IR 05000245/2014008

IR 05000423/2014008; 02/03/2014-02/07/2014 and 05/06/2014 - 05/09/2014; Millstone Power Station Unit 3; Special Inspection Team Report, Inspection Procedure 93812

ML14240A051
Person / Time
Site:	Millstone
Issue date:	08/28/2014
From:	Ho Nieh Division Reactor Projects I
To:	Heacock D Dominion Resources
References
EA-14-092 IR-2014-008
Download: ML14240A051 (40)

Text

August 28, 2014

EA-14-092 Mr. David Heacock President and Chief Nuclear Officer Dominion Resources Millstone Power Station 5000 Dominion Boulevard Glen Allen, VA 23060-6711

SUBJECT: MILLSTONE POWER STATION - NRC SPECIAL INSPECTION REPORT 05000423/2014008 WITH PRELIMINARY WHITE FINDING

Dear Mr. Heacock:

On July 21, 2014, the U.S. Nuclear Regulatory Commission (NRC) completed a special inspection at your Millstone Power Station, Unit 3, in response to repeat overspeed trips of the associated unit's turbine-driven auxiliary feedwater (TDAFW) pump. The enclosed report documents the results of the inspection, which were discussed on May 9, 2014, and July 21, 2014, with Mr. Stephen E. Scace, Site Vice President, and other members of your staff. The special inspection was conducted in response to the TDAFW pump overspeed trips on November 4, 2013, December 18, 2013, and January 23, 2014. The NRC's initial evaluation of this condition satisfied the criteria in NRC Inspection Manual Chapter 0309, "Reactive Inspection Decision Basis for Reactors," for conducting a special inspection. The basis for initiating this special inspection is further discussed in the inspection team's charter that is included in the enclosed report as Attachment B.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel. In particular, the team reviewed event evaluations, causal evaluations, relevant performance history, and extent-of-condition to assess the significance and potential consequences of issues related to the overspeed trips.

The enclosed inspection report discusses a finding that has preliminarily been determined to be a White finding with low to moderate safety significance that may require additional NRC inspections, regulatory actions, and oversight. As described in Section 2.5 of the enclosed report, the finding is associated with an apparent violation of Title 10 of the Code of Federal Regulations (10 CFR) 50, Appendix B, Criterion XVI, "Corrective Action," for Dominion's failure to assure that a condition adverse to quality was promptly identified and corrected. Specifically, the Unit 3 TDAFW pump was operated from May 2013 through February 2014 in an adverse configuration due to the installation of an incorrect cam follower bearing. During this period, as a consequence of this adverse configuration, the pump experienced three overspeed trips. This finding, which the inspectors determined no longer presents an immediate safety concern since the bearing was replaced on February 3, 2014, was assessed based on the best available information, using the applicable Significance Determination Process (SDP). The basis for the NRC's preliminary significance determination is described in the enclosed report. The final resolution of this finding will be conveyed in separate correspondence. Because the finding is also an apparent violation of NRC requirements, it is being considered for escalated enforcement action in accordance with the NRC Enforcement Policy, which appears on the NRC's Web site at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. In accordance with NRC Inspection Manual Chapter 0609, we intend to complete our evaluation using the best available information and issue our final safety significance determination within 90 days from the date of this letter. The NRC's SDP is designed to encourage an open dialogue between your staff and the NRC; however, the dialogue should not affect the timeliness of our final determination. We believe that we have sufficient information to make a final significance determination.

However, before we make a final decision, we are providing you an opportunity to provide your perspective on the facts and assumptions that the NRC used to arrive at the finding and assess its significance. Accordingly, you may notify us of your decision within 10 days to: (1) request a regulatory conference to meet with the NRC and provide your views in person; (2) submit your position on the finding in writing; or, (3) accept the finding as characterized in the enclosed inspection report.

If you choose to request a regulatory conference, the meeting should be held in the NRC Region I office within 30 days of the date of this letter, and will be open for public observation. The NRC will issue a public meeting notice and a press release to announce the date and time of the conference. We encourage you to submit supporting documentation at least 1 week prior to the conference in an effort to make the conference more efficient and effective. The focus of the regulatory conference is to discuss the significance of the finding and not necessarily the root cause(s) or corrective action(s) associated with the finding. If you choose to provide a written response, it should be sent to the NRC within 30 days of the date of this letter. You should clearly mark the response as a "Response to Preliminary White Finding in Inspection Report No. 05000423/2014008; EA-14-092," and send it to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the Regional Administrator, Region I, and a copy to the NRC Senior Resident Inspector at Millstone Power Station. You may also elect to accept the finding as characterized in this letter and the inspection report, in which case the NRC will proceed with its regulatory decision. However, if you choose not to request a regulatory conference or to submit a written response, you will not be allowed to appeal the NRC's final significance determination. Please contact Raymond McKinley at 610-337-5150 within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision. Because the NRC has not made a final determination in this matter, no notice of violation is being issued for this inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violation may change based on further NRC review. The final resolution of this matter will be conveyed in separate correspondence. In addition, the enclosed inspection report documents a violation of NRC requirements which was of very low safety significance (Green). However, because of the very low safety significance and because it is entered into your corrective action program, the NRC is treating this finding as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy. If you contest the non-cited violation in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region I; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at Millstone Power Station. In addition, if you disagree with the cross-cutting aspect assigned to any finding, or a finding not associated with a regulatory requirement in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region I, and the NRC Resident Inspector at Millstone Power Station. In accordance with 10 CFR 2.390 of the NRCs "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,/RA/ Ho K. Nieh Director Division of Reactor Projects Docket No. 50-423 License No. NPF-49

Enclosure:

Inspection Report 05000423/2014008 w/Attachment A: Supplementary Information Attachment B: Special Inspection Charter Attachment C: TDAFW Timeline Attachment D: Detailed Risk Significance Evaluation

cc w/encl: Distribution via ListServ

SUMMARY

IR 05000423/2014008; 02/03/2014 - 02/07/2014 and 05/06/2014 - 05/09/2014; Millstone Power Station (Millstone) Unit 3; Special Inspection Team Report, Inspection Procedure 93812.

This report covered two onsite inspection visits by a special inspection team consisting of a senior reactor analyst, one senior resident inspector, and one senior reactor inspector, all from Region I, and a reactor inspector from Region IV. One apparent violation with potential White safety significance and one Green non-cited violation (NCV) were identified. The significance of most findings is indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) and determined using Inspection Manual Chapter (IMC) 0609, "Significance Determination Process (SDP)," dated June 2, 2011. Cross-cutting aspects are determined using IMC 0310,

"Aspects Within the Cross-Cutting Areas," dated December 19, 2013. All violations of NRC requirements are dispositioned in accordance with the NRC's Enforcement Policy, dated July 9, 2013. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 5.

Cornerstone: Mitigating Systems

Preliminary

White.

The inspection team identified a self-revealing apparent violation of Title 10 of the Code of Federal Regulations (10 CFR) 50, Appendix B, Criterion XVI, "Corrective Action," involving Dominion's failure to promptly identify and correct a condition adverse to quality. Specifically, the Unit 3 turbine-driven auxiliary feedwater (TDAFW) pump was operated from May 2013 through February 2014 in an adverse configuration due to the installation of an incorrect cam follower bearing. As a result of this adverse configuration, the pump experienced three overspeed trips during the subject timeframe. As a consequence, Dominion violated Technical Specification (TS) 3.7.1.2, since TDAFW was determined to be either failed or unreliable for greater than the TS allowed outage time. Dominion installed the correct cam follower, entered this issue in their corrective action program (CAP) as condition report (CR) 538743 and CR 531536, and completed a root cause evaluation (RCE) (RCE 001111). The issue was determined to be more than minor since it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected its objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, operation of the TDAFW pump with the incorrect spherical bearing reduced the reliability of a risk-significant, safety-related mitigating system. The issue was evaluated in accordance with IMC 0609, Appendix A, Exhibit 2, and was determined to require a detailed risk evaluation based on the finding representing an actual loss of function of a single train for greater than its TS allowed outage time. The detailed risk evaluation concluded that the increase in core damage frequency of this issue is in the mid to high E-6 range, or White (low to moderate safety significance). The dominant core damage sequences involved fire scenarios resulting in control room abandonment that rely upon the TDAFW pump as the primary source of make-up to the steam generators and decay heat removal. This finding had a cross-cutting aspect in Human Performance, Consistent Process, where individuals use a consistent, systematic approach to make decisions and risk insights are incorporated as appropriate. Specifically, Dominion did not implement consistent, systematic approaches to resolve the condition as evidenced by their inadequate and inconsistent use of CAP and troubleshooting. [H.13] (Section 2.5)

Green.

The inspectors identified a self-revealing Green NCV of TS 6.8.1, "Procedures and Programs," when Dominion did not maintain an adequate maintenance procedure to ensure reliable performance of the TDAFW system. Specifically, TDAFW properly started following the August 9, 2013, reactor trip, but was subsequently shut down after observed flow and pressure oscillations. Dominion staff discovered the control valve linkage misaligned due to a loose cam follower bearing retaining nut. As part of the repair, Dominion implemented a revision to the C MP 711 procedure to require application of thread-locker to the cam follower bearing retaining nut during reassembly. Additionally, Dominion entered this issue in their CAP as CR 522896. The finding was more than minor because it is associated with the procedure quality attribute of the Mitigating Systems cornerstone and adversely affected its objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the maintenance procedure did not provide sufficient written instructions to ensure adequate torque of the retaining nut and thereby reliable performance of the TDAFW system three months after reassembly. The finding was evaluated using IMC 0609, Attachment 4 and Appendix A, Exhibit 2.A, and determined to be of very low safety significance (Green) since it was not associated with a design or qualification deficiency, not a loss of system/function, and not an actual loss of its TS function. This finding had a cross-cutting aspect in the area of Human Performance,

Documentation, in that licensee organizations are expected to create and maintain complete, accurate, and up-to-date documentation. Specifically, Dominion did not maintain a comprehensive, high-quality maintenance procedure that was thorough to assure assembly of critical TDAFW components. [H.7] (Section 2.3)

REPORT DETAILS

1. INTRODUCTION 1.1 Background and Event Description On May 15, 2013, at the end of a refueling outage, Dominion observed that the Millstone Unit 3 TDAFW pump was experiencing speed oscillations of approximately +/- 100 rpm (or approximately +/-5 percent of average speed) when operating in low flow conditions following a full-flow surveillance test. The pump speed oscillated within 2.8 percent of the overspeed trip setpoint at 4746 rpm. The speed oscillations caused swings in the discharge pressure of +/-105 psig (approximately +/-10 percent of average discharge pressure) which approached within 1.1 percent of the discharge relief valve setpoint. These oscillations were both within the 3 percent setpoint tolerances for the respective devices. After troubleshooting and several adjustments to the turbine speed control governor, the pump did not achieve the required differential pressure during a second full flow test on May 17. Dominion subsequently determined that the oscillations did not reduce pump reliability and attributed the full-flow low differential pressure to the instability of the governor. Dominion concluded that TDAFW pump differential pressure remained above the design requirements specified in the accident analysis and determined the pump was operable.

