IR 05000250/2020050

Special Inspection Report 05000250/2020050 and 05000251/2020050

ML20344A126
Person / Time
Site:	Turkey Point
Issue date:	12/09/2020
From:	Randy Musser NRC/RGN-II/DRP/RPB3
To:	Moul D Florida Power & Light Co
References
IR 2020050
Download: ML20344A126 (60)

Text

December 9, 2020

SUBJECT:

TURKEY POINT UNITS 3 AND 4 - SPECIAL INSPECTION REPORT 05000250/2020050 AND 05000251/2020050

Dear Mr. Moul:

On August 26, 2020, the U.S. Nuclear Regulatory Commission (NRC) completed its initial assessment of three reactor trips, which occurred on August 17, 2020, August 19, 2020 and August 20, 2020 at Turkey Point Unit 3. The NRCs initial evaluation satisfied the criteria in NRC Management Directive (MD) 8.3, NRC Incident Investigation Program, (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18073A200), for conducting a special inspection. The basis for initiating this special inspection is further discussed in the Special Inspection Charter, which is included as Attachment B, to the enclosed report.

On October 30, 2020, the NRC completed its special inspection and the NRC inspection team discussed the results of this inspection with Mr. Michael Pearce, Site Vice President, and other members of your staff. The results of this inspection are documented in the enclosed report.

Six findings of very low safety significance (Green) are documented in this report. Five of these findings involved violations of NRC requirements. We are treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2 of the Enforcement Policy.

If you contest the violations or the significance or severity of the violations documented in this inspection report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region II; the Director, Office of Enforcement; and the NRC Resident Inspector at Turkey Point.

If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region II; and the NRC Resident Inspector at Turkey Point. This letter, its enclosure and attachments, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Randall A. Musser, Chief Reactor Projects Branch 3 Division of Reactor Projects

Docket Nos. 05000250 and 05000251 License Nos. DPR-31 and DPR-41

Enclosure:

As stated with attachments

Inspection Report

Docket Numbers:

05000250 and 05000251

License Numbers:

DPR-31 and DPR-41

Report Numbers:

05000250/2020050 and 05000251/2020050

Licensee:

Florida Power & Light Company

Facility:

Turkey Point Unit 3 & 4

Location:

Homestead, FL 33035

Inspection Dates:

August 31, 2020 to October 30, 2020

Inspectors:

N. Lacy, Operations Engineer

D. Orr, Senior Resident Inspector - Turkey Point

R. Patterson, Senior Reactor Inspector

M. Riley, Reactor Inspector

A. Rosebrook, Senior Reactor Analyst

M. Schwieg, Reactor Inspector

R. Taylor, Senior Project Engineer

J. Zeiler, Senior Resident Inspector - Harris (Team Lead)

Approved By:

Randall A. Musser, Chief

Reactor Projects Branch 3

Division of Reactor Projects

TABLE OF CONTENTS

Summary (List of Violations)

Page 3

.1

Description of Events and Reactive Inspection Basis

Page 5

.3

Assessment of operator performance and crew decision making:

.3.1

Event #1

Page 6

.3.2

Event #2

Page 7

.3.3

Event #3

Page 12

.4

Adequacy of JIT training and licensed operator startup certification training

Page 13

.5

Evaluation of the extent of condition to the other operating crews

Page 13

.6

Assessment of the licensees response:

.6.1

Event #1

Page 15

.6.2

Event #2

Page 18

.6.3

Event #3

Page 19

.7

Evaluation of authorizations for each restart:

.7.1

Event #1

Page 20

.7.2

Event #2

Page 20

.7.3

Event #3

Page 21

.8

Assessment of schedule pressure and safety culture

Page 21

.9

Evaluation of operating experience

Page 22

.10 Evaluation equipment reliability and configuration control

Page 22

Inspection Results:

FIN 2020050-01, (Inadequate Design Analysis for CV-3-2011)

Page 24

NCV 2020050-02, (Failure to Manage Reactivity During Startup)

Page 26

NCV 2020050-03, (Failure to Monitor SRNI N-32)

Page 29

NCV 2020050-04, (Failure to Implement Corrective Actions for SRNI N-32)

Page 31

NCV 2020050-05, (Failure to Implement Procedures for Feedwater Control)

Page 34

NCV 2020050-06, (Failure to Establish Preventive Maintenance for SRNI)

Page 36

Exit Meetings

Page 39

Attachment A, Sequence of Events:

Event #1

Page A-1

Event #2

Page A-2

Event #3

Page A-5

Attachment B, SIT Charter

Page B-1

Attachment C, IMC 0609 Appendix M, Significance Determination Process

Page C-1

Attachment D, Documents Reviewed

Page D-1

Attachment E, Acronyms

Page E-1

SUMMARY

The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees performance by conducting a special inspection at Turkey Point Units 3 and 4, in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors. Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information.

List of Findings and Violations

Inadequate Design Analysis of Automatic Turbine Runback Actuation Coincident with Inadvertent Opening of CV-3-2011 Cornerstone Significance Cross-Cutting Aspect Report Section Initiating Events Green FIN 05000250/2020050-01 Open/Closed None (NPP)93812 A self-revealed Green Finding was identified for the licensees failure to implement adequate design change controls associated with the 2012 Unit 3 extended power uprate (EPU)modification that added an automatic medium turbine runback coincident with the opening of the low-pressure feedwater heater bypass valve CV-3-2011. Specifically, the licensee failed to implement procedure EN-AA-205-1100, Design Change Packages, and to evaluate the effect of the valve opening without a valid demand signal in the Failure Modes and Effects Analysis (FMEA) and to adequately review the calculational design inputs and assumptions required by design change procedures.

Failure to Adequately Manage Reactivity During Startup Cornerstone Significance Cross-Cutting Aspect Report Section Barrier Integrity /

Initiating Events Green NCV 05000250/2020050-02 Open/Closed

[H.4] - Teamwork 93812 The NRC identified a Green finding and associated non-cited violation (NCV) of Unit 3 Technical Specification (TS) 6.8.1, Procedures and Programs, for the failure to follow procedure 3-GOP-301, "Hot Standby to Power Operation, which provided instructions for reactor startup. Specifically, the operating crew failed to implement 3-GOP-301 which resulted in an excessive reactivity addition and caused an RPS trip which automatically shut down the reactor.

Failure to Adequately Monitor Source Range Nuclear Instrument (SRNI) N-32 Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000250/2020050-03 Open/Closed

[H.11] - Challenge the Unknown 93812 The

NRC Identified

a Green NCV of TS 3.3.1, Instrumentation, for not entering the Limiting Condition for Operation (LCO) and completing the action statement for one of the required SRNI Hi Flux Trip channels being inoperable in a mode where it was required.

Specifically, the licensee conducted a reactor startup, and entered Mode 2 with the SRNI N32 and its associated SR High Flux RPS trip channel inoperable.

Failure to Implement Adequate Corrective Action for Degraded Source Range Nuclear Instrument (SRNI) N32 Condition Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000250/2020050-04 Open/Closed

[P.2] - Evaluation 93812 The NRC identified a Green NCV of 10 CFR 50, Appendix B, Criterion XVI, Corrective Action, for failure to identify and correct a condition adverse to quality related to the SRNI N32 and its associated RPS SR high flux trip channel during the post trip review of the August 19, 2020, trip which resulted in a subsequent reactor startup on August 20, 2020, with an inoperable RPS trip channel.

Failure to Implement Procedures for Feedwater Recirculation Control in Automatic Cornerstone Significance Cross-Cutting Aspect Report Section Initiating Events Green NCV 05000250,05000251/2020050-05 Open/Closed None (NPP)93812 A self-revealed Green NCV of TS 6.8.1, Procedures and Programs, was identified for the licensees failure to establish, implement, and maintain adequate procedures for properly controlling the configuration of the Master Controller for the steam generator feedwater pump (SGFP) recirculation valves during Unit 3 plant startup.

Failure to Develop and Establish a Preventive Maintenance Schedule to Measure Source Range Nuclear Instrument (SRNI) Detector Performance Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000250,05000251/2020050-06 Open/Closed

[P.5] -

Operating Experience 93812 An NRC-identified Green NCV of TS 6.8.1, Procedures and Programs, was identified for the licensees failure to develop and establish a preventive maintenance schedule to perform source range nuclear instruments (SRNI) detector baseline and trending tests.

Additional Tracking Items

None.

INSPECTION SCOPES

Inspections were conducted using the appropriate portions of the inspection procedure (IP) in effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with their attached revision histories are located on the public website at http://www.nrc.gov/reading-rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared complete when the IP requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter (IMC) 2515, Light-Water Reactor Inspection Program - Operations Phase. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.

Starting on March 20, 2020, in response to the National Emergency declared by the President of the United States on the public health risks of the coronavirus (COVID-19), inspectors were directed to begin telework and to remotely access licensee information using available technology. During this time the inspectors performed site visits as local COVID-19 conditions permitted. In some cases, portions of the IP were completed remotely and on site. A significant portion of IP 93812 was performed on site during the week of August 31,

OTHER ACTIVITIES

- TEMPORARY INSTRUCTIONS, INFREQUENT AND ABNORMAL

93812 - Special Inspection Team

In accordance with the attached Special Inspection Team (SIT) Charter, the inspection team conducted inspection activities associated with a review of three separate reactor trip events that occurred at Turkey Point Unit 3 on August 17, August 19, and August 20, 2020.

.1 Description of Events and Reactive Inspection Basis

During the week of August 17, 2020, Turkey Point Unit 3 experienced three reactor trips, one of which was automatically initiated by the reactor protection system (RPS) and two were the result of plant operator actions to manually trip the reactor:

1) The first trip, manually initiated by plant operators, occurred on August 17, 2020, at 2111 from approximately 91 percent power in response to rising steam generator (SG) water levels that approached the automatic turbine trip setpoint.

2) The second trip was automatically initiated by the plants RPS and occurred on August 19, 2020, at 1324. Specifically, the source range nuclear instrument (SRNI),

N31, sensed a high neutron flux condition and initiated the trip during reactor startup.

3) The third trip, manually initiated by plant operators, occurred on August 20, 2020, at 2358 from approximately 34 percent power in response to the loss of the single operating 3B steam generator feedwater pump (SGFP).

NRC Management Directive (MD) 8.3, NRC Incident Investigation Program, and IMC 0309, Reactive Inspection Decision Basis for Reactors, was used to evaluate the level of NRC response for the three reactor trips that occurred at Turkey Point Unit 3 during the week of August 17, 2020. Based on the deterministic criteria detailed in MD 8.3 and risk insights related to the three events, NRC Region II management determined that the appropriate level of NRC response was to conduct a Special Inspection. A SIT was chartered to review the causes of the three events and Turkey Points organizational and operator responses to these events.

.2 Review the circumstances leading up to the events on August 17, August 19, and

August 20, 2020, and develop a Sequence of Events leading up to the incidents and details of the operator actions in response to events.

