies. The way you would do that, is in the normal and emergency procedures to dictate how the operators would control the dg load reductions in all of the accidents.

I am just saying the out of production and unsupported manufacturer Nordberg dg has a too poor "real" reliability (the reliability would be a lot worst, but for the federal falsification of documents and getting away with lying to the NRC)than the recorded and publicly seen reliability...these machine are grossly inappropriate for a nuclear safety function. It going to get much worst with the replacement parts problem and as these DG age during the rest of the life of the plant. 

“On August 18, 2014, at 1718, approximately 14 hours into a 24 hour surveillance test of EDG 1B, cylinder 5L exhaust temperature dropped" indicates the inop wasn't initiated by the poor quality of the components and tolerances. It is obvious the valve inserts dropped and damaged the rest of the components. Duke with the concurrence of the NRC, turned the event from knowingly operating the DGs recklessly with dangerous components or parts and the associated federal falsification of documents into a “combination of the above factors” beyond the control of the licencee as stated in LER 369/2014-01. I am surprised Duke didn't frame it as a act of god, thus beyond their control.  

The McGuire NRC inspection report 99-07 and this event in LER 2014-01 are identical. Duke is shaping the regulatory response to a ghostly “ inadvertent, unforeseen and a act of god by the licensee” from the real "corruption, falsification of federal documents and pure corporate negligence issue".  

because of unforseen movement of the VSI upon engine shutdown prior to the maintenance activity. The slippage

"The slippage of the VSI"...isn't it hilarious this choice of words. Engineering language...language or word understanding disruption...the real possibility of the operability destruction of the dg through touristy and flowery words and language.   

of the VSI from the cylinder head was attributed to a combination of conditions, most prominently involving elevated exhaust temperatures in tandem with a rapid cylinder cooldown. Other factors that may have contributed to the failure included the quality of the interference fit between the VSI and the head during installation. Improper seat installation reduces contact between the seat and the cylinder head which could make the seat vulnerable to drop out under certain conditions. 

(me-the NRC engineering safety philosophy where uncertainty always gets thrown towards the licensee executive's bonuses) side) 

However, the licensee was not able to establish that the seat was improperly installed during the 1997 rebuild because the subject seat was destroyed and the head distorted during the failure of cylinder 4L( me-or if the part gets destroyed, that gives you the option to lie your teeth off).

Basically the inspectors and NRC's bureaucracy unproductively churning the agencies process without getting a result. Meaninglessly churning the NRC's processes to no ends. Is primarily churning the process the ultimate ends to what is in the best interest of the USA according to the NRC...not making a safer and better world for its people.

The slippage of the VSI was similar to the dropped VSI event that was discovered on EDG 2A in June 1998. The inspectors independently reviewed the diagnostic information of EDG 1B and noted that similar conditions to the dropped VSI event of 1998 were present. However, in this post-maintenance configuration, the engine was not operated at the full load condition. Had these conditions been present during  a full-load run (as is performed to "demonstrate operability), a local alarm for elevated cylinder exhaust temperature would have alerted operators to the conditions. In accordance with the annunciator response procedure, an elevated temperature alarm (activated above 3500 kilowatts EDG load) would trigger an engineering assessment and prompt an extended engine cooldown to prevent dropping a VSI. The inspectors concluded that this degraded condition would not have been permitted to exist following an operability test and that the previous corrective actions would have prevented the EDG from being returned to service in a degraded condition. The licensee informed the inspectors that additional monitoring of cylinder performance at lower load conditions was being evaluated to eliminate this type of failure. Subsequently, maintenance procedures for valve adjustments have been improved to prevent over-adjustments in case of unknown VSI movement. The long-term corrective actions include replacement of all exhaust VSis to an improved VSI part (discussed below).

Cracked VSI (PIP M99-4450)

On October 4, 1999, the licensee performed a visual inspection for potential loose parts from the 4L cylinder failure on the remaining EDG 1 B cylinder heads and discovered a crack on cylinder 2R exhaust VSI. The subject VSI contained a 360-degree circumferential crack; however, the seat remained intact (no missing pieces). A previously cracked VSI occurred at McGuire on May 19, 1998, where a circumferential crack resulted in a 120-degree piece of the exhaust VSI (EDG 1A cylinder 6R) breaking away and lodging onto the turbocharger inlet screen. The inspectors reviewed temperature trends of EDG 1B cylinder 2R, which revealed no abnormal performance. Prior to identification of this cracked VSI, the licensee believed that a precursor condition existed that could be detected prior to failure of a cracked VSI. Although this was true in the previous case, the inspectors observed that these precursor symptoms (lower than expected exhaust temperatures at low load conditions) were not present for the current case. In addition, the root cause of the previously cracked VSI concluded that a material defect likely caused the failure. This conclusion was based on a detailed root cause investigation; however, the metallurgical analysis did not provide conclusive evidence of a defect.