A reactor trip occurred at Unit 3 on August 9, 2013. The TDAFW pump automatically started and successfully injected to the steam generators. When full flow was no longer needed, operators reduced TDAFW flow to minimum. At minimum flow conditions, discharge pressure exceeded the discharge relief valve lift setpoint (1850 psig) and fluctuated between 1869 psig and 1609 psig. In addition, speed fluctuated between 4656 rpm and 4350 rpm with the design of the overspeed trip setpoint set at 4746 +/-142 rpm. Dominion engineering requested that the pump be shut down when it was no longer required (after approximately four hours of operation) to facilitate troubleshooting. Dominion operations stopped the TDAFW pump, declared the pump inoperable, and entered TS 3.7.2.1 on August 10. Troubleshooting revealed that the governor valve control linkage was out of adjustment (cam follower bearing was not properly aligned in the cam plate cam slot) and the governor's stability compensation was not set correctly. Operation of the TDAFW pump in low flow conditions with an unstable governor could challenge the lift setpoint of the discharge relief valve and result in its opening. Excessive TDAFW pump speed oscillations were believed to challenge the overspeed trip feature of the TDAFW pump and could result in tripping the TDAFW pump when it is needed. On August 12, Millstone adjusted the governor's stability compensation to eliminate the oscillations, which dampened the governor response making it less responsive (more sluggish). They also corrected the problems identified above with the governor valve linkage by replacing the cam follower.

Subsequently, on November 4, 2013, during routine quarterly surveillance testing of the TDAFW system, the TDAFW pump tripped on overspeed during startup. At that time, Dominion believed the cause was water intrusion into the pump via condensate in the steam supply lines. An increased monitoring and surveillance plan was developed. Dominion then began performing surveillance runs weekly to demonstrate continued operability of the pump. On December 18, 2013, they experienced another overspeed trip when the 'D' steam line was unisolated following repairs to address a steam leak.

5 Enclosure Dominion attributed the overspeed trip to condensate in the 'D' steam line. To address water intrusion concerns, Dominion implemented a number of compensatory measures and ran a number of surveillance tests to demonstrate operability. On January 23, 2014, during the weekly surveillance run of the TDAFW pump, it again tripped on overspeed. Dominion did not attribute this trip to water intrusion because they had implemented corrective actions to prohibit condensate intrusion into the pump following the two previous trips. Dominion identified, during subsequent troubleshooting, that a linkage connecting a lever to the cam plate was installed reversed, such that the shoulder on the female end would interfere with the prongs of the connecting lever.

In addition, Dominion identified that the thrust transmitted on the valve stem was

~ 70 lbf, whereas a value of 300 lbf was expected. Following the granting of a Notice of Enforcement Discretion (NOED) to complete repairs on January 26, 2014, the TDAFW pump was returned to service and declared operable at 5:05 a.m. on January 27, 2014. Additional details regarding recent Unit 3 TDAFW system issues can be found in NRC Integrated Inspection Reports (IRs) 05000423/2013004, 2013005, and 2014002.

Notably, two of these reports documented Green findings (FIN) for Dominion's failure to complete an adequate and timely operability determination on TDAFW governor control oscillations and failure to follow their operability procedure to establish adequate compensatory measures to restore TDAFW reliability. Dominion completed an root cause evaluation (RCE) on the Unit 3 TDAFW failures in the second quarter of 2014. Additionally, Millstone launched a focus team tasked to review the past ten years of operational practice, preventive maintenance, industry experience, and other information for the TDAFW pump. 1.2 Special Inspection Scope The NRC conducted this inspection to gain a better understanding of the circumstances involving the TDAFW pump overspeed trips during surveillance testing on November 4, 2013, December 18, 2013, and on January 23, 2014. The inspection team used NRC Inspection Procedure 93812, "Special Inspection," as a guide to complete their review.

Additional inspection and review activities were outlined in the special inspection team charter, provided as Attachment B. The special inspection team reviewed procedures, corrective action documents, work orders, engineering analyses, and the RCE prepared by Dominion. In addition, the team conducted equipment walkdowns and interviewed key plant personnel regarding the discovery and resolution of the condition. A list of site personnel interviewed and documents reviewed are provided in Attachment A to this report. 1.3 Preliminary Conditional Risk Assessment The failure of the TDAFW pump involved a failure of safety-related equipment. There have been equipment and performance issues related to this pump dating back to the conclusion of the outage in May 2013. Additionally, in the 2013 3rd Quarter Resident Inspection Report (05000423/2013-004), there is a finding that involves an inadequate operability determination related to governor performance on this pump.

Using the Millstone Unit 3 SPAR model, the Region I Senior Reactor Analyst (SRA)calculated the conditional core damage probability (CCDP) for the TDAFW pump 6 Enclosure overspeed trip failures and associated unavailability times. Based upon best available information and a review of the known problems with the TDAFW pump since August 2013, the calculated CCDP was 1.52E-6. Based upon the preliminary CCDP estimate of low E-6 range, in accordance with IMC 0309, this event fell within the range for a Special Inspection Team. Additional details regarding the assumptions used in the IMC 0309 risk evaluation are located in Attachment B, Special Inspection Charter, of this report.

2. SPECIAL INSPECTION AREAS 2.1 Review of the Notice of Enforcement Discretion (NOED)

a. Inspection Scope

On January 23, 2014, the Unit 3 TDAFW pump failed a required surveillance test. During the starting sequence, the pump tripped on overspeed due to mechanical binding in the turbine governor valve linkage. Dominion entered TS limiting condition for operations (LCO) 3.7.1.2(a) action (c) which provided up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to repair the failed pump before requiring Unit 3 to be shutdown to Mode 3. Troubleshooting efforts revealed that the mechanical linkage between the mechanical governor and the turbine governor control valve had binding in the open position due to a linkage being reversed. Additionally, a worn cam follower bearing was replaced along with the governor assembly. Although repairs had been completed, it became apparent that the required post-maintenance tests, including a full flow test at full power, could not have been completed prior to the expiration of the LCO on January 26, 2014. Dominion requested enforcement discretion from compliance with TS 3.7.1.2 for a period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The NRC reviewed the request in accordance with IMC 0410, "Notices of Enforcement Discretion," and granted a one-time 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> extension to required action statement (C)of TS LCO 3.7.1.2(a). Dominion completed the post-maintenance testing and restored the TDAFW pump to an operable status within the additional time granted. An Unresolved Item (URI) was opened in accordance with the IMC 0410 process and was documented in IR 05000423/2014002, Section 4OA3. The team reviewed the sequence of events and details of the issue to determine whether there should be any enforcement action associated with the granting of the NOED.

b. Findings and Observations

No findings were identified. IMC 0410 provides the NRC staff a process to exercise enforcement discretion for unanticipated temporary noncompliances with applicable TS LCO or other license conditions. IMC 0410, Attachment 1, "NOED Checklist," item 07d, asks, "Did the licensee provide information that shows the licensee fully understands the cause of the situation that has led to the NOED request?" The inspection team concluded that, at the time of the NOED request, Dominion's information was complete and accurate.

However, in hindsight and based on review of the issue and Dominion's RCE, Dominion had not fully understood the direct cause of the overspeed events. Specifically, in the RCE Attachment 8, it states "the decision that the cause was the governor or the identified linkage problems, did not remove the direct cause of the overspeed trips, leaving the TDAFW pump susceptible to future trips." The installation of the wrong cam follower bearing was identified on January 30, 2014, following the end of the NOED period and Dominion declaring TDAFW operable. Additionally, IMC 0410, section 03.05 7 Enclosure describes inappropriate uses of the NOED process and states that NOEDs are not appropriate to troubleshoot maintenance issues. The team concluded that, in hindsight, Dominion had not fully identified the direct cause of the TDAFW situation that led to the NOED request. This inadequate understanding of the cause is captured as part of the apparent violation discussed in section 2.5 of this report. The NOED specified a list of prerequisites and compensatory actions to mitigate risk that were required to be verified and completed prior to the 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> extension becoming effective. Inspectors reviewed and verified Dominion's satisfactory completion of the specified requirements in the NOED. The URI documented in section

4OA3 of IR 05000423/2014002 is closed.

2.2 Event Timeline

a. Inspection Scope

The team generated a timeline of events which captured the failures, maintenance evolutions, and tests performed on the TDAFW system. The team also reviewed timelines located in Dominion's RCE associated with TDAFW performance. The timeline is attached in Attachment C of this inspection report.

b. Findings

No findings were identified. 2.3 Review of Maintenance

a. Inspection Scope

The team evaluated the adequacy and completeness of the maintenance on the TDAFW system, including preventive maintenance, maintenance practices, procedural guidance, post-maintenance testing, and supervisory oversight. The team independently evaluated selected procedures, preventive maintenance strategies, CRs, system health reports, and associated work orders. In addition, the team reviewed the RCE, conducted equipment walkdowns, and interviewed key station personnel. For weaknesses identified, the inspectors verified that appropriate corrective actions have been planned or taken.

1. Findings

Introduction.

The inspectors identified a self-revealing Green NCV of TS 6.8.1, "Procedures and Programs," involving Dominion's failure to maintain an adequate maintenance procedure to ensure reliable performance of the TDAFW system.

Specifically, TDAFW responded to an August 2013 reactor trip but was subsequently shut down and declared inoperable after observed flow and pressure oscillations. Dominion staff discovered the control valve linkage misaligned due to a loose cam follower bearing retaining nut.

8 Enclosure

Description.

During the Spring 2013 Millstone Unit 3 refueling outage, the TDAFW pump governor valve and governor valve linkage were overhauled using work order 53102204245 to correct a governor valve packing steam leak. Work order step 9 stated, "IAW C MP 711, reconnect control valve linkage." Maintenance procedure, C MP 711, "Terry Turbine Governor Control Valve Maintenance," Revision 002-01, step 4.6.1.a stated in part, "ASSEMBLE and INSTALL the following as necessary, ensuring there is no load on valve stem: valve stem connector and cam follower assembly to cam plate." The maintenance was completed on May 7, followed by post-maintenance testing and declaring the system operable. On August 9, Unit 3 experienced an automatic reactor trip on low steam generator water level. The TDAFW system actuated and provided flow in response to the trip. At 109 minutes into the response and coincident with being placed on minimum flow, equipment operators reported flow and pressure oscillations to the main control room. When TDAFW was placed on minimum flow, flow oscillations increased and discharge pressure spikes above the relief valve setpoint but below the overspeed setpoint were observed. At the request of the equipment operator and based on both low flow demand and availability of motor-driven AFW pumps, Operations shutdown the TDAFW pump and declared it inoperable. During a subsequent TDAFW walkdown, a Dominion engineer noted that the cam follower bearing was not properly aligned in the linkage cam plate (CR 522896). The retaining nut that retains the bearing assembly had backed off, came in contact with the fulcrum support, and resulted in the bearing being displaced 3/8" out of the cam slot, almost its full width. As part of the repair, Dominion implemented a revision to the C MP 711 procedure to require application of thread-locker to the cam follower bearing retaining nut during reassembly and completed post-maintenance testing to include a full-flow test to the steam generators.

Regulatory Guide (RG) 1.33, Appendix A, paragraph 9.a requires, in part, that

"Maintenance that can affect the performance of safety-related equipment should be properly pre-planned and performed in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances. Skills normally possessed by qualified maintenance personnel may not require detailed step-by-step delineation in a procedure." In this case, the C MP 711 instructions did not include specific steps for tightening the nut that retains the cam follower bearing assembly. The inspectors determined that this failure demonstrated its ability to affect safety-related equipment performance and therefore mandated that specific procedural guidance exist. Despite this, the inspectors also concluded that TDAFW did not lose its function given the appropriate response to the August 2013 reactor trip, the pump's continued operation when placed on minimum flow, the inability of the bearing to disassemble based on physical constraints, and the determination that, under postulated design basis conditions, the gradual adjustments to lower TDAFW discharge flow to meet decay heat removal demand would support continued satisfactory operation, despite the degraded bearing condition.