The Special Inspection (SI) conducted a detailed review of the three events; the August 17, 2020, manual reactor trip (hereafter, referred to as Event #1), the August 19, 2020, automatic reactor trip (hereafter, referred to as Event #2), and the August 20, 2020, manual reactor trip (hereafter, referred to as Event #3).

The team gathered information from operations logs, post-trip analyses, plant computer data systems, licensee cause analyses, sequence of events printouts, condition reports, and interviews to develop a timeline of the three events. See Attachment A for the Sequence of Events for Event #1, Event #2, and Event #3.

.3 For each event, assess crew operator performance and crew decision making,

including their adherence to procedures, expected roles and responsibilities, including reactivity management by the operators, reactivity management plans provided by nuclear engineering, the command and control function associated with reactivity manipulations, the use of procedures, log keeping, and overall communications.

.3.1 Inspection Activities Related Specifically to Event #1:

The team reviewed plant operating parameter data from the event, control room logs and procedures, the completed Post Trip Report (PTR), action requests (ARs) generated for the problems identified during the event, and interviewed members of the control room operations crew that were on-shift during Event #1, as well as selected operations personnel and engineering staff directly involved in evaluating the post-event issues.

On August 17, 2020, with the plant operating at 100 percent power, a Medium turbine runback to 85 percent turbine power was automatically initiated as a result of the spurious opening of the low-pressure feedwater heater bypass valve (CV-3-2011).

The operations crew diagnosed the condition due to expected control room annunciation alarms that alerted the operators that both valve CV-3-2011 had repositioned open and a turbine runback had initiated. In addition, the control room valve controller for CV-3-2011 position indication lights confirmed that the valve was in the open position.

The operators appropriately responded to the event using off-normal operating procedure 3-ONOP-089, Turbine Runback. While implementing the actions in this procedure, the operations crew observed that the turbine did not runback to and remain at the expected 85 percent setpoint. Instead, after approximately 30 seconds, turbine power reduced to approximately 87 percent turbine power and then stopped, indicating the runback was completed. Shortly thereafter, the runback again initiated down to approximately 85 percent turbine power. Over the next approximately 60 seconds, the turbine control system (TCS) runback circuitry armed and disarmed multiple times, cycling around 82 percent to 85 percent turbine power setpoint. The team noted that the repeated cycling created operator distractions and eventually led to the Unit Supervisor (US) directing the operators to take manual control of the TCS to mitigate the cycling.

During this period of managing the unexpected turbine runback operation, the operators were distracted from monitoring the increasing SG levels, resulting in the Shift Manager (SM) identifying and alerting the operators of rising SG levels (approximately 60-65 percent level at the time), especially in the 3B and 3C SGs.

Subsequently, operators took manual level control of the 3C SG feedwater regulating valve, to arrest the rising level. Operator manual actions were unsuccessful in lowering level and once the 3C SG level reached approximately 78 percent, the SM directed a manual reactor trip due to the potential to challenge the automatic reactor trip that occurs at the 80 percent level. The time from initiation of the transient with the spurious opening of CV-3-2011 until insertion of the manual reactor trip was approximately 2.5 minutes. The team determined that based on the increasing SG level conditions, the operator actions to manually trip the reactor were appropriate.

Following the manual reactor trip, the operators entered emergency operating procedure 3-EOP-E-0, Reactor Trip or Safety Injection. While performing the immediate operator actions associated with procedure 3-EOP-E-0, the operators identified that the position indication light for the 3B moisture separator reheater (MSR) main steam stop valve (MOV-3-1432), was not illuminated and the valve could not be verified closed. This valve gets an automatic closure signal as part of a turbine trip actuation. After attempts to manually close the valve from the control room switch did not result in a positive indication that the valve was closed, the operators implemented the required procedural actions to close the upstream main steam isolation valves (MSIVs) to isolate all sources of steam from the SGs in order to prevent a potential uncontrolled reactor coolant system (RCS) cooldown. No further complications were encountered while completing the remaining actions in 3-EOP-E-0 and the operators entered procedure 3-EOP-ES-0.1, Reactor Trip Response, in order to stabilize and control the plant following a reactor trip without a safety injection present. The plant was stabilized in Mode 3 at normal operating temperature and pressure without any further noteworthy plant complications.

The team determined that the operators took appropriate actions as required by the procedure when faced with the uncertainty of the position for valve MOV-3-1432 and closed the MSIVs as required.

Following the event, the licensee initiated ARs and related work orders (WOs) to address the issues identified during the event. These ARs included the following:

• AR 2365707, Indicating lights on valve MOV-3-1432 lost during reactor trip

• AR 2365708, Valve CV-3-2011 failed open

• AR 2365714, 3B and 3C feedwater regulating valves were slow to respond during turbine runback

• AR 2365716, Unit 3 reactor manually tripped

• AR 2365717, Unexpected TCS response during turbine runback

• AR 2365722, Reheat intercept valve 3-10-012 indicates bad indication on TCS panel

• AR 2365723, Reheat stop valve 3-10-015 indicates bad indication on TCS panel

The team determined that appropriate actions were initiated to document problems and issues identified during the event.

.3.2 Inspection Activities Related Specifically to Event #2:

The Turkey Point Unit 3 main control room operating crew members who were present during the startup and subsequent automatic reactor trip on high source range (SR)counts were interviewed with two NRC team members present. Additionally, the reactor engineer present during the startup was also interviewed.

While each interviewee had a different perspective during the event, their answers were provided with openness and an obvious effort to meet the goals of the interviewers.

They described the event in a consistent manner with enough detail which allowed the NRC to gain insight into the details of Event #2.

On August 19, 2020, operators were conducting a reactor startup of Turkey Point Unit 3 after experiencing a manual reactor trip on August 17, 2020. The operators were performing procedure 3-GOP-301, "Hot Standby to Power Operation, and conducting a normal plant startup using control rods. The operating crew consisted of a three-person reactivity team, including the reactor Operator at the Controls (OATC), a peer checker, and one reactivity Senior Reactor Operator (SRO). The responsibility of the reactivity team was managing reactivity during the startup. The crew also had a Unit 3 Reactor Operator (RO), with overall responsibility of Unit 3 operations, and a third RO, who was providing administrative support (i.e., log keeping, plant announcements, etc.). A US was responsible for the overall Unit 3 activities and a SM was overseeing all crew activities. Also present during the startup was a Reactor Engineer who was supporting the startup by plotting the SRNI inverse count rate (1/M) plot, and a training department observer. Additionally, two Assistant Operations Managers and the Site Vice President (SVP) were present in the main control room observing the startup.

After declaring the reactor critical at 1316 hours0.0152 days <br />0.366 hours <br />0.00218 weeks <br />5.00738e-4 months <br />, the OATC was given the order from the reactivity SRO to perform Step 5.21 of procedure 3-GOP-301 to raise power to 10-8 amps and do not exceed a 1.0 decade per minute (dpm) startup rate (SUR).

However, the OATC did not announce his intentions to the rest of the reactivity team or crew as to how he intended to carry out the step. The OATC intended to perform a continuous rod withdrawal of control rod group D until a 0.7 dpm SUR was achieved and stop. His rationale for 0.7 dpm was that with a steady state 0.7 dpm SUR power would not double in less than a minute. Had the OATC announced his intentions both the SM and US stated they would have recommended not taking that action and withdrawing rods in steps and establishing a lower SUR of 0.5 dpm. The OATC withdrew control bank D for 45 seconds, which was 53 steps, until rod motion was stopped when a valid SR Hi Flux RPS trip signal was generated and the reactor automatically tripped.

The SUR was greater than 1.0 dpm for the final 25 seconds of the 45 second rod pull and reached a maximum indicated value of 3.0 dpm, with an instantaneous SUR of 7.4 dpm at the time of the trip.

No member of the operating crew, nor any of the observers, recognized that the OATC had exceeded the SUR limits of the procedure, or that the plant was approaching an RPS trip threshold, and that the OATC was withdrawing rods continuously.

Approximately 20 seconds before the trip, the SR Block Permissive (P-6) came in as expected and the third RO had been directed to take the procedural actions to deenergize SR High Volts. The third RO announced the expected alarm and had only just opened the procedure before the trip.

While the operators had attended Just-in-Time (JIT) training there were missed opportunities and shortfalls in their performance as related to Conduct of Operations which culminated in the failure to follow procedure and exceeding the allowed SUR of 1.0 dpm which ultimately led to the automatic reactor trip. The team determined that the following were contributing factors to the human performance errors identified:

• Experience Level of the Crew: Two of the three members of the reactivity team and the US had never conducted a reactor startup using control rods to pull to criticality on the plant. It was known that this was the first startup for the reactivity SRO since he had recently qualified, but it was not recognized that the OATC, a qualified RO for 8 years, nor the US had also never performed this evolution in the plant. The SM thought he had paired an experienced RO with an inexperienced SRO.

• JIT Training: Required JIT training was conducted for the start-up crew the afternoon prior to the startup. All members of the crew attended, with exception of the Unit 3 RO and the Reactor Engineer. A table-top walkthrough of the startup procedure was performed emphasizing 3-way communications. However, simulator training was only performed for the turbine synchronization to the grid and not the startup and power ascension. The training crew was also unaware that the OATC had never performed this evolution in the plant.

• Operator Fundamentals breakdowns: The OATC never informed the reactivity team of his startup intentions or which key plant parameters to monitor and at what point to stop withdrawing control rods. Thus, the operating crew did not have an opportunity to coach the OATC or to provide backup when the SUR exceeded the intended 0.7 dpm. Also, operators did not follow fundamental principles to ensure they understood the expected plant response for an action, (i.e., take the action, observe plant response, and stop if expected plant response was not achieved). The OATC did not know how much rod motion was needed to establish a steady 0.7 dpm SUR and did not recognize that not seeing a 0.7 dpm for such an extended rod withdrawal was an abnormal system response.

Note: The indicated SUR was well above 1.0, based on review of plant computer historical data after the event, however, none of the crew noticed this at the time.

• Oversight and Control of the Startup Evolution: The reactivity team provided no meaningful assistance to the OATC during the power ascension, nor did the US or SM. Key reactor plant indications were displayed on the ROs vertical panel.

Additionally, the SROs had monitoring capability digitally displayed in other areas of the control room. The reactivity SRO and the US were in direct line of site of nuclear instrumentation and the OATCs hand on the rod control switch, yet did not notice the excessive startup rate or appropriately stop the withdrawal of control rods. Audio of SR counts and rod motion was energized and loud enough to be heard, and plant computer data was available in multiple locations. Additionally, the action to deenergize SR high volts after the P-6 Permissive light came in was delegated to the third RO. If this action had been assigned to the OATC as normally performed, the OATC would have had to stop withdrawing rods when P-6 was announced while SUR was approximately 1.0. Instead the OATC continued withdrawing control rods during this time limited evolution.