Following the recent VSI crack, licensee corrective action included a video inspection of the VSIs on the other three EDGs. The inspectors considered this to be prudent. The inspectors observed portions of the video boroscope. Video quality and resolution were excellent; however, residual fuel oil limited seat details in some areas and only 300 degrees of the VSI surface could be observed because of physical limitations to camera movement inside the cylinder head. The licensee informed the inspectors that 360 degree cracking had been observed previously on cylinders with approximately one million cycles of operation (65 hours of engine run time). The proposed long-term corrective action was to replace the exhaust VSIs with those having a 0.001 inch greater interference fit and perform the rework with improved installation methods using qualified McGuire maintenance personnel. All EDG 1 B exhaust VSIs were subsequently replaced with those of greater interference fit, the EDG was operated for more than 65 hours, and then the VSIs were boroscoped. For all four EDGs, no additional cracked exhaust VSIs were identified and the inspectors confirmed that each cylinder head inspected did have more than 65 hours of run time prior to the video inspection. The licensee now believes that both cracked VSls were fatigue related failures related to improper installation and not a material defect in the VSI. (me- I can’t  catch my breath I laughing so hard. I think I am having a heart attack)

It is amazing, in the written record and part 21, the magnitude of out of specs and out of tolerances problems with Nordberg nuclear diesel repair and replacement parts throughout many decades. It is amazing how reliable these repair and replacement parts systems are with producing so many out of specs and out of tolerance components over the decades. Another commonality in the Nordberg system over the ages is how incomplete and shallow the engineering and its documentation are with their dgs. How incomplete and the missing is engineering information on Nordberg ds. The Nordberg technical specifications, policies and procedures and information are so insufficient on these nuclear grade safety components.

  

It is the widespread go-to excuse for all of the players. 

Just so you get it, the Nordberg nuclear diesel generator line went out of business many years ago. As the reality of the manufacturing line shutdown was approaching Nordberg, they reduced servicing these machines and updating the documentation of problems. Duke now is basically the QEM (qualified equipment manufacturer) and they basically own the documentation remnants of the Nordberg nuclear grade dg line. Duke sometimes is very dishonest with declaring the problem. Duke basically is a purchaser and owner of Nordberg DGs and they own the business entity named Nordberg. There is no similar QEM designation of a licensee such as Duke in the nuclear industry.  

The licensee speculated that vendor problems with improper dimensional checks and installation technique.

It is dangerous beyond understanding...if a licensee is being allowed to speculate on the failures of safety components. If the players are basically playing Abbott and Costello's "Who's On First" in secret and nontransparent maintenance and components failure in the 

 The NRC,licencees and manufacturers' baseball team.

documentation system between the licencee, manufacturers, vendors and engineering service providers. If the maintenance documentation systems of the players can't be seen amongst themselves and outsiders...then they can play "Who's on First" to their hearts delight with the NRC on why a components failed on a nuclear plant emergency diesel generator...may have contributed to the failures.

may have contributed to the failures. In addition, the vendor rebuilt the heads with a smaller VSI than preferred. ( Oh shit, now my wife has called 911 fearing I am going to bust a vein in my head) The inspectors

 Are just the facts a lie in the big story? What evidence does the NRC have these defective inserts could remained stable in the worst case mission time? What evidence does the NRC infer that the insert cracks are stable and the failure is predictable? See how the NRC always throws the engineering and assumption uncertainties to whatever advantages a licensee. They only caught these cracked inserts by chance…they caught the cracks when another cylinder choked on a lose insert. The NRC can only punish the licensees on what the agency can see and measure...can't incentivize a licensee for having cracks on inserts risking a future failure of the machine when much needed in a accident. 

Who was the vendor that did this inadequate job…why does the NRC protect the name of these bad actor servicing vendors? At the heart of this problem, there is absolutely no NRC oversight of the licensee or their vendors overhauling a diesel generator. The NRC doesn’t have the diesel generator expertise to know the proper maintenance of this machine during an overhaul period.

The agency can only catch the problems and failure with the DG through the rear view mirror of component failure…never catch emergent problems in an on going overhaul. I doubt the inspectors get much training with overseeing DG maintenance overhauls. The NRC is overly dependent with the licencee telling the inspector what went wrong with diesel failures and what went wrong or discovered in a DG overhaul.   

cracked VSIs, just like the other degraded EDG sub-components identified in Violation (VIO) 50-369,370/98-07-07, were attributable to inadequate vendor oversight during the 1997 rebuild of the EDGs. As the corrective actions taken in response to VIO 50-369.370/98-0707 already address vendor oversight improvements, the cracked VSls are considered to be an additional example of VIO 50-369,370198-07-07: Inadequate Vendor Oversight of EDG Refurbishment.

c. Conclusions

A negative trend on emergency diesel generator subcomponent reliability continued with two recent issues involving VSIs. The time spent to address the VSI condition resulted in additional EDG unavailability time, which the licensee has acknowledged as a continuing adverse trend. These

These degraded sub-components were considered an additional example of a previous violation for inadequate vendor oversight of rebuilding activities performed in 1997.

degraded sub-components were considered an additional example of a previous violation for inadequate vendor oversight of rebuilding activities performed in 1997. Corrective action to video boroscope all exhaust VSIs was prudent; the technical basis for continued operability was adequate; and proposed long-term corrective action to replace the exhaust VSIs to a more robust part was acceptable.