Analysis.

Failure to maintain an adequate maintenance procedure that adversely impacts TDAFW performance was a performance deficiency. The finding was more than minor because it is associated with the procedure quality attribute of the Mitigating Systems cornerstone and adversely affected its objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the maintenance procedure did not provide sufficient written instructions to ensure adequate torque of the retaining 9 Enclosure nut and thereby reliable performance of the TDAFW system three months after reassembly. The finding was evaluated using IMC 0609, Attachment 4 and Appendix A, Exhibit 2.A, and determined to be of very low safety significance (Green) since it was not associated with a design or qualification deficiency, not a loss of system/function, and not an actual loss of its TS function. Specifically, the inspectors concluded there was not a loss of function based on the TDAFW's appropriate response to the August 2013 reactor trip, the pump's continued operation when placed on minimum flow, the inability of the bearing to disassemble based on physical constraints, and the determination that, under postulated design basis conditions, the gradual adjustments to lower TDAFW discharge flow to meet decay heat removal demand would support continued satisfactory operation, despite the degraded bearing condition.

This finding had a cross-cutting aspect in the area of Human Performance, Documentation, in that licensee organizations are expected to create and maintain complete, accurate, and up-to-date documentation. Specifically, Dominion did not maintain a comprehensive, high-quality, maintenance procedure that was thorough to assure assembly of critical TDAFW components. [H.7]

Enforcement.

TS 6.8.1 requires, in part, that "Written procedures shall be established, implemented, and maintained covering the activities referenced below: a. The applicable procedures recommended in Appendix A of RG 1.33, Revision 2, February 1978." RG 1.33, Appendix A, paragraph 9.a requires, in part, that "Maintenance that can affect the performance of safety-related equipment should be properly pre-planned and performed in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances. Skills normally possessed by qualified maintenance personnel may not require detailed step-by-step delineation in a procedure." Contrary to this, on May 7, 2013, Dominion did not maintain an adequate maintenance procedure, C MP 711, "Terry Turbine Governor Control Valve Maintenance," to ensure proper assembly of the control valve linkage. As a result, on August 9, 2013, during a reactor trip response, the TDAFW control valve linkage became misaligned, degraded pump performance, and the train was subsequently shutdown and declared inoperable. Dominion revised the procedure to require thread-locker and used the procedure to reassemble the linkage. Because this violation was of very low safety significance (Green), and Dominion entered this issue into their CAP, this violation is being treated as an NCV, consistent with Section 2.3.2.a of the Enforcement Policy. (NCV 05000423/2014008-001, Failure to Maintain Adequate Maintenance Instructions for the Turbine Driven Auxiliary Feedwater Pump Governor Control Valve Linkage) 2. Observations In addition to the corrective action violation above, the inspectors identified several minor issues that contributed to TDAFW degraded system performance. Heim Joint Configuration During corrective maintenance following the January 2014 TDAFW overspeed trip, Dominion identified that the cam plate linkage at the connective lever had been installed in reverse. Dominion immediately corrected the configuration and discovered evidence through a subsequent investigation that the linkage, also known as a Heim joint, had been installed incorrectly since 2008. A Dominion contractor determined that friction in this linkage was not considered a cause of the overspeed trips since the force required 10 Enclosure to cause a lock-up of the linkage was in excess of those forces observed during pull tests during valve disassembly and reassembly. Dominion revised their maintenance procedure to ensure the linkage connecting rod was installed correctly (CA281255). This issue of incorrect installation was determined to be minor in accordance with IMC 0612.

Governor Valve Stem Stroke Following the January 2014 TDAFW overspeed trip, inspectors completed field observations during Dominion's corrective maintenance including control valve linkage and stem setup. Procedure C MP 711, "Terry Turbine Governor Control Valve Maintenance," Revision 2-02, section 4.1.2, indicated that the as-found linkage condition should be an approximate valve travel of 0.625". The team noted, through field observations, an as-found stroke length of a nominal 0.860" for the governor valve stem, approximately 38 percent greater than the nominal value. The stem stroke length setting above the nominal target value was also confirmed through a review of data compiled from strain gauges that Dominion had installed on the stem prior to the last overspeed event on January 23, 2014. Dominion and vendor analyses, subsequent to the overspeed events, concluded that setting the cam follower higher in the cam plate slot results in a further open control valve position and an associated increase in the stem thrust required to overcome backpressure and dynamic loading during a system start. Therefore, a setting of 0.860" versus the stated approximate valve stem travel of 0.625" would have resulted in a greater challenge to the governor and linkage to overcome the initial backpressure to initiate stem movement and prevent an overspeed condition. The team noted that Dominion's RCE had not addressed or identified that the as-found stroke length had been a nominal 38 percent above the previous maintenance procedure nominal value.

This was also not discussed as a contributing cause although the previous setup would have reduced the available stem thrust. During the inspection, Dominion concluded that the vendor's analysis of linkage forces and conclusions were not significantly impacted by the as-found stroke length. However, the team noted that if the cam follower coefficient of friction was assumed to have been 0.5, this would have increased the force required on the linkage lever arm attached to the cam plate by a nominal 16 percent for the target stem thrust. On January 25, 2014, Dominion identified that a Woodward Governor drawing existed that had information not previously contained in maintenance procedures. C MP 711 was updated in revision 2-05 to reflect that excessive valve travel can cause binding in the cam plate due to the roller bearing traveling into an area not normally used.

However, the team noted that direction in step 4.1.8 is for a minimum valve travel of 0.625" with no associated limit placed on the maximum allowable valve travel in the open position or cam follower position in the plate. Dominion initiated CR 548174 to further investigate the effect of the maximum stem travel to determine if a bounding value needs to be included in the procedure. The team noted that the actual as-left stem stroke was a nominal 0.680" after the January 26, 2014, maintenance and this setting has been verified through several tests to be adequate. Dominion had previously identified the need to revise their procedures and had left the stem stroke setting close to the targeted range, which effectively reduced the force required for stem movement.

The team determined the stroke length issue to be of minor significance in accordance with IMC 0612.

11 Enclosure Governor Linkage Pull Test The team noted that Dominion's maintenance procedures included provisions for a pull test designed to perform a static check of the forces required through the linkage on the valve stem to stroke the governor valve. The test consisted of installation of a gauge block on the stem. This was to ensure that the pull test was performed consistently near the full open to full closed stroke length of 0.625". As noted above, the team determined that the previous pull tests may not have consistently been measuring the maximum forces within the linkage for the static test because the as-found stem stroke length had previously been 0.860". This pull test had been performed by Dominion to gain confidence that there was no binding within the governor valve and linkage above the established 26 pounds for the acceptance criterion. However, the team noted that because the actual stem stroke length exceeded the 0.625", the potential existed that the pull test had not effectively been measuring the maximum forces required with the cam follower deeper within the cam slot (a more open valve). Additionally, the RCE had eliminated the direct cause of the overspeed events for other nonconforming or degraded items identified within the governor linkage, in part, based on the assumption that the pull test would have measured inadequate forces during the valve stroke with the linkage. The team noted that this had not been a conservative assumption based on the as-found stem stroke being greater than the assumed 0.625" and the use of the gauge block which would have limited the stem from full travel based on the gauge block installation. The team determined that this was a weakness in the vendor evaluation attached to the RCE, but could not conclude that the direct cause determined would have changed. Dominion wrote CR 551507 to evaluate this and had already been considering changes to the pull test based on the knowledge that the previous testing had not captured the linkage binding issues. Discussions with Dominion engineering indicated they are evaluating incorporation of dynamic forces into the test to improve the capability of detecting any conditions adverse to quality within the governor linkage.

This issue was determined to be minor in accordance with IMC 0612.

Calibration Acceptance Criterion for Electrical Overspeed Trip The team questioned why station calibration procedures for the electrical overspeed loop allowed a tolerance which could potentially result in an electrical overspeed trip during the most challenging load conditions. Specifically, when pump flow is lowered or removed from the steam generators and transitioned to minimum flow conditions, this effectively challenges the control system to respond and maintain the desired speed setting.

The team noted that the existing acceptance criteria of 4752 +/-120 rpm could result in leaving the setpoint at a low enough value where an inadvertent trip could occur during TDAFW load changes. Specifically, during load change demands such as removing flow to steam generators to control level, actual plant data showed that turbine speed overshoots the controller setpoint and rises above the lower level of the overspeed trip acceptance criterion. Actual full flow test results had shown speed overshoots above 4632 rpm when removing load from the pump which had been the acceptable low end of the speed band. The team determined that the instrument calibration procedure acceptance criteria for TDAFW electrical overspeed trip loop accuracy were inadequate in that it would allow the potential to trip the TDAFW pump during load changes. The loop allowable tolerance was not adequate given the low margin to the trip. The team determined this to be a minor violation in that actual test data reviewed for as-found trip 12 Enclosure setpoints had showed little to no drift in the instrument loop relative to the tested overspeed trip setting. Dominion entered the issue into their CAP (CR 547231) to ensure the allowable band could not result in inadvertent overspeed trips when Operations performs load changes. This issue was determined to be minor in accordance with IMC 0612. 2.4 Review of Operating Experience

a. Inspection Scope

The team reviewed and evaluated Dominion's application of pertinent industry and internal operating experience and evaluation of potential precursors including the adequacy of any actions taken in response to the operating experience or precursors.

Specifically, the team reviewed both internal and external operating experience involving TDAFW pump failures and actions taken by the Millstone staff to identify and address these types of failures. In addition, the team examined the specific issues associated with linkages between the governor and control valve and control valve packing leakage to assess any new generic issues of industry interest for prompt communication and dissemination.

b. Findings and Observations

No findings were identified.

Operating Experience The inspectors determined that while Dominion had considered pertinent industry and internal operating experience, Dominion had not properly evaluated NRC Information Notice (IN) 2010-020, "Turbine-Driven Auxiliary Feedwater Pump Repetitive Failures." IN 2010-020 states, in part, that the operating experience examples discussed "illustrate the importance of ensuring that any condition adverse to quality affecting the TDAFW system is fully understood so that appropriate corrective actions can be taken.

Repetitive failures may indicate that although the direct cause of the original condition was addressed, the root cause remains uncorrected." Inspectors determined there were no CAP entries regarding IN 2010-020 and there was nothing in the TDAFW system health report related to the IN. Dominion's RCE for this issue concluded that the events described in IN 2010-020 "were not specifically applicable to the Unit 3 TDAFW pump overspeed trips." Based on Dominion's failure to identify and fully understand the cause of the overspeed trips, the inspectors determined that the IN 2010-020 discussion was pertinent to the Millstone 3 TDAFW condition. The inspectors concluded this issue was minor in accordance with IMC 0612.