• Confusing Indications: Prior to criticality during the startup, it was noted that SRNI channels N31 and N32 were deviating by approximately 1.0 decade. As the startup progressed this deviation continued to increase. During the continuous rod withdrawal, plant computer data also showed that SRNI N32 SUR was also lagging the other three SUR indications (i.e., intermediate range nuclear instruments (IRNI)channels N35 and N36 and SRNI N31). At the time of the trip, SUR was 3.0 dpm on three channels and 1.5 dpm on SRNI N32. It was possible that some operators may have been confused by this or focused on this incorrect indication.

• Distractions: The P-6 permissive coming in shifted the focus of many operations crew away from key parameters. This alarm and the actions to secure SR high volts was occurring adjacent to the ROs panel, and was happening up until the trip, which may have shifted the focus of the OATC.

The team determined that numerous plant procedures were not adhered to during this event, including the following:

1. Procedure 3-GOP-301, Hot Standby to Power Operation, revision (Rev.) 53,

Step 5.21, required operators to establish a steady state SUR of 1.0 dpm or less while raising power to and stabilizing at 10-8 amps on IRNI. In addition, Precautions and Limitations, Step 4.14, stated the SUR should not be permitted to exceed a steady state value of 1.0 dpm below the Point of Adding Heat (POAH). Contrary to the procedure, operators failed to follow Step 5.21 and continuously withdrew control bank D from 83 steps to 136 steps over a 45 second period, resulting in a SUR in excess of 1.0 dpm for approximately the last 25 seconds of the rod pull on both IRNI and SRNI reaching a maximum displayed value of 3.0 dpm. This action added excessive reactivity which resulted in an automatic reactor trip on SR high flux of 105 counts per second (cps).

2. Procedure 3-GOP-301, caution statement prior to Step 5.16.3 stated, Excessive

boration/dilution rates and rod motion shall be avoided. Additionally, procedure OP-AA-103-1000, Reactivity Management, Rev. 13, Section 3.7, caution statement stated, Inadequate reactivity control has the potential to cause core damage.

As a result, licensed operators are responsible for conservative, deliberate reactivity control, in accordance with approved procedures, to prevent challenging the integrity of the fuel cladding or the RCS pressure boundary. Contrary to the procedure, the operating crew failed to adequately control reactivity additions and the OATC performed an excessive continuous rod withdrawal of 53 steps for 45 seconds, which resulted in a SUR greater than 3 dpm and a SR high flux RPS trip. This was a reactivity addition of 270 percent mille (pcm) which was 130 pcm in excess of what was necessary to achieve a 1.0 dpm SUR.

3. Procedure OP-AA-100-1000, Conduct of Operations, Rev. 25, Attachment 5,

Section 3.2, stated the OATC was responsible for monitoring for the effects of primary reactivity manipulations on the unit (control rods, boration, dilution and TCS adjustments). Contrary to the procedure, the OATC did not adequately monitor key reactor parameters for the effects of continuously withdrawing the control rods while raising power to 10-8 amps. Specifically, the OATC did not recognize plant response (SRNIs, IRNIs, and associated SURs) was not as expected and outside procedural limits and did not appropriately stop withdrawing control rods. The OATC was attempting to withdraw control rods when the RPS actuation occurred.

4. Procedure OP-AA-100-1000, Conduct of Operations, Rev. 25, Attachment 4,

Section 3.3, stated that the Command and Control SRO, or US, was expected to stay in a position of oversight for all control room activities, remain fully involved, and assert authority when standards were not being maintained. Contrary to the procedure, the US did not assert authority to ensure the OATC withdrawing the control rods maintained a SUR less than 1.0 dpm. Specifically, no communications were conducted to understand how the OATC intended to withdraw control rods and the US did not ensure how the reactivity team, (Reactivity SRO, OATC and RO peer checker), intended to adequately monitor key parameters during the power increase to 10-8 amps.

5. Procedure OP-AA-100-1000, Conduct of Operations, Rev. 25, Attachment 4,

Section 3.1, stated that licensed operators were responsible for complying with the conditions of their license and intervening in system or component operation as necessary. Contrary to the procedure, the Reactivity SRO, OATC peer checker, US, Unit 3 RO, Administrative third RO, and SM each had an opportunity to recognize and respond to the conditions listed below:

1) The OATC was continuously withdrawing control rods for 45 seconds; and 2) Key plant parameters, which were clearly displayed in the control room, were greater than procedural limits and rapidly approaching the RPS trip limit.

6. Procedure OP-AA-103-1000, Reactivity Management, Rev. 13, stated that no

significant discrepancies exist between reactor power level indicators and/or indirect power indications such as turbine first stage pressure. If significant discrepancies exist, power ascension shall cease until the situation was investigated. Approval of the Operations Director/Manager was required to resume power ascension.

Contrary to the procedure, the reactor startup was continued with a deviation between SRNI channels N31 and N32 with increasing magnitude as the startup progressed. The OATC and his peer checker identified the deviation as a concern to the Reactivity SRO who then discussed the concern with the US and SM. The SROs determined the current deviation to be acceptable and directed the OATC and his peer checker to continue the startup and monitor N32.

The team also reviewed the crews decision making process for continuing the startup with a degraded SRNI N32 on August 19, 2020, the post trip review of the August 19, 2020 trip, and decision-making process associated with the licensees decision to startup on August 20, 2020, with SRNI N32 in a known degraded state.

In each of these cases, licensee staff and management did not adequately evaluate the operability of the SRNI and additionally, its associated RPS SR High Flux Trip Function.

In each case, the operability of the instrument was performed qualitatively, and available quantitative information was not considered. The reviews appeared to focus on the instrumentation and display function as opposed to the operability of the RPS trip function. This RPS trip function was challenged during the August 19, 2020, event and the SRNI N32 channel was demonstrated to not to have been able to perform its safety function. The post trip review and Onsite Review Groups (ORG) restart readiness process failed to identify this and authorized the August 20, 2020, startup to proceed.

See NCV 05000250/2020050-02, Failure to Adequately Manage Reactivity During Startup, NCV 05000250/2020050-03, Failure to Adequately Monitor SRNI N-32, and NCV 05000250/2020050-04, Failure to Implement Adequate Corrective Action for Degraded SRNI N32 Condition, in the inspection results for additional details.

.3.3 Inspection Activities Related Specifically to Event #3:

The team reviewed data for plant operating parameters, reviewed station logs and procedures, interviewed the operating crew on duty at the time of the event and engineering personnel.

3.3.1 Manual Reactor Trip

The team determined that the operating crew took appropriate actions to perform a manual reactor trip and manual closure of MSIVs in response to conditions that resulted from the incorrect SGFP recirculation valves alignment. The reactor trip was required after the trip of the only running SGFP. The MSIV closure was required by procedure EOP-ES-0.1, Reactor Trip Response, to limit the cooldown due to excessive steam flow. Both actions were the result of procedural response requirements.

3.3.2 Control Room Alarm Response

Leading up to Event #3 the Unit 3 operating crew received two alarms in the main control room on August 20, 2020. The first alarm was the Distributed Control System (DCS) trouble alarm. The operating crew followed the alarm response procedure (ARP),3-ARP-097-CR.D, Control Room Response - Panel D, and navigated to procedure Step A to the DCS secondary trouble page. This page identified alarm conditions for the 3A/3B/3C/3D MSR, 3A reheater drain tank (RHDT), and 3A/3B heater drain tank (HDT)controllers given they were in manual instead of automatic. The operators took appropriate actions to restore level control valves for 3A/3B/3C/3D MSR, 3A RHDT, and 3A/3B HDT to automatic control on DCS to support closing the main generator output breakers and synchronizing to the grid. However, the operating crew failed to navigate to Step B of the procedure as they believed Step A had corrected the alarm conditions.

The DCS secondary trouble display panel did not list the recirculation valves master controller, instead, this page listed the individual recirculation valve controllers. Because the individual valve controllers were in Automatic, they were not alarming. The team determined that had the recirculation valves master controller been included on the DCS secondary trouble page in Step A, operators may have recognized that the recirculation valves master controller was not in automatic. The team determined the failure to navigate to Step B, was a missed opportunity, however this was not the primary cause of the failure to configure the recirculation valves master controller in automatic during the plant startup. The second alarm was the SG C Level Deviation / Controller Trouble alarm. The team determined the operating crew took proper actions and followed the ARP to open Feedwater Bypass Valve, (FCV-3-499), and take manual control of the feedwater controller to maintain SG level.

3.3.3 Master Recirculation Controller in Manual Recovery

When the operating crew discovered the SGFP recirculation valves controller was in manual at 34 percent reactor power, the operating crew closed the recirculation valves with the master controller. This action closed all three recirculation valves at the same time. When the valves were closed from 100 percent demand to 60 percent demand, the feedwater pump tripped on low suction pressure. The operating crew should have more appropriately closed the recirculation valves in a controlled manner using each of the valve controllers. A controlled closing of the three recirculation valves may have potentially maintained SGFP suction pressure and prevented a trip on low suction pressure. However, the team noted the time pressure created by the lowering SG water level. When the operating crew discovered the master controller was in manual, the C SG water level was already at 40 percent and lowering. This time pressure may have impacted the operating crew recovery actions by choosing not to close the SGFP recirculation valves in a more controlled manner.

.4 Review the adequacy of JIT training and licensed operator startup certification training

as it relates to reactivity control.

.4.1 Inspection Activities Related Specifically to Event #1:

There was no JIT training with Event #1 as it occurred from full power operations.

.4.2 Inspection Activities Related Specifically to Event #2:

The team interviewed members of the training staff that conducted the JIT training for the crew that conducted the startup associated with Event #2, and reviewed training procedures related to the conduct of the JIT training. The team also observed a startup on the simulator utilizing the training staff and discussed how training was conducted related to a reactor startup and reactivity control.

While the reactor restart JIT training met training requirements there was a missed opportunity to reinforce conservative operation of the control rods after the reactor was critical. This observation was based on the use of a tabletop discussion for the reactor startup portion of the JIT training. The remaining JIT training to roll the turbine and synchronize the generator to the grid was conducted in the simulator versus the use of tabletop discussions.

.4.3 Inspection Activities Related Specifically to Event #3:

The team interviewed the training staff that conducted the JIT training for the crew that conducted the startup associated with Event #3. The team determined that adequate JIT training was provided to these operators. The crew members attended JIT training on the July 20, 2020 for startup and power ascension. While the JIT power ascension training did not cover any issues with the feedwater regulating valve response or the closure of valve CV-3-2011 that occurred with Event #1, these issues were not the direct cause of Event #3. This manual trip was initiated by the loss of the only running SGFP when the operators attempted a fast closure of the SGFP recirculation valves.

.5 Evaluate the extent of condition for identified issues with respect to the other

operating crews.

.5.1 Inspection Activities Related Specifically to Event #1:

The team assessed the extent of condition for the identified issues associated with Event #1 and interviewed other crews and operations personnel knowledgeable with the circumstances associated with the event. None of the operators interviewed either from Event #1 or from other crews recalled the unusual turbine TCS arming/disarming or slower than expected SG level control system responses during simulator training for scenarios involving the spurious opening of CV-3-2011 coincident with a turbine Medium Runback. The team requested and reviewed simulator data involving the simulator response to this specific transient, which confirmed that there were significant transient response differences between the simulator and the actual plant. The simulator response did not exhibit either the TCS runback anomaly or the unexpected rise in SG levels. Particularly noteworthy was the difference in feedwater flows. Unlike the simulator, feedwater flows remained high throughout the actual plant transient indicating a slow response of the feedwater regulating valves resulting in the higher SG levels.