Relief Valve Margin Issue The team determined that challenges to the TDAFW discharge relief valve margin continue at the station. Millstone 3 issued Licensee Event Report (LER) 2010-004 in August 2010 for TDAFW being inoperable due to a degraded discharge relief valve, RV45. Specifically, minimal margin between the relief valve setpoint and TDAFW discharge pressure while on recirculation flow caused the relief valve to leak past its seat. The LER stated that "as corrective action to prevent recurrence, design changes are being evaluated to modify the system configuration." The team noted that similar 13 Enclosure lifts of this relief valve were observed during tests within the timeframe of the Special Inspection Team scope. The inspectors questioned the operability of the Unit 3 TDAFW pump since the relief valve may be challenged if the turbine was close to the overspeed setpoint (CR 538720). Specifically, peak discharge pressure was within the +/- 3 percent American Society of Mechanical Engineers tolerance of the relief valve. As a result, an operability determination, OD000577, was written to address this operability concern.

One of the required actions of OD000577 was to tighten the as-left tolerance to 1850 to 1868.5 psig (+1/- 0 percent). The inspectors concluded this issue was minor in accordance with IMC 0612. 2.5 Review of Causal Analyses

a. Inspection Scope

The team evaluated the adequacy of Dominion's response to the TDAFW system failures, including Dominion's cause analyses, extent of condition, corrective actions, and failure mode considerations. Further, the team reviewed Dominion's final RCE for the TDAFW system failures. The team reviewed plant drawings, videos, procedures, and associated system modifications. In addition, the team conducted a walkdown of the TDAFW system and interviewed key Millstone personnel.

b. Findings

Introduction.

The inspection team identified a self-revealing apparent violation of 10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," involving Dominion's failure to promptly identify and correct a condition adverse to quality. Specifically, the Unit 3 TDAFW pump was operated from May 2013 through February 2014 in an adverse configuration due to installation of an inappropriate cam follower bearing within the turbine control valve linkage. As a result of this adverse configuration, the pump experienced three overspeed trips during the subject timeframe. As a consequence, Dominion violated TS 3.7.1.2, since TDAFW was determined to be either failed or unreliable for greater than the TS allowed outage time.

Description.

On May 12, 2013, during the Millstone Unit 3 Spring 2013 refueling outage, preventive maintenance was performed on the TDAFW pump system that included a governor control valve overhaul, associated work on the valve stem linkage, and cam follower bearing replacement. On August 9, TDAFW started on an automatic actuation signal, coincident with a Unit 3 reactor trip. When the demand for maximum auxiliary feedwater flow (two motor-driven pumps and the TDAFW pump in service) was no longer needed, TDAFW was taken to minimum flow conditions and subsequently shutdown. During a walkdown of the system post-actuation, Dominion observed that the cam follower bearing on the control valve stem connector rod was misaligned. In response, Dominion replaced the cam follower bearing, reassembled the stem connector assembly, and completed post-maintenance testing on August 11, 2013.

On a routine surveillance test on November 4, the TDAFW pump tripped on electrical overspeed during its initial startup acceleration. Dominion captured this issue as CR 531536 and attributed this trip to condensate in the steam supply lines. Dominion implemented compensatory measures to include ensuring the steam traps were adequately draining the lines, isolating the 'D' steam supply line, and completing weekly operating surveillances to demonstrate reliability. On December 18, the 'D' steam 14 Enclosure supply line was reopened for a TDAFW surveillance test and the TDAFW pump tripped on electrical overspeed during initial startup acceleration. Dominion captured this issue as CR 535411 and incorporated it in an existing RCE (RCE 001111) started from the November overspeed trip. During a surveillance test on January 23, 2014, TDAFW tripped again on electrical overspeed during the initial startup. During Dominion's investigation and troubleshooting, the maintenance staff discovered that the Heim joint on the linkage between the governor and the TDAFW control valve was installed in reverse (CR 537933). During this at-power troubleshooting and repair activity, Dominion corrected the inverted Heim joint, replaced the cam follower bearing, replaced the governor, checked governor valve internals, and conducted a full-flow test following the successful request and receipt of an NOED to exceed the 72-hour TS allowed outage (ML14030A601).

Following the successful test and after declaring the TDAFW system operable, Dominion determined that the installed cam follower bearing, that rolls in the cam plate slot, was an inappropriate part. Specifically, the installed bearing lacked an aluminum bronze insert that provided inherent lubricity. On February 3, 2014, Dominion took the TDAFW pump out of service, replaced the cam follower bearing with the correct part, successfully completed post-maintenance testing, and declared TDAFW operable. Subsequently, Dominion reported this condition under 10 CFR 50.73(a)(2)(i)(B) for a condition prohibited by TSs given that the TDAFW was either failed or unreliable for greater than the TS allowed outage time (ML14189A071).

With respect to troubleshooting of the overspeed events, Dominion's RCE determined that the November 2013 troubleshooting was narrowly focused on the presence of condensate in the steam supply lines and did not provide adequate justification for excluding other failure modes. MA-AA-103, "Conduct of Troubleshooting," Revision 10, step 3.6.10 requires documentation of the reason for eliminating failure modes on the failure mode tree. Dominion also noted that complex troubleshooting teams were not established for the subsequent overspeed trips. MA-AA-103, step 3.4.1 requires complex troubleshooting if the activity requires involvement from more than two disciplines, requires specialized personnel such as vendors, or poses an operational risk. Step 3.4.3 requires a team for challenges associated with short duration LCOs and other significant equipment problems.

In addition to the troubleshooting performed, the inspectors noted other opportunities for Dominion to identify the overspeed cause. On December 12, 2013, CR 534108 documented rust-colored residue on the turbine linkage, specifically the jam nut, cam follower, and fulcrum support plate slot. Dominion determined that "corrosion does not impact current operability" and closed the CR to trending. On December 5, 2013, CR 534403 documented that the control valve and cam plate were moving in discrete versus smooth movements. Subsequent to the overspeed events, the governor vendor agreed that a sticking linkage could cause the discrete movements. This CR was closed to a work order to troubleshoot and repair the control valve packing. On December 19, 2013, CR 535491 documented an equipment operator's observations that the cam follower did not rotate in the linkage, dragged, appeared to be cocked at the end of the surveillance, and the as-left condition did not match the as-found condition. This CR was closed with no additional corrective actions. During linkage corrective maintenance and installation following the January 2014 overspeed trip, rough spots were found on the cam follower bearing and it was replaced.

15 Enclosure The team's independent review and assessment of RCE 001111 and associated TDAFW pump troubleshooting plans identified additional observations regarding Dominion's use of troubleshooting and the CAP. Formal troubleshooting had not been performed as required by MA-AA-103 for the August 2013 oscillations. Second, indications of rubbing/scuffing marks on the outer diameter surface of the cam follower observed by Dominion on August 9, following the reactor trip and TDAFW actuation, were not documented in the CAP (CR 539041). Finally, the inspectors noted that Dominion installed a sensor on the control valve stem to monitor the forces applied in early January 2014 after the pump had tripped twice on overspeed conditions. Overall, the inspectors determined that the incorrect cam follower bearing was a condition adverse to quality that was within Dominion's ability to foresee, correct, and should have been prevented. The inspectors did not identify a performance deficiency associated with the receipt inspection of the incorrect bearing as the critical characteristics were below the thresholds established by the vendor and the manufacturer. A Noncompliance report was submitted on March 17, 2014, in accordance with 10 CFR 21.21(d)(3)(i) under Event Notification System 49923. The inspectors considered August 11, 2013, as the first reasonable opportunity for Dominion to identify the incorrect bearing.

Analysis.

The team determined that Dominion's failure to promptly identify and correct a condition adverse to quality constituted a performance deficiency. The issue was evaluated in accordance with IMC 0612, Appendix B, and was determined to be more than minor since it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected its objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, TDAFW pump operation with the incorrect cam follower bearing resulted in three TDAFW pump overspeed trips thereby reducing the reliability of a risk-significant, safety-related mitigating system. The issue was evaluated in accordance with IMC 0609, Appendix A, Exhibit 2, and was determined to require a detailed risk evaluation based on the finding representing an actual loss of a single train for greater than its TS allowed outage time.

As detailed in Attachment D of this report, a detailed risk evaluation concluded that the increase in core damage frequency associated with the reduced reliability of the TDAFW pump was estimated to be in the mid to high E-6 range, or White (low to moderate safety significance). As discussed in the attached detailed risk evaluation, the dominant core damage sequences contributing to the risk significance of this performance deficiency involve postulated fire scenarios that would cause operators to abandon the control room due to smoke, fire or loss of control functions. In these postulated low frequency and severe fire events, the operation of the TDAFW pump is relied upon, and solely credited, for providing steam generator make-up and associated decay heat removal, per station emergency operating procedures. In recognition of the singular importance of the TDAFW pump for mitigation of fires leading to the abandonment of the control room, Dominion has completed or initiated emergency operating procedural improvements to support operator actions for TDAFW pump recovery and use of the motor-driven AFW pumps if free from fire damage. The team understands that Dominion is also considering the development of primary "feed and bleed" procedure steps to provide an alternative core damage mitigation success path.

This detailed risk evaluation was reviewed during a Significance and Enforcement 16 Enclosure Review Panel held on July 29, 2014. The finding no longer presents an immediate safety concern because Dominion corrected the condition adverse to quality in February 2014. This finding had a cross-cutting aspect in Human Performance, Consistent Process, where individuals use a consistent, systematic approach to make decisions and risk insights are incorporated as appropriate. Specifically, Dominion's troubleshooting was inconsistent in that it deviated from their established process as exemplified by being narrowly focused, not systematically justifying exclusion of other failure modes, not using a formal method, and not properly incorporating multi-discipline teams. Additionally, when previous operability determinations such as those associated with steam line condensate and identified corrosion were called into question by new facts, Dominion did not properly re-evaluate their operational decision making to ensure it was appropriate. Finally, Dominion's CAP was not used consistently as exemplified by staff not entering adverse conditions into the CAP, closing CRs without corrective actions, and delayed implementation of a monitoring sensor as a corrective action. [H.13]

Enforcement.

10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," states, in part, that "measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected." Contrary to this, from August 11, 2013, to February 3, 2014, Dominion did not promptly identify and correct an inappropriate cam follower bearing installed in the Millstone 3 TDAFW system. The incorrect part had been installed since May 12, 2013, and the TDAFW system experienced three overspeed trips on initial starts. As a result of the failure to correct the condition, Dominion also violated TS 3.7.1.2, since TDAFW was determined to be either failed or unreliable for greater than the TS allowed outage time. There were no actual safety consequences. Immediate corrective actions included replacing the cam follower bearing with the correct part, successfully completing post-maintenance testing, and entering the issue in Dominion's CAP as CR 538743 and CR531536. This issue is being characterized as an apparent violation in accordance with the NRC's Enforcement Policy, and its final significance will be dispositioned in separate future correspondence. (Apparent Violation 05000423/2014008-02, Failure to Promptly Identify and Correct a Turbine-Driven Auxiliary Feedwater Condition Adverse to Quality) 2.6 Review of Operability and Reportability

a. Inspection Scope

The team reviewed Dominion's evaluation of conditions surrounding the issue for reportability to verify Dominion met the proper reporting requirements of 10 CFR 50.72 and 10 CFR 50.73. Additionally, the team reviewed Dominion's evaluation of the issue under 10 CFR 21. Finally, the team reviewed the adequacy of Dominion's assessments of past operability with regards to the TDAFW system.

b. Findings and Observations

No findings were identified.

10 CFR 50.73 Subsequent to completion of the RCE, Dominion determined that TDAFW performance constituted a reportable condition. Specifically, under CR 531536, Dominion determined that firm evidence of a discrepant condition existed for periods of time exceeding TS 3.7.1.2 LCO allowed outage time and was, therefore, a condition prohibited by TSs.

Dominion submitted the associated LER on June 30, 2014.

10 CFR 21 On March 17, 2014, Dresser-Rand issued a Defects and Noncompliance report in accordance with 10 CFR 21.21(d)(3)(i) under Event Notification System 49923.

Specifically, ten bearings were shipped under part number 75439A07 to Dominion Nuclear in 2006 that were Seal Master Com 8 bearings that did not have an aluminum bronze insert. Dresser-Rand acknowledged that extended operation without lubrication will result in the Seal Master Com 8 bearing seizing. Customers were directed to visually inspect their bearings for the bronze insert and to replace the bearing at the first opportunity if no insert was visible. On April 17, 2014, Dresser-Rand submitted their final report of the defect under their own report number 47. Operability Determinations Following the November 4, 2013, overspeed trip, Dominion completed an operability determination (OD000561) that attributed condensate in the steam supply lines as the cause. In late February 2014, an engineering technical evaluation (ETE-CME-2014-1002) determined that condensate accumulation in the steam lines was consistent with Millstone Unit 3 operational experience and did not adversely impact TDAFW operability. This was also captured in CR 541414. In total, from November 2013 through January 2014, OD000561 had been revised five times. Dominion's RCE identified numerous challenges with their implementation of the operability process. Examples included one revision that involved approval of an uncontrolled copy, one revision that was approved without full alignment of the Operations department, and consecutive revisions that credited condensate before and after the steam supply air-operated isolation valves respectively as the cause for overspeed trips without an explanation for the change.

Further, the first few revisions included contradictory sections. Specifically, the linkage/control valve stem failure mode had been "eliminated based on satisfactory operation of the turbine" while a compensatory measure of operating TDAFW at an increased frequency had been established to verify that potential valve stem binding was not occurring. IMC 0326, "Operability Determinations & Functionality Assessments for Conditions Adverse to Quality or Safety," states, in part, that "the supporting basis for the reasonable expectation of SSC [structure, system, and component] operability should provide a high degree of confidence that the SSCs remain operable" and that "the standard of 'reasonable expectation' is a high standard." The inspectors questioned Dominion on whether they had identified an adverse trend in operability determinations based on the sequence described above as well as two NCVs related to operability determinations documented in 2013 NRC IRs. Dominion's Nuclear Oversight department had identified this as an area for improvement in December 2013 (CR 535412) and Engineering documented their role in this process as a gap to excellence in February 2014 (CR 540138). The inspectors concluded this issue was minor in accordance with IMC 0612.

18 Enclosure

4OA6 Meetings, Including Exit

On May 9, 2014, the inspectors presented the inspection results to Mr. Stephen E. Scace, Site Vice President, and other members of the Millstone staff. The inspectors verified that no proprietary information was retained by the inspectors or documented in this report.

On July 21, 2014, the inspectors presented the inspection results to Mr. Matthew Adams, Plant Manager, and other members of the Millstone staff. The inspectors verified that no proprietary information was retained by the inspectors or documented in this report.

ATTACHMENT A:

SUPPLEMENTARY INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

R. Acquaro Unit 3 Shift Manager

M. Adams Plant Manager L. Armstrong Director of Safety and Licensing J. Barile Nuclear Engineer III

A. Bussham Organizational Effectiveness Manager

F. Cietek Nuclear Engineer, PRA

T. Cleary Licensing Engineer D. Dodson Supervisor, Nuclear Engineering G. Closius Licensing Engineer

M. Goolsbey Manager - Millstone 3 Operations

C. Maxson Manager, Nuclear Engineering, Site

G. McGovern Supervisor, Nuclear Maintenance

J. Rigatti Manager, Nuclear Site Engineering P. Russell Shift Manager

S. Scace Site Vice President

D. Scott Senior Engineer

M. Vezina Component Engineer

B. Willkens Manager - Millstone Excellence H. Thompson Contract Engineer J. Barile System Engineer

S. Coulter Maintenance Lead

R. Witt Contract ESI Engineer

LIST OF ITEMS OPENED, CLOSED, DISCUSSED, AND UPDATED

Opened

05000423/2014008-02 AV Failure to Identify and Promptly Correct a Condition Adverse to Quality (Section 2.5)

Opened/Closed

05000423/2014008-01 NCV Failure to Provide Adequate Maintenance Instructions for the Turbine Driven Auxiliary Feedwater Pump Governor Control Valve

Linkage (Section 2.3)

Closed

05000423/FIN-2014002-01 URI NOED Granted by NRC for TDAFW Pump Repairs on January 26, 2014 (Section 2.1)

Attachment A

Section 1R01: Adverse Weather Protection

CRs 531945

536654

534290

522911

537933

538172

514502

535411

531665

515988

534875

528526

535587

538019

487952

535881

531536

533234

520252

537883

532984

538007

535685

538015

2932

515999

537862

515950

515821

532536

511710

535744

538764

538755

538634

539069*

539142*

539024*

539041*

535491

534108

522896

539047*

539056

539064*

538473

537871

537940

538018

537863

538932*

538926*

538016

538942*

538961*

538785*

538812

538826

538929*

538945*

538825

538823

538813

538812

538720*

534403

536347

538082

536515

536564

538353

392003

2155

540001*

539506

547231

548736*

548268*

548740*

548143*

548174*

540277

540298

540305

554370*

• NRC Identified during inspection

Procedures

MP 3720AC, Auxiliary Feedwater Pump Turbine Maintenance, Revision 005-13

PI-AA-300, Cause Evaluation, Revision 7

PI-AA-300-3001, Root Cause Evaluation, Revision 4

PI-AA-300-3002, Apparent Cause Evaluation, Revision 6

PI-AA-200, Corrective Action, Revisions

21 and 22

MA-AA-103, Conduct of Troubleshooting, Revision 10

OP-AA-100, Conduct of Operations, Revision 25

MP 3704A-303, Preventive maintenance Technique for Terry Turbine Trip Throttle Valve Linkage, Revision 003-002

MP 3704A-304, Preventive maintenance Technique for Terry Turbine Governor to Governor Control Valve Linkage Adjustment, Revision 002-001, Revision 002-002, Revision 002,05,

Form

MP 3710AA-147D, Lubrication Maintenance Technique Terry Turbine Aux Feedwater Pump - Trip Throttle Valve Linkage, Revision 003-02

MP 3762AC, Terry Turbine Trip Throttle Valve Maintenance, Revision 004-00 WC 9, Station Surveillance Program, Revision 005-06

SP 3622.3, Auxiliary Feedwater Pump 3FWA*P2 Operation Readiness Test, Revision 017-18

C

MP 711, Terry Turbine Governor Control Valve Maintenance, Revision 002-05,

IC3485I02, Turbine Driven AFW Pump Airpax Model 300 Electronic Tachometer, Revision 1

3670.1-011, Rad Waste Operation Unit 3 Default Tour Type, Pages 12-14 of 26,

Revision 008-11

Surveillance Tests

SP 3622.3, Auxiliary Feedwater Pump 3FWA*P2 Operational Readiness Test, Revision 017-18, completed 2/4/14

SP 3622.9, TDAFW Pump Full Flow Test in MODE 1, Revision 000-01, dated 1/26 and 27/14

Attachment A

SP 3622.3, Auxiliary Feedwater Pump 3FWA*P2 Operation Readiness Test, Revision 017-13, performed 11/8/2013 SP3622.3-001, TDAFW Pump Operational Readiness and Quarterly IST Group B Pump Tests, Revision 014-05, performed 2/25/13, 5/17/13, 8/12/13, 8/13/13, 11/4/13, 11/06/13, 11/07/13, 11/16/13, 11/18/13, 12/02/13, 12/18/13, 12/18/13, 12/19/13, 12/20/13,

2/20/13, 12/26/13, 1/02/14, 1/10/14, 1/23/14, and 1/23/14 SP3622.3-002, TDAFW Overspeed Test (Using Main Steam), Revision 009-04, performed 1/26/14,

SP3622.3-002, TDAFW Overspeed Test (Using Compressed Air), Revision 001-02, performed 11/03/11, and 5/11/13 SP2622.3-001, AFP Turbine Overspeed Trip Test, Revision 005-07, performed 11/5/12

SP3622.3-003, TDAFW Pump Time Response Test, Revision 008-03, performed 8/26/13

SP3622.3-003, TDAFW Pump Time Response Test, Revision 008-04, performed 1/27/14

SP3622.3-004, ESF Building Emergency Ventilation System Test, Revision 009-004, performed 2/25/23 SP3622.3-005, TDAFW Pump IST Comprehensive Pump and check Valve Test, Revision 004-04, performed 8/12/2013, and 5/17/13 SP3622.3-008, Refuel Testing of TDAFW Pump Team Supply

Non-Return Isolation Valves, Revision 000-003, performed 5/15/13 SP3622.8-001, Auxiliary Feedwater Train 'A' Valve Stroke Time Test, Revision 010-01 performed 1/28/13, 1/28/13, 7/16/13, and 10/8/13 SP3622.8-009, Auxiliary Feedwater Train 'B' Valve Stroke Time Test, Revision 000-06 performed 3/25/13. 6/17/13, 9/10/13, and 12/6/13 SP3622.8-012, TDAFW Pump Control Valves Stroke Time Test, Revision 000-02, performed 2/24/13, 5/13/13, 8/17/13, and 11/3/13

SP 3616A.1-002, Stroke Time and Failure Mode Text of 3MSS*AOV31A, B, D, 3MSS*AOV65; Stroke Time Test of 3MSS*MOV31A, B, and D, Revision 008-07, performed 2/25/13,

6/11/13, 6/27/13, 8/17/13,

9/17/13, 11/14/13, 11/16/13, 11/21/13, and 12/18/13

SP 3616A.1-012, TDAFW Pump Remote Position Indication Verification, Revision 000-03, performed 11/21/13

Work Orders

53102700183 53102204245 53102634186

53102656351 53102204245 53102634186 53102656351 53102677787 53102689251 53102689777 53102700183 M3 06 06228

M3 06 00466

Drawings

EM-123A, Main Steam and Reheat, Revision 58

EM-130B, Feedwater System, Revision 47

MP 3704A-304, Terry Turbine Governor to Governor Control Valve Linkage Adjustment Unit 3 Terry Turbine Seam Supply Drain Line Isometric For Information Only Drawings

DC

C900178, Crosby Pressure Relief Valve, Revision A 800328D, Terry Turbine Electrical Schematic, Revision 2 25212-29736 Sh.13, The Terry Steam Turbine Co. Lever Diagram, Revision 11/29/07

212-26923, P&ID Main Steam and Reheat, Revision 58

212-26941, P&ID Turbine Generator and Feed Pump Oil Systems, Revision 23

212-26945, P&ID Turbine Plant Miscellaneous Drains, Revision 37 25212-26930, P&ID Feedwater System SH2, Revision 47 25212-26930, P&ID Feedwater System SH4, Revision 27

212-26930, P&ID Feedwater System SH3, Revision 25

Attachment A Other Documents Engineering Logs from March 2013 through January 2014

Operating Experience

IN 2010-20

IN 1994-66

IN 1993-51

IN 1990-05

Millstone 3 OE Tracking - MPS - IN10-20

Evaluations MRE016681

OD000577, Prompt Operability Determination, Revision 0, dated 2/7/14

OD000571, Prompt Operability Determination, Revision 0, dated 1/25/14 CA276914

ACE 18312

ETE-CME-2014-1002, TDAFW Pump Steam Line Condensate Between 3MSS*AOV31A/B/D and 3MSS*MOV17A/B/D, Revision 0 RCE001111, Millstone 3 TDAFW Pump Trips on 11/4/13, 12/18/13, and 1/23/14, Revision 1