The team determined that these differences contributed to the operators not anticipating the abnormal plant responses and a weakness in monitoring rising SG levels.

Additionally, the equipment challenges faced by the operators during this event would have been common to all the operators based on the nature of the issues. While other crews may have taken action earlier to place the SG feedwater regulating valves in manual in an attempt to control SG water level had they recognized the abnormally rising levels earlier, it was clear that simulator training had not adequately prepared the operators with the understanding and expectations that added focus and attention to unexpected SG levels would be necessary for such a transient. As interim corrective actions, operations management issued a Night Order for all the operators explaining the circumstances associated with the event and the learnings related to the issues identified with the TCS runback logic and SG level controls. The team noted that the licensee is performing a root cause of the event which included understanding the anomaly associated with TCS arming and disarming multiple times.

.5.2 Inspection Activities Related Specifically to Event #2:

The team interviewed a sample of operators from other crews, managers, and training department personnel, to assess the extent of condition for the performance issues that contributed to the automatic trip on August 19, 2020. Interviews focused on command and control of reactor startups, and how the operators performed and controlled 3-GOP-301, "Hot Standby to Power Operation, procedure step 5.21 that stated, establish a steady state startup rate of 1.0 dpm or less to 10-8 amps and stabilize reactor power at 10-8 amps on the Intermediate Range (IR) Monitors.

The team determined that one of the major contributors to this event was the experience level of the crew. Two of the three members of the reactivity team and the US had never conducted a reactor startup using control rods rather than boron dilution to establish a steady state SUR less than 1.0 dpm using control rods and then leveling at 10-8 amps in the IR.

It was known that this was the first startup for the reactivity SRO since he had recently qualified, but it was not recognized that the OATC, a qualified RO for 8 years, nor the US never performed this evolution on the plant. The SM assumed the crew makeup consisted of an experienced RO with an inexperienced SRO. This also contributed to the level of oversight given to the OATC, since the other team members erroneously assumed the OATC was the most experienced and did not closely question or monitor the OATC actions. During the JIT training, the trainer asked if anyone on the crew had not performed the evolution before, but only the reactivity SRO was identified as a first-time performer.

The team determined the issue was specific to this crew. Given interviews with the training department and other operators there was no evidence of any training lapses.

Interviews revealed that operators most likely would not have performed this evolution in the manner the OATC did on August 19, 2020, and furthermore, it was not trained to be done in this manner. The expectations of the crew backing each other up and independently monitoring plant parameters were also clear to all personnel interviewed.

The team also interviewed several other reactor engineers and management with regards to the reactivity management procedure implementation and the roles and responsibilities of the reactor engineer during reactor startup and their insights about the SRNI N32 engineering evaluation and historical performance. The team determined that the reactor engineer was following current station procedures and guidance by only plotting one channel of SRNI on the 1/M plot.

.5.3 Inspection Activities Related Specifically to Event #3:

The team interviewed a sample of operating crews, managers, and training department personnel, to assess the extent of condition for the performance issues that contributed to the manual scram on August 20, 2020. Procedure 3-GOP-301, "Hot Standby to Power Operation, was determined to be inadequate due to the lack of positive configuration control of feedwater control systems. Specifically, the procedure did not verify the proper configuration of the SGFP recirculation system to support power ascension. The licensee took corrective actions to update procedure 3-GOP-301 to add specific actions for verifying the recirculation valves were closed and the master controller was in automatic during power ascension.

Likewise, ARP, 3/4-ARP-097-CR.D, Control Room Response - Panel D, did not have an operator action to ensure Secondary Controls Auto/Manual controllers were in the required position to support current plant status. The ARP was inadequate. The licensee took interim actions to provide information via a Night Order that described the actual operation of the DCS secondary trouble screen including inputs, and what caused the alarms to come in, and how to respond using procedure 3/4-ARP-097-CR.D.

.6 Review and assess the effectiveness of the licensees response to these events and

corrective actions taken to date.

.6.1 Inspection Activities Related Specifically to Event #1:

The licensee prepared a PTR for Event #1, and entered the issues identified into the corrective action program (CAP), initiated a root cause evaluation, and planned to issue a licensee event report (LER) for the event. At the time of this inspection, only the PTR was completed and available for review.

.6.1.1 Spurious Opening of CV-3-2011, Low Pressure Feedwater Bypass Control Valve

Following the August 17, 2020, Unit 3 manual trip event, the licensee initiated AR 2365708 to address the spurious opening of CV-3-2011. In addition, WO 40737414 was initiated to perform immediate troubleshooting to determine the cause for why CV-3-2011 opened and to implement repairs. The team reviewed the results of the troubleshooting activities which identified that one of the two pressure switches (i.e., PS-3-2011) that automatically opened CV-3-2011 was faulty and required replacement. Maintenance personnel identified evidence of water intrusion into the pressure switch housing. The licensee suspected that the heavy rain event on the day of the trip allowed water to enter the pressure switch housing due to a degraded gasket.

This water intrusion provided a false signal to the air actuator solenoid of CV-3-2011 which opened the valve without a valid demand signal. Given that Unit 4 turbine building, was also open to the environment, and had two similar pressure switches that control the opening of a similar valve CV-4-2011, the licensees immediate extent of condition, inspected Unit 4 for potential water intrusion impact. No similar water intrusion problems were identified. In addition, the licensee planned further extent of condition actions to inspect other vulnerable Unit 3 and Unit 4 turbine building equipment for potential water intrusion. The team determined that appropriate licensee actions were taken or were planned to identify the cause of the spurious opening of CV-3-2011 and to address extent of condition.

.6.1.2 Loss of Position Indication of MOV-3-1432, 3B MSR Main Steam Stop Valve

The team reviewed the licensees actions to address the loss of position indication on MOV-3-1432, the 3B MSR Main Steam Stop Valve, that required the operators to close the MSIVs following the manual reactor trip to isolate all sources of steam from the SGs in order to prevent a potential excessive RCS cooldown rate. The licensee initiated AR 2365717 to address the issue and conducted troubleshooting and repair under WO 40737415. The team reviewed the completed WO which identified a tripped valve motor thermal overload relay on the C phase that de-energized the valve motor operator upon receipt of the automatic close signal and prevented the valve from closing.

A broken wire at a terminal lug connection in the valve control circuit was found and repaired. This broken wire and tripped relay also explained why the valve position indication was lost during the event. The circumstances on how the wire connection could have broken and when it occurred could not be readily identified. Pictures of the terminals and broken connection did not indicate any obvious damage attributed to poor termination or existing wiring stresses. The licensee planned to conduct further evaluation of the issue under AR 2365717. The team determined the licensees immediate and planned corrective actions to address the issue were appropriate.

.6.1.3 Abnormal Turbine Control System Runback Oscillations

As discussed in Sections

.3.1 and.5.1 of this report, the TCS runback system did not

operate as expected during Event #1. The operations crew observed that the turbine did not runback to and remain at the expected 85 percent setpoint. Instead, after approximately 30 seconds, the runback completed but turbine power only reduced to approximately 87 percent turbine power. Subsequently, the runback logic armed and disarmed multiple times until the manual reactor trip was initiated, cycling around the 82 to 85 percent turbine power setpoints. The licensees initial review of the TCS runback response documented in the PTR, determined that the TCS Medium Runback circuitry allowed the arming/disarming phenomenon to occur based on the manner that the installed software was setup which used turbine inlet pressure as the basis for the setting that was used by the runback arming/disarming circuitry. During the event, turbine inlet pressure oscillated around the software arming setpoint (i.e., 584.3 psig),which resulted in the Medium Runback logic arming and disarming multiple times. At the time of the inspection, the licensee was still evaluating whether the TCS runback and related software had operated per design as part of the actions to address AR 2365717.

In addition, the licensees root cause of Event #1 was not complete but was also expected to evaluate in detail the exact cause of the TCS runback arming and disarming anomaly. As interim corrective actions, operations management issued a Night Order to the operators explaining the circumstances associated with the event including the anomalies identified with the TCS runback arming and disarming anomaly.

.6.1.4 Abnormal Steam Generator Level Control Issues during Transient

During Event #1, it was observed that the SG level control system did not respond as expected in automatic to maintain the SG levels below the automatic trip setpoint of 80 percent narrow range level which required the operators to manually trip the reactor prior to reaching the trip setpoint. As discussed in Section

.5.1 of this report, higher than

expected feedwater flows were observed during periods when the feedwater regulating valves were being demanded to close which resulted in unexpected rising SG levels.

The team reviewed ARs 2365714 and 2365716 that were initiated to address the issue, as well as preliminary engineering evaluations and documents related to the Extended Power Uprate (EPU) modification that was implemented in 2012 which modified the SG level control system, feedwater regulating valve controller setup, and the TCS.

Operational transient functions associated with CV-3-2011 were added as part of the EPU modification for the new digital TCS runback logic system. This included automatic opening of CV-3-2011 during several automatic turbine runback conditions. These conditions included: 1) Medium Runback to 85 percent on a trip of one of the three condensate pumps above 88 percent turbine power, 2) Fast Runback to 50 percent on a trip of one of the two feedwater pumps above 60 percent turbine power, and 3) Medium Runback to 85 percent on manual activated runback above 60 percent turbine power.

In addition, as it relates to Event #1, the EPU modification added the Medium Runback to 85 percent whenever CV-3-2011 indicated open via two valve position limit switches with the turbine above 88 percent power.

The team determined that a design analysis error in the 2012 EPU modification for the digital TCS runback logic system and feedwater regulating valve controller setup was the primary cause of the inability of the SG level control system to control rising SG levels during the event. When the 2012 EPU analyses were performed, valve CV-3-2011 opening without a valid demand, was not included in the Failure Modes and Effects Analysis (FMEA) performed by the licensee or its engineering contractor, nor was the runback transient analyzed correctly in calculation CN-CPS-09-67, Steam Generator Water Level Analysis for the Turkey Point Units 3 and 4 Extended Power Uprate, due to a lack of acknowledgement in the design phase that a pressure switch failure could cause CV-3-2011 to inadvertently open. In accordance with licensee design procedures, EN-AA-205-1100, Design Changes Packages, a FMEA was required for such a condition. The lack of analysis of the specific transient that occurs when CV-3-2011 opens without a valid demand signal contributed to not considering the impact of the transient analysis in the setup and tuning of the feedwater regulating valves. The inadequate setup and tuning of the feedwater regulating valves, via calculation CN-PCSA-12-10, Steam Generator Water Level Analysis to Support Feedwater Control System Tuning at EPU Conditions for Turkey Point Unit 3, was most likely the reason for the unexpected rising SG water levels during Event #1.