DM3-00-0309-07, Actual Speed Setting for MP3 Auxiliary Feedwater Pump/Turbine, dated 10/4/07

ETE-CME-2013-1026, Permissible Water Level for MPS3 Terry Turbine Drain Lines,

Revision 0

ETE-MP-2014-1016, Technical Basis for Acceptability to Perform TDAFW Pump Full Flow Test during Operational Mode, Revision 0

ETE-CME-2013-11262, 50.59 for continuous flow through Steam Trap 3DTM-TRP16B

Revision 3

ETE-MP-2013-1207, Unit 3 TDAFW Pump (3FFWA*P2) Speed Oscillations Experienced During 3R15 Testing Basis Form Operation, Revision 0

Miscellaneous

LCR 3FWA-040, Loop Calibration, Revision 1 Operations Standing Orders:

SO-13-025,

SO-13-027,

SO-13-028,

SO-14-001,

SO-14-004, and

SO-14-007

LER 05000423/1994-014

LER 05000423/1994-011

LER 05000423/2010-004

LER 05000423/2008-006

Operation Log Entries concerning TDAFW matters for 2013 through 2/3/2014

C

MP 711, Terry Turbine Governor Control Valve Maintenance, Revision 002-02 performed 5/16/2013

MA-AA-103 Attachment 2, Terry Turbine Tripped on Overspeed Troubleshooting Plan dated 11/5/13

MA-AA-103 Attachment 2, Terry Turbine Tripped on Overspeed Troubleshooting Plan dated 12/19/13

MA-AA-103 Attachment 2, Terry Turbine Tripped on Overspeed Troubleshooting Plan dated 1/23/14

MA-AA-103 Attachment 4, Complex Troubleshooting Failure Mode/Cause Table dated 11/5/13 Unit 3 TDAFW Pump Governor Valve Linkage videos taken during surveillance test starts on 4/29/12, 3/31/14, 1/23/2014, 12/18/2013, 11/4/2013, and 8/12/2013 Engine Systems, Inc. Certificate of Conformance dated 10/30/13 for Governor S/N

2093192

Engine Systems, Inc. Test as Received Reports for Governor S/N

2093192 dated 2/21/2013

Attachment A Engine Systems, Inc. Mechanical Governor Condition Report for Governor S/N

2093192 dated 2/22/2013. Engine Systems, Inc. Test as Received Reports for Governor S/N

2082283 dated 3/28/2014.Engine Systems, Inc. Mechanical Governor Condition Report for Governor S/N

2082283 dated 3/28/2014 Woodward Governor specification Report for Part Number 9903-232-ESI dated 8/8/2005

Bingham-Willamette

MSD-DS 4x6x10B Nameplate Information, 0-1 Revision 5

Purchase Order

45363353 dated 5/23/2005 for roller bearings Purchase Order

45443567 dated 6/8/2006 for ten roller bearings On-The-Job Training MP3 Terry Turbine Trip Linkage Adjustment, Revision 4 2014 Non License Training AFW2014 Just In Time Training MP3 Terry Turbine Operation FWA061C Lesson Title: Auxiliary Feedwater System, Revision 6 ch2

FSAR 10.4.9 Auxiliary Feedwater System Technical Data Sheet Safety & Relief Valves for 3FWA*RV45 Station Procedure Change Form for

SP 3622.3, Revision 4 Change 1 dated 10/24/1990

VTM 25212-041-003, Terry Steam Turbine vendor manual, Revision 01

Specification

SP-ME-691, Specification for General Thermal Insulation (Design and Installation) for Millstone Nuclear Power Station - Unit 3 dated 11/13/1981 Plant Process Computer Data Graphs of 3FWA*P2 Speed Versus Time for surveillances performed; 11/4/13, 11/5/13, 11/6/13, 11/12/13, 11/15/13, 11/18/13, 12/2/13, 12/18/13, 12/18/13, 12/19/13, 12/20/13, 12/20/13, 12/16/13, 1/2/14, 1/16/14, 1/10/14, 1/23/14,

1/26/14, and 1/27/14 FWA*P2 Governor Output Force vs. Cam Bearing Friction for Different Control Valve Stem Loads Plant Process Computer Graphs of 3FWA*P2 Speed, Discharge Pressure, and Flowrate vs. Speed for surveillance starts performed 5/5/13, 5/15/13, 5/17/13, 8/9/13, 8/12/13, 11/4/13, 11/5/13, 11/6/13, 11/12/13, 11/15/13, 11/18/13, 12/12/13 and 12/20/13 Chart of TDAFW Pump Governor Linkage Forces versus Cam Follower Friction Coefficient, Cam Plate Slot Angle and Valve Position Attachment A

LIST OF ACRONYMS

10 CFR Title 10 of the Code of Federal Regulations

CAP Corrective Action Program

CC [[]]

DP conditional core damage probability

CR Condition Report

Dominion Dominion Nuclear Connecticut, Inc

IMC Inspection Manual Chapter

IN Information Notice IR Inspection Report

LCO limiting condition for operation

LER licensee event report

Millstone Millstone Power Station

NCV Non-cited violation

NOED Notice of Enforcement Discretion

NRC Nuclear Regulatory Commission

RCE Root Cause Evaluation

RG Regulatory Guide

SDP Significance Determination Process SRA Senior Reactor Analyst

SSC structure, system, or component

TDA [[]]

FW turbine driven auxiliary feedwater

TS Technical Specifications

URI Unresolved Item

B-1 Attachment B Special Inspection Charter Millstone Nuclear Power Station Unit 3 Multiple Turbine-Driven Auxiliary Feedwater (TDAFW) Pump failures from May 2013 to January 23, 2014

Background:

On May 15, 2013, at the end of the refueling outage, Dominion observed that the Millstone

Unit 3 turbine-driven auxiliary feedwater (TDAFW) pump was experiencing speed oscillations of approximately +/- 100 rpm (or approximately +/-5% of average speed) when operating in low flow conditions following a full-flow surveillance test. The pump speed oscillated within 2.8% of the

overspeed trip setpoint at 4746 rpm. The speed oscillations caused swings in the discharge

pressure of +/-105 psig (approximately +/-10% of average discharge pressure) which approached within 1.1% of the discharge relief valve setpoint. These oscillations are both within the 3% setpoint tolerances for the respective devices. After troubleshooting and several adjustments to the turbine speed control governor, the pump did not achieve the required differential pressure

during a second full flow test on May 17. Dominion subsequently determined that the

oscillations did not reduce pump reliability and attributed the full-flow low differential pressure

to the instability of the governor. Dominion concluded that

TDA [[]]

FW pump differential pressure remained above the design requirements specified in the accident analysis and determined the pump was operable.

A reactor trip occurred at Unit 3 on August 9, 2013. The

TDA [[]]

FW pump governor linkage was

observed to be misaligned, and the pump was noted to be oscillating when operating at low flow

rates. Discharge pressure exceeded the discharge relief valve lift setpoint (1850 psig) and fluctuated between 1869 psig and 1609 psig. In addition, speed fluctuated between 4656 rpm and 4350 rpm with the overspeed trip setpoint set at 4746 +/-142 rpm. The system engineer

requested that the pump be shut down when it was no longer required (after approximately four

hours of operation) to facilitate troubleshooting. The shift manager stopped the

TDA [[]]

FW pump,

declared the pump inoperable, and entered Technical Specification 3.7.2.1 on August 10. Troubleshooting revealed that the governor control linkage was out of adjustment (cam plate misaligned to the cam follower) and the governor compensator was not set correctly. Operation

of the

TDA [[]]

FW pump in low flow conditions with an unstable governor could challenge the lift

setpoint of the discharge relief valve and result in its opening. Excessive

TDA [[]]

FW pump speed

oscillations were believed to challenge the overspeed trip feature of the

TDA [[]]

FW pump and

could result in tripping the

TDA [[]]

FW pump when it is needed. On August 12, Millstone adjusted the governor compensator to eliminate the oscillations but that adjustment made the governor less responsive (more sluggish). They also corrected the problems identified above with the governor linkage.

Subsequently, on November 4, 2013, during routine quarterly surveillance testing of

TDAFW system, the

TDAFW pump tripped on overspeed shortly after the pump starting. At that time, Dominion believed the cause was water intrusion into the pump via condensate in the steam

supply lines. An increased monitoring and surveillance plan was developed. Dominion then

began running surveillance runs weekly to demonstrate continued operability of the pump.

On December 18, 2013, they experienced another overspeed trip when the 'D' steam line

was unisolated following repairs to a steam leak. Dominion attributed the overspeed trip to condensate in the 'D' steam line. With regards to water intrusion, the licensee implemented a number of compensatory measures and ran a number of surveillance tests to demonstrate operability.

B-2 Attachment B On January 23, 2014, during the weekly surveillance run of the

TDA [[]]

FW pump, it again tripped on overspeed. Dominion did not attribute this trip to water intrusion as the cause because they

implemented corrective actions to prohibit condensate intrusion into the pump following the two trips above. Dominion identified, during subsequent troubleshooting, that a key link in the governor control linkage had been installed incorrectly and was mechanically binding, thus

preventing the governor from establishing proper control of the turbine during a start sequence.

In addition, Dominion identified that the thrust output from the governor module was ~ 70 lbf,

whereas a value of 300 lbf was expected. Following the granting of a Notice of Enforcement

Discretion (NOED) to complete repairs on January 26, 2014, the

TDA [[]]

FW pump was returned to service and declared operable at 0505 on January 27, 2014.

Dominion is currently completing a root cause evaluation and the resident inspectors continue

to conduct baseline inspections with assistance from Division of Reactor Safety specialists.

Additionally, Millstone has launched a Focus team tasked to review the past ten years of operational practice, preventive maintenance, industry experience, and other information for the

TDA [[]]

FW pump.

Basis for the Formation of the Special Inspection Team: The failure of the

TDA [[]]

FW pump involved a failure of safety-related equipment. There have been equipment and performance issues related to this pump dating back to the conclusion of

the outage in May 2013. Additionally, in the 3rd Quarter Resident Inspection Report of 2013,

there is a finding that involves an inadequate operability determination related to governor

performance on this pump.

Using the Millstone Unit 3 Standardized Plant Analysis Risk (SPAR) model, the Region I Senior Reactor Analyst (SRA) calculated the conditional core damage probability (CCDP) for the

TDAFW pump overspeed trip failures and associated unavailability times. Based upon best available information and a review of the known problems with the

TDAFW pump since August 2013, the SRA made the following conservative assumptions to estimate the risk associated with the unreliability and unavailability of the pump: 1) the exposure time of the problems involving the turbine-driven pump date back to restart of the unit on August 12, 2013, and

includes approximately 4,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />; 2) during surveillance testing conducted between

November 4, 2013, and January 12, 2014, the

TDA [[]]

FW pump failed on demand (due to

overspeed) 3 times out of approximately 9 starts; this 0.33 failure probability is used rather than

the nominal 0.0649 value, to reflect actual failure to start probability for the exposure period; and 3) conservatively, no operator recovery credit following an overspeed trip failure was assigned. The SRA used the zero Test & Maintenance model for this risk assessment, in accordance with

established guidance.

The calculated

CC [[]]

DP is: 1.52E-6. If an operator recovery credit was to be assigned of a 1 in 10 chance of failure; the estimated

revised

CC [[]]

DP would be 1.52E-6 X 1/10 = 1.52E-7. If the external event contribution were to

be added, due to the importance of the

TDA [[]]

FW pump for fire mitigation, preliminary values

obtained from the licensee would result in the

CC [[]]

DP increasing to the middle of the E-6 range.

Based upon best available information and the uncertainty of assigning a recovery credit because of the unknown

TDAFW pump failure mechanism(s), the 1.52E-6

CCDP value was

selected to represent the estimated risk increase associated with the Inspection Manual Chapter

B-3 Attachment B (IMC) 0309 reactive inspection assessment. This

CC [[]]

DP value places the risk in the "No Additional Inspection" to "Special Inspection Team" overlap region.

Based upon the preliminary

CCDP estimate of low E-6 range, in accordance with

IMC 0309, this event falls within the range for a Special Inspection Team.

Objectives of the Special Inspection: The objectives of the special inspection are to review and assess: (1) Dominion's planning and execution of the risk significant work activities on the

TDAFW system; (2) equipment issues related to the

TDAFW testing; and (3) Dominion's response to this significant equipment failure.

To accomplish these objectives, the following will be performed: 1. Review whether there should be any enforcement action associated with the granting of the

NO [[]]

ED. 2. Generate a timeline of events which captures the failures, maintenance evolutions, and tests performed on the

TDAFW system. 3. Evaluate the adequacy and completeness of the maintenance on the

TDAFW system, including preventive maintenance, maintenance practices, procedural guidance, post-

maintenance testing, and supervisory oversight.

4. Evaluate Dominion's application of pertinent industry operating experience and evaluation of potential precursors including the adequacy of any actions taken in response to the operating experience or precursors.

5. Evaluate the adequacy of Dominion's response to the

TDAFW system failures, including Dominion's cause analyses, extent of condition, corrective actions, and failure mode considerations. 6. Verify the licensee met the proper reporting requirements of 10

CFR 50.72 and 10 CFR 50.73. Also determine if the licensee has plans to issue a Licensee Event Report to

document this issue.

7. Evaluate the adequacy of Dominion's past operability with regards to the

TDA [[]]

FW system.

8. Evaluate Dominion's assessment of the risk significance of the degraded condition, including evaluation of input assumptions and independently evaluate the risk significance. 9. Evaluate the adequacy of Dominion's final root cause for the

TDA [[]]

FW system failures. (Approximate completion date March 2014)

Additionally, the team leader will review lessons learned from the Special Inspection and, if appropriate, prepare a feedback form on recommendations for revising the Reactor Oversight Process baseline inspection procedures in order to proactively identify the issues and causes

involved with the event.

B-4 Attachment B Guidance: Inspection Procedure 93812, "Special Inspection," provides additional guidance to be used by the Special Inspection Team. Team duties will be as described in Inspection Procedure 93812.

The inspection should emphasize fact-finding in its review of the circumstances surrounding the

event. It is not the responsibility of the team to examine the regulatory process. Safety concerns identified that are not directly related to the event should be reported to the Region I

office for appropriate action. The Team will conduct an entrance meeting and begin the initial onsite inspection on

February 3, 2014. While on site, the Team Leader will provide daily briefings to Region I

management, who will coordinate with the Office of Nuclear Reactor Regulation, to ensure that all other parties are kept informed. Additional inspection activities will continue through completion of Dominion's final root cause analysis. The inspection is anticipated to complete in March 2014. A report documenting the results of the inspection should be issued within 45 days

of the completion of the inspection. This Charter may be modified should the team develop

significant new information that warrants review.

C-1 Attachment C Millstone Unit

3 TDA [[]]

FW Timeline

5/12/13 During 3R15,

WO 53102204245 installs Seal Master cam roller, overhauls control valve, inspects inner/outer packing gland areas, and replaces stem spacers/washers 5/15/13 Maintenance run and full flow operational test (

SP 3622.3-005) 5/17/13 Operational readiness/quarterly

IST test (

SP [[3622.3) 8/9/13 Automatic start on Reactor trip 8/10/13 System engineer finds governor valve linkage out of alignment. 8/11/13 Cam follower replaced, thread-locker applied to cam roller nut, governor tuned. Maintenance run and Operational readiness test (SP 3622.3) 8/12/13 Maintenance run and full flow test (SP 3622.3) 8/26/13]]

TDAFW Time Response test (

SP 3622.3) 11/4/13

TDAFW overspeed trip during Operational readiness/quarterly

IST 3622.3) 11/18/13 Operational readiness test (SP 3622.3) 12/2/13 Operational readiness test (SP 3622.3) 12/18/13]]

TDAFW overspeed trip during operational readiness test (

SP 3622.3). Operational readiness test (SP 3622.3) for information only, not operability 12/19/13 After pump linkage pull test, Operational readiness test (SP 3622.3) 12/20/13 Two operational readiness tests, second one for operability (SP 3622.3) 12/26/13 Operational readiness test (SP 3622.3)

C-2 Attachment C 1/2/14 Operational readiness test (SP 3622.3) 1/10/14 Operational readiness test (SP 3622.3) 1/16/14 Operational readiness test (SP 3622.3) 1/23/14

TDAFW overspeed trip during operational readiness test (

SP 3622.3) 1/26/14 Dominion requests

NOED for Millstone 3. Governor replaced, Heim joint orientation corrected, cam follower bearing replaced. Maintenance run,

SP 3622.9, and full flow tests. 1/27/14 Operational readiness test with single steam supply line (SP 3622.3) 1/29/14

CR 538353 identifies unexpected wear and oxidation observed on removed cam follower bearing on both 8/11/13 and 1/26/14. 1/30/14

CR 538743 identifies

TDAFW has the incorrect cam follower bearing 2/3/14 Dominion takes

TDAFW out of service, replaces cam follower with correct part.

SIT inspectors observe disassembly/reassembly maintenance. 2/4/14 Maintenance run and surveillance (

SP 3622.3) as post-maintenance test.

D-1 Attachment D Detailed Risk Significance Evaluation Initial Screening

The failure to identify and correct the installation of an incorrect cam follower bearing in the turbine governor control valve linkage to the turbine-driven auxiliary feedwater (TDAFW) pump, a condition adverse to quality, was more than minor and a performance deficiency (PD). This

finding was screened for safety significance using IMC 0609, "Significance Determination

Process," Appendix A, Exhibit 2, "Mitigating Systems Screening Question," and determined to

require a detailed risk evaluation because the automatic start function of the

TDA [[]]

FW pump was determined to be either failed or unreliable for greater than the Technical Specification allowed outage time. Specifically, in the time period of August 11, 2013 to February 3, 2014, the

incorrect cam follower bearing contributed to three turbine overspeed trips and a number pump

output flow oscillation problems adversely impacting the reliability and dependability of the

pump.

Detailed Risk Evaluation

The Senior Reactor Analyst (SRA) used the Systems Analysis Programs for Hands-On Evaluation (SAPHIRE) Revision 8.1.0 and the Standardized Plant Analysis Risk (SPAR) Model

for Millstone Unit 3, Model Version 8.20, to conduct the internal events detailed risk evaluation and the licensee's Individual Plant Examination (IPE) for Severe Accident Vulnerabilities and the Individual Plant Evaluation External Events (IPEEE) to assess the external events risk contribution for this performance deficiency.

Internal Events Contribution The

SRA used the below table to summarize the condition of the

TDAFW pump between the period of May 2013 and February 2014, when the incorrect Seal Master roller bearing was installed. The total number of credited demands (cold start surveillance tests using SP3622.3-

005, "TDAFW Full Flow Operational Test," and one automatic start on August 9, 2014) and

failures (turbine trip on overspeed) during the time period the incorrect cam follower bearing was

installed was three failures in 25 total demands. The

SRA used the failure probability of 3/25 or 0.12 to accurately represent the reliability of the

TDAFW pump while the incorrect bearing was installed. While the exposure period for the incorrect bearing installation is approximately 259

days, the team identified the performance deficiency for the period between August 11, 2013

and February 3, 2014 (173 days). The August 11, 2013 date represents the first opportunity

that Dominion had to have identified the incorrect bearing installation and February 3, 2014

represents the day the bearing was replaced with the correct bearing, resolving the adverse condition to quality.

D-2 Attachment D Date(s) Failure/Demand Exposure Period Notes: 05/15-17/13 0/3 86 days 3 steam lines in service; 05/15 new incorrect Sealmaster bearing installed;

08/09 auto start on reactor trip and

pump shutdown after 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> operating

due to flow oscillations 08/09/13 0/1 08/11/13 0/2 08/12-26/13 0/1 (new incorrect bearing installed) 14 days 08/26/13 0/1 <1 day 1 steam line (B) in service 08/26-11/04/13 1/1 (overspeed trip) 70 days 3 steam lines in service, no starts other than 11/04 quarterly ST 11/05-06/13 0/1 42 days 2 steam lines in service (D isolated) 11/12/13 0/1 11/16/13 0/1 11/18/13 0/1 12/02-18/13 0/1 12/18/13 1/1 (overspeed trip) <1 day 3 steam lines in service 12/18-20/13 0/3 35 days 2 steam lines in service: on 01/26 - Heim joint R2 properly installed,

governor replaced, valve set-up corrected 12/26/13 0/1 01/02/14 0/1 01/10/14 0/1 01/16/14 0/1 01/23/14 1/1 (overspeed trip) 11 days 01/26/14 0/1 01/27/14 0/1 02/03/14 Correct Heim bearing installed The

SRA made the following changes to the Millstone Unit 3

SPAR model: Turbine Driven Feed Pump P2 failure to start (AFW-TDP-FS-P2) basic event nominal failure probability (6.5E-3) was changed to reflect the failure rate (overspeed trips per demands) during the time the incorrect roller bearing was installed, equal to 0.12 Exposure time for the condition case was set at 173 days Based upon these changes to the model, the calculated conditional or delta core damage frequency (CDF) is 2.75E-6 (conditional case) minus 1.93E-6 (base case) equal to 8.2E-7/year. Internal Events Recovery Credit

The Millstone

3 SPAR model does not include an operator action recovery probability for the

TDAFW pump. To estimate a recovery probability, the

SRA confirmed that Unit 3 Emergency Operating Procedures (

EOP s) address operator actions to establish or recover the

TDAF [[]]

WP (refer to

EOP 35

FR-H.1, "Response to Loss of Secondary heat sink,") as directed by E-0,

"Reactor Trip or Safety injection". The team identified that between December 18, 2013 and

January 30, 2014, Dominion revised

EOP 35

FR-H.1 four times to enhance operator guidance

and to improve the likelihood of a successful restart of the turbine. Based upon Dominion's

D-3 Attachment D identified direct cause of the three

TDAFW pump overspeed trip events and the absence of any actual attempts by operators to recover the

TDAFW pump following these trip events, the SRA

concluded that recovery credit was more dependent upon the mechanistic failure of the turbine control system than the success of operators to implement recovery actions in a timely manner. Accordingly, the SRA assumed the recovery probability was the same as the failure probability

for the exposure period.