In addition, an opportunity to have identified the design analysis discrepancy was missed during the licensees engineering review of a supporting EPU calculation, PTN-BSHM-08-011, Feedwater & Condensate Equipment Selection, Performance Evaluation, and Operation Transients Review. Specifically, a review comment was documented in this calculation which identified that the runback due to CV-3-2011 spuriously opening was not one of the analyzed transients and questioned whether the transient needed to be analyzed. Subsequent actions were not taken to adequately address the comment.

As a result, the inadvertent opening of CV-3-2011 along with a turbine Medium Runback was not analyzed because the licensee, and engineering contractor, mistakenly determined that the total loss of heater drain flow transient evaluation would include the effects of this specific runback. However, calculation CN-CPS-09-67, section 4.4.4, Assumptions for Complete Loss of Heater Drain Flow Transient, explicitly assumed only conditions as a result of a valid opening signal due to an actual loss of heater drain flow were included. Licensee design procedure ENG-QI-1.5, Calculations, required an engineer who was knowledgeable of the subject matter shall review calculations to ensure that assumptions and judgements have sufficient rationale, and inputs were from an appropriate source, were correct, and incorporated into analysis, and were consistent with the plant design and operation. The team determined that the licensee failed to follow ENG-QI-1.5, which contributed to not recognizing the need to analyze the transient in more detail.

The team determined that the licensees failure to follow design procedures EN-AA-205-1100 and ENG-QI-1.5 during implementation of the 2012 EPU modifications, were the primary cause of Event #1. See FIN 05000250/2020050-01, Inadequate Design Analysis of Automatic Turbine Runback Actuation Coincident with Inadvertent Opening of CV-3-2011, in the inspection results for additional details.

.6.1.5 Interim Corrective Actions to Disable Unit 3 Medium Turbine Runback for Spurious

CV-3-2011 Opening

The team reviewed the licensees actions to address the failure to conduct an adequate design analysis for the spurious opening of CV-3-2011 coincident with an automatic turbine Medium Runback to 85 percent when operating greater than 88 percent turbine power. The licensee developed a temporary design change package to block the TCS runback logic circuitry associated with CV-3-2011 going open, preventing a TCS Medium Runback initiation until a permanent modification could be developed and installed.

This modification (EC 295196) was implemented on August 25, 2020, prior to Unit 3 going above 88 percent turbine power following the initial manual reactor trip that occurred on August 17, 2020. Along with this modification, plant procedures were modified which directed the operators to take prompt actions to reduce turbine load manually by approximately 50 megawatts (MW) in order to maintain reactor power less than 100 percent during an inadvertent opening of CV-3-2011. To prevent a similar occurrence on Turkey Point Unit 4, the licensee planned to implement a similar modification during the upcoming Fall 2020 refueling outage. The team determined that adequate interim licensee corrective actions were implemented or planned to address the issue until further corrective actions were implemented following the completion of the ongoing root cause evaluation associated with the event.

.6.2 Inspection Activities Related Specifically to Event #2:

The licensee prepared a PTR for Event #2, and entered the issues into the CAP. The licensee initiated a root cause evaluation for the operator performance issues and planned to issue an LER for this event. Immediate corrective actions included removal of operators from their licensed duties pending remediation, JIT training, crew briefings, and increased oversight of startup operations. Additional corrective actions were to be developed upon completion of the root cause evaluation. Additionally, ARs 2366002 and 2366093 were written to evaluate the concerns raised about the SRNI performance.

Immediate corrective actions included troubleshooting and an engineering evaluation of the condition. The team determined that licensees immediate corrective actions were ineffective, and the engineering evaluation did not determine that the issues that rendered SRNI N32 inoperable were related to the degraded boron trifluoride (BF3)proportional detector. See NCV 05000250/2020050-04, Failure to Implement Adequate Corrective Action for Degraded Source Range Nuclear Instrument N32 Condition, in the inspection results for additional details. Following the August 20, 2020 trip, the licensee contacted the vendor for assistance with the SRNI. Subsequently, SRNI N32, was repaired, retested, and returned to an operable status on August 24, 2020.

.6.3 Inspection Activities Related Specifically to Event #3:

The licensee prepared a PTR for Event #3, entered the issues identified into the CAP, initiated a root cause evaluation, and planned to issue a LER for the event. At the time of this inspection, only the event PTR was completed and available for review.

.6.3.1 Feedwater Recirculation Valves Controller Configuration Control Problem

Event #3 was caused by the SGFP master recirculation controller being in manual mode instead of automatic during power ascension. This incorrect configuration resulted in the recirculation valves being left fully open with reactor power at 34 percent. Under normal operation these valves would have fully closed above 20 percent power had the controller been in automatic. When the operating crew took manual control and attempted to close the recirculation valves, it resulted in a rapid increase in feedwater flow and lowered the suction pressure to the operating 3B SGFP, and subsequently caused a SGFP trip on low suction pressure. Due to the loss of the only running SGFP, the operators inserted a manual reactor trip.

The team identified the SGFP master controller and associated recirculation valves were not in the correct configuration during power ascension. The team identified two operating procedures that were inadequate to ensure the proper configuration:

1) The general operating procedure (GOP), 3/4-GOP-301, Hot Standby to Power Operation, did not include a requirement to verify the status of the SGFP Recirculation valve controllers prior to entering Mode 1; and 2) The ARP, 3/4-ARP-097-CR.D Control Room Response - Panel D, did not have an operator action to ensure Secondary Controls Auto/Manual controllers were in the required position to support the current plant status.

The licensee took the following initial corrective actions to update procedure 3-GOP-301:

• When at 200 Megawatts Electric (MWe), the SGFP recirculation valves were checked to be closed and in Automatic

• Prior to entering Mode 1, the 3B SGFP stations on DCS will be verified to be in Automatic for recirculation valves CV-3-1414, CV-3-1417, and CV-3-1418

The team reviewed the licensees initial corrective actions and determined it was adequate to verify the SGFP master recirculation controller was in automatic and recirculation valves were properly aligned during power ascension.

See NCV 05000250,05000251/2020050-05, Failure to Implement Procedures for Feedwater Recirculation Control in Automatic, in the inspection results for additional details.

.7 Review and evaluate the actions and reviews taken by the licensee prior to authorization

for each restart of Turkey Point Unit 3, including the effectiveness of the Onsite Review Group.

.7.1 Inspection Activities Related Specifically to Event #1:

The team reviewed the meeting minutes to the Onsite Review Group (ORG) meeting conducted on August 19, 2020, for the post trip review of the August 17, 2020, Unit 3 manual trip event, and decision to grant the subsequent restart of the unit. Additionally, the team interviewed all the members of the ORG who participated in the meeting.

The inspectors determined that the ORG was convened in accordance with procedure LI-AA-1000, Onsite Review Group, with appropriately qualified individuals with a membership that represented all necessary disciplines. The team determined that the ORG was effective in their review of the event. The ORG reviewed the equipment problems associated with the event that were documented in the PTR including the failed pressure switch which caused the spurious opening of valve CV-3-2011, the position indication failure associated with valve MOV-3-1432, which required the closure of the MSIVs, the abnormal TCS runback response, and the unexpected SG level control problems. At the time of the ORG review, it was recognized that the abnormal SG level control issue was most likely due to the feedwater regulating controller setup issue and the failure to conduct an adequate design analysis of the Medium Runback for the spurious opening of CV-3-2011 coincident with an automatic 85 percent turbine runback transient. Reactor restart authorization was approved with the understanding that prior to Unit 3 resuming operation above 88 percent turbine power, either the feedwater regulating valves would need to be re-tuned to respond to the transient or the automatic turbine Medium Runback would need to be disabled. Ultimately, management decided to implement a temporary modification to disable this Medium Runback and provided the operators with procedural guidance to manually reduce turbine power during any future spurious opening of CV-3-2011 until a permanent resolution could be developed and implemented.

.7.2 Inspection Activities Related Specifically to Event #2:

The team interviewed all the members of the ORG who participated in the restart authorization following Event #2.

The team determined that the ORG was ineffective in their review of this event. The ORG was convened in accordance with procedure LI-AA-1000, with appropriately qualified individuals with a membership that represented all necessary disciplines.

However, several factors may have contributed to the ORGs ineffectiveness and their ultimate decision to restart Unit 3 with an inoperable SRNI. These factors included:

• The ORG was not provided an electronic or hardcopy of the reactor engineering evaluation that reviewed the disparity between the SRNIs (N31 and N32) identified during the reactor startup and the automatic trip on August 19, 2020.

• The ORG accepted the verbal explanation of the reactor engineering evaluation and the ORG members did not challenge the lack of vendor input, the qualifications or experience of the engineers that prepared and reviewed the engineering evaluation related to the BF3 proportional detectors, the lack of objective channel check criteria, and the credit for surveillance testing that was limited to testing those portions of the SRNIs in the control room vertical panels and consoles. The reactor engineering evaluation additionally discovered that SRNI N32 lagged SRNI N31 in previous reactor startups yet concluded that this was acceptable SRNI behavior. The ORG did not challenge the conclusion that the disparity discovered during the engineering evaluation on previous startups was acceptable.

• The ORG membership on August 20, 2020, included members with previous reactor engineering experience, yet those members did not understand that the current revision of procedure 3-GOP-301, Hot Standby to Power Operation, directed reactor engineers to collect and calculate inverse count rate data using a single designated SRNI. Those members assumed the reactor startup conducted on August 19, 2020, was compared to inverse count rate data using both SRNIs.

• The PTR that was provided to the ORG members to determine Unit 3s readiness to return to power operation included a graph, obtained from plant computer data, and a software program used to visualize plant computer data, of the observed disparity between SRNI N31 and N32. The graph included both SRNI (N31 and N32) but on two different scales. SRNI N31 was displayed from 0 to 80,000 cps and SRNI N32 was displayed from 0 to 900 cps. Some of the ORG members admitted to not recognizing that the two instruments were displayed on scales with almost two decades difference.

• The ORG was originally scheduled for 0700 on August 20, 2020 and was still scheduled for this time as late as 2209 on August 19, 2020. The ORG was changed to 0500 at 0457 on August 20, 2020. Some of the ORG members participated remotely and received little to no advance notice to participate in the ORG quorum.

See NCV 05000250/2020050-04, Failure to Implement Adequate Corrective Action for Degraded SRNI N32 Condition, in the inspection results for additional details regarding the Unit 3 reactor restart on April 20, 2020, with SRNI N32 inoperable.

.7.3 Inspection Activities Related Specifically to Event #3:

The team interviewed all the members of the ORG who participated in the restart authorization following Event #3.

The team determined that the ORG was effective in their review of the event. The ORG was convened in accordance with procedure LI-AA-1000, with appropriately qualified individuals and a membership that represented all necessary disciplines.

.8 Assess the decision making and actions taken by the licensees personnel to determine

if there are any implications related to schedule pressure or the site's safety culture.

Common Event Discussions:

None of the licensee personnel interviewed during the inspection stated that they felt schedule pressure was a factor in the errors during these events. The team noted the ORGs decision to conduct a restart readiness meeting without having all the supporting documentation available and with 3 minutes notice at 0457 on August 20, 2020, appears to be a case when indirect schedule pressure influenced the organization.

The team assessed the decision making and actions taken by licensee personnel to determine if there were any implications related to schedule pressure or the site's safety culture on the circumstances surrounding the reactor trips. This assessment focused on the adequacy of licensee activities which monitor the traits of a healthy nuclear safety culture. Those activities included:

• Nuclear Safety Culture Monitoring Panel (NSCMP) and Site Leadership Team (SLT)meeting results. The purpose of the NSCMP was to identify negative contributors and trends related to nuclear safety culture which were then rolled up to the SLT for additional monitoring and action.

• Employee Concerns Program (ECP) pulsing results

• Licensee cognitive trending of issues raised to ECP, Human Resources, Licensing, Nuclear Assurance, and Bargaining Unit organizations.

The team did not identify implications related to schedule pressure or the site's safety culture that were precursors to the circumstances surrounding the events, with the exception of, the apparent indirect schedule pressure on August 20, 2020. In addition, the assessment did not identify any safety culture issues at the time of this inspection.

.9 Evaluate the licensees application of pertinent industry operating experience.

The team reviewed select operating experience from the NRC, licensee, and industry that was applicable to the events. Additionally, the team reviewed how the licensee evaluated that operating experience.

The team determined that the licensee had typically performed adequate evaluations of applicable operating experience. However, opportunities were missed which included:

Surry Power Station reported a similar issue with SRNIs in November 2018. Surrys monitoring program identified that one of their SRNIs was inoperable. The associated report detailed their monitoring program and how it detected the condition. The licensee missed an opportunity to identify the lack of a monitoring program and to communicate this condition to operators, engineers, and instrumentation and control (I&C) technicians.

See NCV 05000250,05000251/2020050-06, Failure to Develop and Establish a Preventive Maintenance Schedule to Measure SRNI Detector Performance, for additional details.

Many of the breakdowns of operator fundamentals related to human error prevention and operator performance were trained upon extensively following Institute of Nuclear Power Operations (INPO) significant operating experience reports (SOERs) issued in 2010 and 2011. While the initial training in response to these SOERs was adequate, the refresher training had not been adequately reinforced, (see section

.3.2 for specific

examples).

.10 Evaluate equipment reliability and configuration control for the systems that were

challenged during the trips which occurred on August 17 and August 20, considering the relationship with the Extended Power Uprate (EPU) with additional focus on EPU single point trip vulnerability.

.10.1 Inspection Activities Related Specifically to Event #1:

The team determined that the primary cause of Event #1 was a design analysis error in the implementation of the 2012 EPU modification for the digital TCS runback logic system and feedwater regulating valve controller setup which resulted in the inability of the SG level control system to adequately control level while in automatic. In addition, the TCS runback logic program, which was also part of the EPU modification, did not respond as expected. Specifically, the TCS Medium Runback stopped initially at 87 percent turbine power and received multiple runback requests which caused operator distractions in focusing on unexpected rising SG level conditions that ultimately resulted in the need to manually trip the reactor due to SG levels approaching the turbine trip setpoint. At the time of this inspection, the licensees root cause of the event was not completed but was expected to evaluate in detail the exact cause of the TCS runback logic problem and unexpected SG water level anomalies and address the multiple problems involving the implementation of the EPU design modification.

.10.2 Inspection Activities Related Specifically to Event #3:

The team determined the primary cause of Event #3 was a configuration control problem with the feedwater recirculation system created by the implementation of the EPU modification in 2012. The modification did not revise the plant procedures 3/4-GOP-301, Hot Standby to Power Operation or 3/4-ARP-097-CR.D, Control Room Response - Panel D, to ensure that the SGFP master controller and the associated recirculation valves were in the proper configuration during power ascension.

Additionally, the team identified an equipment reliability problem with the feedwater regulating valves following the EPU modification. Specifically, the 3C feedwater regulating valve (FCV-3-478) response was slow and the C SG water level lagged the other SGs during Event #3. The slow feedwater regulating valve was not the primary cause of Event #3, however, it did complicate the operating crews recovery actions in order to stabilize the C SG water level. The licensee has had past issues during previous transient events with slow response from the 3C FCV-3-478 valve.

INSPECTION RESULTS

Inadequate Design Analysis of Automatic Turbine Runback Actuation Coincident with Inadvertent Opening of CV-3-2011 Cornerstone Significance Cross-Cutting Aspect Report Section Initiating Events

Green FIN 05000250/2020050-01 Open/Closed None (NPP)93812 A self-revealed Green Finding was identified for the licensees failure to implement adequate design change controls associated with the 2012 Unit 3 extended power uprate (EPU)modification that added an automatic medium turbine runback coincident with the opening of the low-pressure feedwater heater bypass valve CV-3-2011. Specifically, the licensee failed to implement procedure EN-AA-205-1100, Design Change Packages, and to evaluate the effect of the valve opening without a valid demand signal in the Failure Modes and Effects Analysis (FMEA) and to adequately review the calculational design inputs and assumptions required by design change procedures.

Description:

On August 17, 2020, with Unit 3 operating at full power, the control room received indication of an automatic medium turbine runback coincident with the spurious opening of the low-pressure feedwater heater bypass valve CV-3-2011. As a result of unexpected rising SG water levels, the operators took manual control of the feedwater regulating valve for the 3C SG that had the highest level at the time, however, operators were unsuccessful in reducing the increasing level trend. The operators manually tripped the reactor at approximately 91 percent reactor power as SG water levels approached the setpoint for an automatic turbine trip.

The licensees investigation into the cause of the unexpected rising SG levels identified a design change error when the digital TCS automatic runback logic system was modified during the implementation of the EPU modification in 2012. While the design analysis for the modified TCS runback logic included adequate analysis of a turbine runback due to CV-3-2011 opening in response to an actual SGFP low pressure condition, it did not include the design analysis of an inadvertent opening of CV-3-2011 with a medium turbine runback.

Specifically, in accordance with licensee design change procedure EN-AA-205-1100, Design Change Packages, a FMEA was required to be performed for the inclusion of the transient, but design engineering personnel failed to conduct the required FMEA transient analysis for the event. In addition, licensee design procedure ENG-QI-1.5, Calculations, required an engineer who was knowledgeable of the subject matter to review calculations to ensure that assumptions and judgements had sufficient rationale and that inputs were from appropriate sources, correct, incorporated into the analysis, and were consistent with the plant design and operation. A missed opportunity to have identified the design analysis discrepancy occurred during engineering review of the supporting EPU calculations. An engineer identified that the runback due to CV-3-2011 spuriously opening was not one of the analyzed transients; however, it was mistakenly determined that the total loss of heater drain flow transient evaluation would bound the effects of this specific runback.

As a result of not conducting the required transient analysis for the spurious opening of CV-3-2011 coincident with an automatic Medium Runback, it was not recognized that this transient was more severe than the other analyzed runback conditions. The lesser severity transients formed the basis for the setup and tuning of the feedwater regulating valve controllers. Due to the more challenging plant conditions experienced during a spurious opening of valve CV-3-2011, the feedwater regulating valves and their controllers were not setup and tuned (in automatic) to be able to manage the needed response that was required to prevent the unexpected rise in SG levels that was experienced.

Corrective Actions: The licensee entered the issues identified during the manual reactor trip into the CAP and initiated a root cause evaluation for the event. Prior to Unit 3 restart, the pressure switch which caused the spurious opening of CV-3-2011 was repaired and a temporary modification was implemented to modify the TCS logic, to eliminate the automatic medium turbine runback during an inadvertent opening of CV-3-2011.

Corrective Action References: AR 2365716

Performance Assessment:

Performance Deficiency: A performance deficiency was identified for the licensees failure to evaluate the spurious opening of valve CV-3-2011 and its effect on the ability of the main feedwater regulating valves to control SG water levels and prevent a plant trip. Specifically, the licensee failed to implement procedure EN-AA-205-1100, Design Change Packages, and to evaluate the effect of the valve opening without a valid demand signal in the Failure Modes and Effects Analysis (FMEA) and to adequately review the calculational design inputs and assumptions required by design change procedures.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Design Control attribute of the Initiating Events cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, operators were unsuccessful in controlling SG level and manually tripped the reactor as levels approached the setpoint for an automatic turbine trip.

Significance: The inspectors assessed the significance of the finding using IMC 0609, 4, Initial Characterization of Findings, for Initiating Events, and IMC 0609, Appendix A, The Significance Determination Process For Findings At-Power, and using Exhibit 1, Initiating Events Screening Questions, determined the finding to be of very low safety significance (Green) because the finding, when screened as a transient initiator, did not cause both a reactor trip AND the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition (e.g., loss of condenser, loss of feedwater).

Cross-Cutting Aspect: Not Present Performance (NPP). No cross-cutting aspect was assigned to this finding because the inspectors determined the finding did not reflect present licensee performance given that the EPU modification was implemented in 2012.

Enforcement:

Inspectors did not identify a violation of regulatory requirements associated with this finding.

Failure to Adequately Manage Reactivity During Startup Cornerstone Significance Cross-Cutting Aspect Report Section Barrier Integrity /

Initiating Events Green NCV 05000250/2020050-02 Open/Closed

[H.4] -

Teamwork 93812 The NRC identified a Green finding and associated non-cited violation (NCV) of Unit 3 Technical Specification (TS) 6.8.1, Procedures and Programs, for the failure to follow procedure 3-GOP-301, "Hot Standby to Power Operation, which provided instructions for reactor startup. Specifically, the operating crew failed to implement 3-GOP-301 which resulted in an excessive reactivity addition and caused an RPS trip which automatically shut down the reactor.

Description:

On August 19, 2020, operators were conducting a reactor startup of Unit 3 after experiencing a manual reactor trip on August 17, 2020. The operators were performing procedure 3-GOP-301, "Hot Standby to Power Operation, conducting a normal plant startup using control rods. The operating crew consisted of a three-person reactivity team: the OATC, a peer checker, and a reactivity SRO. The responsibility of the reactivity team was to manage reactivity during the startup. The crew also had a Unit 3 RO, and a third RO, to provide administrative support (i.e., log keeping, plant announcements, etc.). A US was responsible for the overall Unit 3 startup activities and a SM was overseeing all crew activities. Also present during the startup was a Reactor Engineer supporting the startup by plotting the SRNI inverse count rate, (1/M plot), and a training department observer.

Additionally, two assistant operations managers and the SVP were present in the main control room observing the startup.