The SRA considered the range of possible recovery credit from between zero, or no recovery

credit, to no less than 0.01, using a

SP [[]]

AR-H human reliability analysis approach with nominal performance shaping factors. Based upon the team's review of the videotapes of the observed turbine overspeed trips, in all cases the governor valve control linkage did not move until the turbine tripped. This indicated that the control linkage was either bound (presumably due to the

frictional forces caused by the incorrect roller bearing) or the combination of the resistive forces

applied by steam admission to the turbine (valve stem load), incorrect bearing frictional forces and linkage resistance were greater than the output of the governor attempting to drive the control valve to the closed position. An argument can be made that following the turbine trip and closure of the control valve, the linkage and any associated binding has been exercised and

free to move on a subsequent demand. This situation would support assigning recovery credit

commensurate with nominal human failure probabilities. Likewise, an argument can be made that the same binding or cumulative resistive forces remain and could cause the control valve linkage to bind again on a subsequent restart attempt. In this case, it would be appropriate to

assign zero recovery credit, because the failure mechanism(s) has not been cleared or

corrected. As stated above, absent conclusive evidence, the team believes the most

appropriate and reasonable recovery credit is assumed to be no better or worse than the

failure probability derived from the demands and failures observed during the exposure period associated with the incorrect bearing installed.

Using the above calculated delta

CDF value and the approximate recovery probability, the

SRA

calculated the total internal risk contribution for this PD to be 8.2E-7 x 0.12 = 9.8E-8/year. ,

Although this calculated delta

CDF value is less than 1E-7, based upon the importance of the

TDAFW pump to fire scenario mitigation, per

IMC 0609, Appendix A, Section 6.0, "Detailed Evaluations," it is appropriate to evaluate this

PD for risk associated with external events.

Per

IMC 0609, Appendix H, a review of this

PD for potential impact on Large Early Release

Frequency (LERF) identified that none of the dominant internal event core damage sequences

involve steam generator tube rupture; and therefore screen this issue from further review for

LERF considerations. The dominant core damage sequences include initiating events involving loss of either

DC bus,

loss of offsite power or transients, with subsequent loss of normal and auxiliary feedwater and

failure to cool the primary via feed and bleed.

External Events Contribution

To evaluate the external events contribution for this performance deficiency, the

SRA reviewed the Millstone Unit 3 Individual Plant Examination (

IPE) for Severe Accident Vulnerabilities, dated

August 1990 and the Individual Plant Examination External Events (IPEEE), dated September 1992. Millstone Unit 3 does not have a fire

PRA. From the

IPE and

IPEEE , the

SRA determined that the importance of the

TDA [[]]

FW pump in mitigation of fire events is significantly higher than seismic and other external event hazards (i.e., tornadoes, high winds, external

flooding, transportation, and plane crashes) based upon the

TDA [[]]

FW pump being a protected

(from fire) single train system. Consequently, the external event risk contributions to events

D-4 Attachment D other than fire were not considered. In addition, the

SRA reviewed external event notebooks developed by the

NRC for similar four-loop pressurized water reactors to gain risk insights and

appropriate fire scenario modeling examples. To approximate the delta

CDF contribution for this

PD, the SRA used the quantitative values

derived from the

IPE and

IPEEE for fire zone core damage contribution, fire frequencies and

severity factors associated with non-detection/suppression probabilities. IPE Table 3.5-5,

"Mean Frequency - Fire Areas versus Plant Damage States," identifies, by fire zones, the

approximate annualized contributions to total fire

CDF (4.8E-6/year) assuming the complete loss of the fire zone due to a postulated fire. The fire zones of interest that have auxiliary feedwater (

AFW ) system dependencies are: Control Room (Zone

CB -9); Instrument Rack Rooms (

CB 11-A and 11B); Cable Spreading Room (CB-8) and the Charging and

CCP Zone (

AB-1). These four zones account for approximately 60 percent of the annualized fire risk

(or 3.03E-6/year). The

SRA also used

IPE Table 3.5-4, "Fire Initiating Event Frequencies," to obtain specific fire frequencies, by fire zone, and the associated approximate severity factors.

In the event of a fire in any of the above affected fire zones, operators would evaluate control

room abandonment and potentially implement remote shutdown strategies per the guidance in

EOP 3509.1 (Control Room, Cable Spreading Area or Instrument Rack Room Fire) or

EOP 3509.2 (Auxiliary Building Fire). Important to note is that, upon entry into either of these procedures for a fire, both

EOP 3509.1 and 3509.2 prohibit entry into

EOP E-0, "Reactor Trip or

Safety Injection." Consequently, should the

TDAF [[]]

WP fail to automatically start or run, there is no direct procedural guidance to attempt recovery of the pump via these two procedures, unlike

the procedural guidance in E-0, as discussed above. Also, the SRA identified that Millstone Unit

does not credit primary feed and bleed in the control room abandonment fire mitigation strategies. Per

IMC 0609 guidance and the Risk Assessment of Operational Events (

RASP) Handbook, Volume 1,"Internal Events," Section 6, without procedural guidance, operator

recovery credit is generally not allowed in the risk assessment. Likewise,

NUREG -1921, "

EPRI /NRC-RES Fire Human reliability Analysis Guidelines," Section 4.6.3, Procedures and Training, states that: "If any fire response actions are required that are not proceduralized, the fire

HRA should not take credit for them as a first approximation. Non-proceduralized recovery actions are to be credited on an as-needed basis." The

SRA notes that subsequent to the

problems associated with the

TDA [[]]

FW pump, Dominion did revise the procedural guidance

in

EOP 3509.1 and 3509.2 to include

TDAFW pump recovery action steps.

Closer examination of the four fire zones of interest and the associated fire response procedures identified that for the Charging and

CCP Zone

AB-1 fires, the motor-driven AFW

pumps remain available and are credited in EOP 3509.2. Discussions with the Dominion Risk

Analyst identified that the Cable Spreading Room Zone

CB -8 fire contribution calculated in the

IPE (surrogate 1990) does not credit the subsequent (2002) installation of an incipient fire detection system (IDS). The IDS detectors are installed in the cable trays (vice general area)

to ensure prompt detection. The IDS was installed to address an unreliable automatic carbon dioxide suppression system that had to be placed in manual mode to prevent inadvertent actuations. In addition, Dominion believes that appropriate transient combustible controls

minimize any fire ignition risk in this zone. Accordingly, the

IPE Zone

CB -8 fire frequency and estimated fire risk contribution may be overly conservative. Based upon

NUREG /

CR 6850, Supplement 1, early fire detection provided by an IDS may be applied for fire risk reduction.

Along with the early actions of the fire brigade to suppress a fire or de-energize a degrading

ignition source prior to that detected fire damaging surrounding equipment, IDS fire protection

credit or a reduction factor of 0.5 is reasonable and has been previously accepted by the NRC staff for similar circumstances. To address the potential conservatisms in the documented Zone

D-5 Attachment D CB-8 fire risk contribution. In July 2014, Dominion completed a detailed engineering evaluation

of the ignition sources and associated targets, detection and suppression capabilities for the cable spreading room. Based upon this evaluation, the revised fire frequency (inclusive of the severity factors) was re-calculated to be 4.52E-5/year.

The SRA used a simplified event tree (see below) to represent the external fire risk per affected

fire zone. As stated above, the fire frequencies were taken from

IPE Table 3.5-4. The nominal

TDAFWP fail to start (

FTS ) probability (6.49E-3) was taken from the Millstone

3 SPAR Model. The individual fire zone contributions are summarized in the following table. Fire Zone Fire Frequency Nominal

CDF Case (FTS =

6.49E-3) Condition

CDF Case (

FTS =

0.12) Delta

CDF [[]]

CB -9 4.48E-4/year 2.91E-6/year 5.38E-5/year 5.09E-5/year

CB 11A and 11B 1.50E-4/year 9.74E-7/year 1.8E-5/year 1.70E-5/year

CB -8 4.52E-5/year 2.93E-7/year 5.42E-6/year 5.13E-6/year Total 7.30E-5/year To account for the exposure period of 173 days, the total fire zone contribution value of 7.30E-5/year is multiplied by 173/365 or 0.474 to calculate the external event delta

CDF value of 3.46E-5/year. Per the qualitative screening criteria in

NUREG -1921, Section 4, Table 5-1, the

SRA used a 0.1 human error probability (

HEP) to estimate an operator recovery credit. As stated above, operator recovery credit may be allowed on a case-by-case basis. The SRA determined that

although EOP 3509.1 did not include recovery steps, operators would have had sufficient cues

(identified the lack of auxiliary feedwater flow and/or the

TDAFW pump tripped) per the control room abandonment procedure and had sufficient time to take action to restart the

TDAFW pump

prior to steam generator dryout. The

SRA calculated the recovery credit by adding the operator

HEP estimate to the conditional

TDAFW pump

FTS probability (0.1 + 0.12 = 0.22) because the cause of the mechanistic failure was not identified or corrected, and may still compromise

operator recovery actions. Multiplying the external event delta CDF by the assumed recovery credit (3.46-5/year x 0.22 = 7.6E-6/year) yields a White (low to moderate risk significance) contribution.

D-6 Attachment D The risk insight associated with the relatively high external events (fire) risk significance of the

TDA [[]]

FW pump is that the Millstone Unit 3 control room evacuation procedure relies upon a

single make-up source to the steam generators to provide secondary cooling, and thereby decay heat removal. Upon control room abandonment (due to fire), all subsequent mitigation actions and recovery efforts are procedurally driven per EOP 3509.1 and this procedure does

not include primary feed and bleed as an alternative core cooling method.

Overall Risk Significance The total change in

CDF associated with the reduction in

TDAFW pump reliability for the period between August 2013 and January 2014 is the sum of internal and external conditional core

damage frequencies (9.8E-8 + 7.6E-6 = 7.7E-6), which is of preliminary White, or low to

moderate overall safety significance. This finding should be characterized as preliminary White in the special inspection team inspection report Dominion

PRA Staff Risk Insights and Considerations (summarized, to date) Discussions with the Millstone

PRA staff identified a few risk insights and assumptions that may

significantly influence the external events conditional core damage frequency contributions. Specifically: As stated above, Dominion stated that the values in IPE Table 3.5-4 and Table 3.5-5 associated with fire frequencies, severity factors and associated fire zone contributions are overly conservative. Dominion recently (July 2014) completed a re-evaluation and

determined the fire frequency and associated severity factor for the Cable Spreading

Room (CB-8) is 4.52E-5/year. This value includes credit of the installed

IDS. Dominion stated that the conditions warranting control room abandonment would be carefully and judiciously considered (fire, smoke, hot gases or fumes,

CO2) by the control room operators and be exercised as a last resort before being limited by the single mitigation strategy outlined in EOP 3509.1. This would potentially provide control room operators a broader selection of mitigation systems and available strategies to

ensure adequate core cooling is maintained. Based upon the postulated control room

abandonment scenarios, Dominion believes the two motor-driven AFW pumps would

operate for some time, providing additional time/margin to steam generator dryout conditions. A recent thermal-hydraulic analysis of the available time to steam generator dryout following a reactor trip (with total loss of feedwater) with steam generator levels initially within the normal operating range identified approximately 1.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> before steam

generator dryout (time available for feedwater recovery actions). Dominion used the estimated 1.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> to steam generator dryout and the guidance in

NUREG -1921 to estimate an operator recovery credit for restoration of the

TDAFW pump. Dominion estimated the human error probability to be 3.5E-2. In conjunction with

the conditional

FTS probability, the

TDAFW pump recovery probability was estimated at 0.155. The Dominion

PRA staff stated that the risk significance of the performance deficiency associated with the

TDAFW pump is in the mid-White range.