After declaring the reactor critical at 1316 on August 19, 2020, the OATC was given the order from the reactivity SRO to perform step 5.21 of procedure 3-GOP-301 to raise power to 10-8 amps and do not exceed a 1.0 dpm SUR. The OATC intended to perform a continuous rod withdrawal of control rod group D until a 0.7 dpm SUR was achieved and stop withdrawing control rods. The rationale for 0.7 dpm was that with a steady state 0.7 dpm SUR power would not double in less than a minute. The OATC withdrew control bank D for 45 seconds which was 53 steps until rod motion was stopped when a valid SR Hi Flux RPS trip signal was generated and the reactor automatically tripped. SUR was greater than 1.0 dpm for the final 25 seconds of the 45 second rod withdrawal and reached a maximum indicated value of 3.0 dpm, with an instantaneous SUR of 7.4 dpm at the time of the trip.

No member of the operating crew recognized that the OATC had exceeded the SUR limits of the procedure, or that the plant was approaching an RPS trip threshold, and that the OATC was withdrawing rods continuously. Contributing factors included:

• JIT Training: Required JIT training was conducted for the startup crew the afternoon prior to the startup. All members of the crew attended, with exception of the Unit 3 RO and the Reactor Engineer. A tabletop walkthrough of the startup procedure was performed emphasizing 3-way communications. However, simulator training was only performed for the turbine synchronization to the grid and not the startup and power ascension. The training crew was also unaware that the OATC had never performed this evolution on the plant.

• Operator Fundamentals Breakdowns: The OATC never informed the reactivity team of his startup intentions or which key plant parameters to monitor and at what point to stop withdrawing control rods. Thus, the operating crew did not have an opportunity to coach the OATC or to provide backup when the SUR exceeded the intended 0.7 dpm. Also, operators did not follow fundamental principles to ensure they understood the expected plant response for an action, (i.e. take the action, observe plant response, and stop if expected plant response was not achieved). The OATC did not know how much rod motion was needed to establish a steady 0.7 dpm SUR and did not recognize that not seeing a 0.7 dpm for such an extended rod withdrawal was an abnormal system response. Note: The indicated SUR was well above 1.0 dpm, based on a review of plant computer historical data after the event, however, none of the crew noticed this at the time.

• Oversight and Control of the Startup Evolution: The reactivity team provided no meaningful assistance to the OATC during the power ascension, nor did the US or SM. Key reactor plant indications were displayed on the ROs vertical panel.

Additionally, the SROs had monitoring capability digitally displayed in other areas of the control room. The reactivity SRO and the US were in direct line of site of nuclear instrumentation and the OATCs hand on the rod control switch, yet did not notice the excessive SUR or appropriately stop the withdrawal of control rods. Audio of SR counts and rod motion was energized and loud enough to be heard, and plant computer data was available in multiple locations. Additionally, the action to deenergize SR high volts after the P-6 Permissive light came in was delegated to the third RO. If this action had been assigned to the OATC as normally performed, the OATC would have had to stop withdrawing rods when P-6 was announced while SUR was approximately 1.0 dpm. Instead the OATC continued withdrawing control rods during this time limited evolution.

• Confusing Indications: Prior to criticality, during the startup, it was noted that SRNI channels N31 and N32 were deviating by approximately 1.0 decade. As the startup progressed this deviation continued to increase. During the continuous rod withdrawal, plant computer data also showed that SRNI N32 SUR was also lagging the other three SUR indications (i.e., IRNI N35 and N36 and SRNI N31). At the time of the trip, SUR was 3.0 dpm on three channels and 1.5 dpm on SRNI N32.

It was possible that some operators may have been confused by this or focused on this incorrect indication.

Corrective Actions: The licensee prepared a PTR for the event on August 19, 2020, entered the issues identified into the CAP, and initiated a root cause evaluation for the operator performance issues. Immediate corrective actions included removing operators from watch standing duties for remediation, increased oversight of startup activities, and JIT training.

Additional corrective actions were to be developed as part of the root cause evaluation.

Corrective Action References: AR 2365970

Performance Assessment:

Performance Deficiency: A performance deficiency was identified for the licensees operating crews failure to adequately manage reactivity additions to the core, and failure to adequately monitor key reactor plant parameters during reactivity additions. Specifically, the operating crew did not identify procedure 3-GOP-301 SUR limits were exceeded, which resulted in an automatic RPS actuation and reactor trip.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Human Performance attribute of both the Barrier Integrity and Initiating Events Cornerstones and adversely affected the cornerstone objectives to provide reasonable assurance that physical design barriers protect the public from radionuclide releases caused by accidents or events. Specifically, operators challenged the SUR limits which resulted in an automatic RPS trip actuation.

Significance: The inspectors assessed the significance of the finding using IMC 0609, 4, Initial Characterization of Findings. Subsequently, the inspection staff and applicable Senior Risk Analyst (SRA), with support from management, determined IMC 0609, Appendix M, Significance Determination Process Using Qualitative Criteria, was an appropriate evaluation tool, given that this event was caused by multiple human performance errors, involved an error of commission, and involved low power operations for which the NRC and Licensee do not have plant specific risk models. A planning Significance and Enforcement Review Panel (SERP) was conducted on October 7, 2020, which confirmed the use of IMC 0609, Appendix M, was warranted for this evaluation.

To conduct a risk assessment in accordance with IMC 0609, Appendix M, the SRA consulted with the licensee and Idaho National Laboratory (INL), to develop a low power event tree model for a SR Continuous Rod Withdrawal Event using the guidance in WCAP-15381-NP-A, Revision 2, WOG Risk-Informed ATWS Assessment and Licensing Implementation Process, (ADAMS Accession No. ML072550560). Additionally, the SRA identified several operator time critical actions which were required to be performed in the event RPS fails.

These actions all required the operators to diagnose the condition, enter the appropriate Emergency Operating Procedures (EOPs), and perform the actions. Given the performance deficiency directly related to the operators ability to monitor key plant parameters and identify that an RPS threshold was met, applicable human error probabilities (HEPs) needed to be adjusted to account for operators not diagnosing the event.

The Appendix M worksheet used to reach the SDP conclusion is included in Attachment C of this report. The finding was determined to be of very low safety significance (Green).

Cross-Cutting Aspect: H.4 - Teamwork: Individuals and work groups communicate and coordinate their activities within and across organizational boundaries to ensure nuclear safety is maintained. The failure of the OATC to communicate their intentions and coordinate monitoring activities was a primary contributor to this event.

Enforcement:

Violation: Unit 3, TS 6.8.1.a, stated in part, that written procedures shall be established, implemented, and maintained covering the activities referenced in the applicable procedures required by the NextEra Energy Quality Assurance Topical Report (QATR). NextEra QATR, Appendix B, Procedures, stated in part that, NextEra Energy committed to use Appendix A of Regulatory Guide 1.33 as guidance for establishing the types of procedures that are necessary to control and support plant operation. Regulatory Guide 1.33, Appendix A, item 2, General Plant Operating Procedures, subsection a, included procedures for Hot Standby to Minimum Load (nuclear startup). The licensee implemented procedure 3-GOP-301, "Hot Standby to Power Operation, to provide instructions for reactor startup, to satisfy TS procedure requirements. Procedure step 5.21 provided instructions to establish a steady state startup rate of 1.0 dpm or less to 10-8 amps and stabilize reactor power at 10-8 amps on the IR Monitors.

Contrary to the above, on August 19, 2020, during reactor startup using 3-GOP-301, licensee personnel failed to properly raise power to 10-8 amps while maintaining a startup rate of 1.0 dpm or less which resulted in an automatic reactor trip on the 105 cps SRNI high flux trip setpoint.

Enforcement Action: This violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the Enforcement Policy.

Failure to Adequately Monitor Source Range Nuclear Instrument (SRNI) N-32 Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems

Green NCV 05000250/2020050-03 Open/Closed

[H.11] -

Challenge the Unknown 93812 The NRC Identified a Green NCV of TS 3.3.1, Instrumentation, for not entering the Limiting Condition for Operation (LCO) and completing the action statement for one of the required SRNI Hi Flux Trip channels being inoperable in a mode where it was required.

Specifically, the licensee conducted a reactor startup, and entered Mode 2 with the SRNI N32 and its associated SR High Flux RPS trip channel inoperable.

Description:

On August 19, 2020, operators were conducting a reactor startup following the August 17, 2020, reactor trip. During the startup, the OATC and the RO peer checker identified that SRNI channels N31 and N32 had deviated by a full decade. The operators stopped rod withdrawal and brought their concern to the reactivity SRO and US who discussed the concern with the SM. At this time, SRNI channel N31 had doubled twice while SRNI channel N32 was still close to its pre-startup value. The SM and other SROs reviewed plant data traces for both SRNI channels and observed that both channels appeared to be responding to the rod pulls but at different magnitudes. Based upon this observation and the operator rounds limit of a 1.5-decade channel deviation, the crew believed that SRNI N32 was still operable. The operators were instructed to monitor SRNI N32 and continue with the reactor startup. The reactor engineer who was present in the control room performing the 1/M plot, using SRNI N31, was not consulted. If SRNI N32 was used for on the 1/M plot, it would have been clear that SRNI N32 was not responding properly. Both the startup and reactivity management procedures had steps to compare the estimated critical position, 1/M plot projected criticality values, and provided clear guidance for stopping the startup and evaluating. If SRNI N32 had been used, those limits would have been exceeded prior to the reactor reaching criticality and it would have been clear that SRNI N32 was inoperable.

The established monitoring criteria for the SRNI deviation was 1.5 decades. As control rods were withdrawn to criticality, the deviation between the channels continued to increase.

At approximately 1.4 dpm deviation, SRNI N32 counts had only doubled once, while SRNI N31 had doubled approximately 5 times as expected. During the OATCs rod withdrawal to raise power to 10-8 amps in the IR, the channels deviated by greater than 1.5 decades for most of the withdrawal reaching a maximum deviation of 2 decades at the time of the SR High Flux trip. The SRNI SUR indications for the two channels also began to deviate noticeably, (3.0 dpm for N31 and 1.5 dpm for N32). These key reactor plant parameters were being displayed and were required to be continuously monitored during a plant startup.

TS 3.3.1 required that two of two channels of SRNIs and SR High Flux RPS Trips be operable during Mode 2. The action statement for not maintaining minimum required channels was to immediately stop all reactivity additions. Had the TS LCO action statement been entered, the SR High Flux Trip would have been avoided.

Although not related to the performance deficiency, no technical basis for the 1.5 decade deviation channel check criteria for SRNIs could be found, however, the vendor recommended a channel deviation of 1.0 decade. Personnel had raised this concern previously, in 2001 and 2010, and licensee evaluations had made the same observation and proposed enhancements to update the criterion, however, this was never implemented.

Procedure OP-AA-103-1000, Reactivity Management, Rev. 13, stated that no significant discrepancies exist between reactor power level indicators and/or indirect power indications such as turbine first stage pressure. If significant discrepancies exist, power ascension shall cease until the situation is investigated.

The operations crew had numerous opportunities to challenge the operability of SRNI N32 during the August 19, 2020, reactor startup and had many different indications and resources available which were not used. Reviews of past startup data showed that SRNI N32 frequently deviated from SRNI N31. Subsequent past operability reviews concluded that channel SRNI N32 had been inoperable since at least April 2020. The degraded RPS trip function was challenged and the redundant channel actuated and tripped the reactor during the August 19, 2020, startup.

Corrective Actions: The licensee prepared a PTR for the event on August 19, 2020, and entered the issues identified into the CAP. Troubleshooting was performed on the SRNIs and IRNIs under WO Packages 40737616-01 and -02 which included directing the staff to perform procedure 3-SMI-059.03, SRNI N32 Calibration. These corrective actions were ineffective.

Ultimately, the licensee implemented a repair plan with vendor support to restore the sensitivity of the SRNI N32 detector to an operable condition in WO 40738044, U3 N32 Increase Detector Sensitivity. WO 40738044 increased N32 high voltage detector setting from a nominal 1,500 VDC to 1,750 VDC. A successful post maintenance test for SRNI N32 was completed on August 24, 2020, during a Unit 3 reactor startup, which invoked TS 3.0.6 to demonstrate SRNI N32 operability by comparing cps levels at six discrete points in the reactor startup sequence and verifying that SRNI N31 and N32 channels did not deviate beyond 1.0 decade.

Corrective Action References: AR 2366002

Performance Assessment:

Performance Deficiency: The failure to properly monitor SRNI N32 performance during a reactor startup and the failure to identify that the SRNI N32 was inoperable was a performance deficiency. Specifically, operators failed to follow procedure OP-AA-103-1000 by continuing a reactor startup with power level indication discrepancies present.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the SRNI N32 and associated High Flux RPS trip channel function was unable to perform its TS required safety function in a mode where it was required.

Significance: The inspectors assessed the significance of the finding using IMC 0609, 4, Initial Characterization of Findings, for Mitigating Systems, and IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power. Using the screening questions in IMC 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions, section C, Reactor Protection System (RPS), the performance deficiency screened to very low safety significance (Green) because the finding only affected a single RPS trip signal to initiate a reactor trip AND the function of other redundant trips or diverse methods of reactor shutdown (e.g., other automatic RPS trips, alternate rod insertion, or manual reactor trip capacity) was not affected. The redundant channel of the SR High Flux RPS trip functioned when called upon and IR Hi Flux and Power Range Low Power High Flux RPS trips were also not affected by the performance deficiency and were available.

Cross-Cutting Aspect: H.11 - Challenge the Unknown: Individuals stop when faced with uncertain conditions. Risks are evaluated and managed before proceeding. Specifically, operators did not adequately challenge the degraded performance of SRNI N32 at multiple points during the reactor startup and elected to proceed with the startup versus evaluating the issue more thoroughly.

Enforcement:

Violation: Unit 3 TS 3.3.1, Instrumentation, required that in Mode 2, two of two SR High Flux RPS trip channels be operable.

Contrary to the above, on August 19, 2020, the licensee conducted a reactor startup, and entered Mode 2 with the SRNI N32 and its associated SR High Flux RPS trip channel inoperable.

Enforcement Action: This violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the Enforcement Policy.

Failure to Implement Adequate Corrective Action for Degraded Source Range Nuclear Instrument (SRNI) N32 Condition Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems

Green NCV 05000250/2020050-04 Open/Closed

[P.2] -

Evaluation 93812 The NRC identified a Green NCV of 10 CFR 50, Appendix B, Criterion XVI, Corrective Action, for failure to identify and correct a condition adverse to quality related to the SRNI N32 and its associated RPS SR high flux trip channel during the post trip review of the August 19, 2020, trip which resulted in a subsequent reactor startup on August 20, 2020, with an inoperable RPS trip channel.

Description:

On August 19, 2020, Unit 3 had an automatic RPS actuation due to a valid High SR flux signal from SRNI N31. A post trip review was conducted, and statements were taken from the operators. The purpose of the post trip review was to gather all relevant equipment and human performance data to ensure immediate performance issues were identified and corrective and/or compensatory actions can be developed. The post trip review identified several issues related to the SRNIs including:

1) At the time of the trip, SRNI N31 indicated 78,000 cps and SRNI N32 indicated 760 cps, 2) During the startup a concern had been raised that SRNI N31 and SRNI N32 had diverged by greater than one decade, and 3) There were concerns about SR and IR SUR indications since no operator recalled seeing greater than a 0.7 SUR.

The concerns were documented in AR 2366002, however, an operability review was not documented until the following day, after the August 20, 2020, startup occurred. The SM verbally discussed the issue with operations management and concluded the instrument was operable and documented that position in writing the next day.

As part of the post trip review, the Outage Control Center (OCC) was directing troubleshooting activities for both SRNI and all SUR indications. WO Packages 40737616-01 and -02 included directions to perform procedure 3-SMI-059.03, SRNI N32 Calibration.

This calibration only tests the instrumentation portion of the channel using a test signal.

The SRNI detector and interconnected wiring were not tested. The troubleshooting verified that the instrumentation upstream of the detector and control room indications were operating properly. Procedure 3-SMI-059.03, Sections 4.13 and 4.14 had acceptance criteria for neutron level instrumentation when 105 cps test signal was inserted of 8 x 104 to 1.2 x 105 cps. The post trip review clearly identified that SRNI N32 was well outside this tolerance band when actual plant conditions warranted an RPS trip.

An engineering evaluation was also developed to present to the ORG during the restart readiness meeting. The engineer who developed the evaluation was the Reactor Engineer on shift during the August 19, 2020, reactor trip. The evaluation was reviewed by another engineer; however, this engineer was not a Reactor Engineer and was not familiar with the equipment. The evaluation used engineering judgement and qualitative observations to conclude SRNI N32 was operable, based on the channel response to rod retractions when plant computer data was viewed on a lower scale. This was the same rationale the SM had used when the deviation was identified, for the August 19, 2020, startup. The evaluation also used plant data from previous startups to show that the instrument had behaved similarly in the past. For example, the April 2020 startup data showed the two SR instruments diverged by a factor of seven as the reactor power was raised to the P-6 permissive. None of the quantitative criteria available were used to evaluate the performance of the SRNI and its associated RPS trip channel. These included:

• The SRNI N31 and N32 had diverged by 2 decades at the time of the trip, a fact captured in the executive summary of the PTR. The monitoring criteria in surveillance requirements and operator rounds was SR channels should not diverge by greater than 1.5 decades.

• When actual plant conditions provided a 105 count rate, SRNI N32 was well outside the acceptance bands in surveillance procedure 3-SMI-059.03, Sections 4.13 and 4.14 of 8 x 104 to 1.2 x 105 cps for a test signal of 105 present. The PTR documented the observed count rate was 820 cps.

• SRNI N32 only doubled 4.5 times at the time of the trip while N31 had doubled 11 times.

• When the reactor was called critical, SRNI N32 had only doubled one time, versus the five times as expected, which had occurred on SRNI N31.

• When SRNI N32 data was plotted on the 1/M plot, the guidelines in procedure 3-GOP-301, Hot Standby to Power Operations, step 4.26 were clearly not met.

The same guidance was also in the reactivity management procedure. Specifically, if the projected critical rod position deviated from Estimated Critical Configuration (ECC)by greater than 500 percent mille (pcm), control banks should be reinserted and the ECC reevaluated. Additionally, the reactor shall not be made critical with a difference greater than 1,000 pcm. This was a reasonable criterion that could have been used when addressing SRNI operability during the PTR and the operability determination.

• SRNI N32 SUR indications also diverged from SRNI N31 and IRNI SURs, (3.0 dpm versus 1.5 dpm at the time of the trip).

These quantitative factors contradicted the conclusion of the engineering evaluation and were not adequately considered.

The evaluation was presented orally to the ORG restart review meeting. The actual evaluation was not sent to ORG members until after the meeting and the decision to restart Unit 3 was already made. ORG members questions focused on human performance factors related to the trip and did not challenge the operability of SRNI N32.

After the August 20, 2020, startup and subsequent manual reactor trip, the licensee requested technical assistance from the vendor. The vendor did not support the operability call made by the licensee. The vendor provided guidance to address the condition temporarily to restore operability and recommended replacing the SRNI detector at the next available opportunity.

Corrective Actions: The licensee entered the issue into their CAP as AR 2366002. Short term repairs were implemented and SRNI N32 was retested and returned to an operable status on August 24, 2020.

Corrective Action References: AR 2366002 and AR 2366093

Performance Assessment:

Performance Deficiency: The licensee failed to identify and correct a condition adverse to quality in accordance with 10 CFR 50, Appendix B, Criterion XVI. Specifically, SRNI N32 and its associated RPS trip channel were inoperable during the post trip review and restart authorization process.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, SRNI N32 and the associated High Flux RPS trip channel function was unable to perform their TS required safety function in a mode where it was required.

Significance: The inspectors assessed the significance of the finding using IMC 0609, 4, Initial Characterization of Findings, and IMC 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. Using the screening questions in IMC 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions, section C, Reactor Protection System (RPS), the performance deficiency screened to very low safety significance (Green) because the finding only affected a single RPS trip signal to initiate a reactor trip AND the function of other redundant trips or diverse methods of reactor shutdown (e.g., other automatic RPS trips, alternate rod insertion, or manual reactor trip capacity) was not affected. The redundant channel of the SR High Flux RPS trip was operable and IR Hi Flux and Power Range Low Power High Flux RPS trips were also not affected by the performance deficiency.

Cross-Cutting Aspect: P.2 - Evaluation: The organization thoroughly evaluates issues to ensure that resolutions address causes and extent of conditions commensurate with their safety significance. Specifically, the licensee did not thoroughly evaluate the performance of the SRNI N32, in that they did not properly consider quantitative information that was available to them during the post trip review process when determining operability.

Enforcement:

Violation: 10 CFR 50 Appendix B Criterion XVI, Corrective Actions, required, in part, that Measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected.

Contrary to the above, on August 20, 2020, the licensee failed to promptly identify and correct a condition adverse to quality. Specifically, the SRNI N32 and its associated RPS trip Channel were inoperable during the post trip review of the August 19, 2020, reactor trip, and the licensee subsequently performed a reactor startup without fully identifying, and correcting the required equipment.

Enforcement Action: This violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the Enforcement Policy.

Failure to Implement Procedures for Feedwater Recirculation Control in Automatic Cornerstone Significance Cross-Cutting Aspect Report Section Initiating Events

Green NCV 05000250,05000251/2020050-05 Open/Closed None (NPP)93812 A self-revealed Green NCV of TS 6.8.1, Procedures and Programs, was identified for the licensees failure to establish, implement, and maintain adequate procedures for properly controlling the configuration of the Master Controller for the steam generator feedwater pump (SGFP) recirculation valves during Unit 3 plant startup.

Description:

The Unit 3 manual reactor trip, that occurred on August 20, 2020, was caused by the SGFP Recirculation Valves Master Controller being in manual instead of automatic during power ascension. This alignment resulted in the recirculation valves being left fully open with reactor power at 34 percent. These valves would have been fully closed above 20 percent power had the controller been in automatic. When the operating crew took manual control and attempted to close the recirculation valves, it resulted in lowering suction pressure and eventual trip of the 3B feedwater pump due to low suction pressure. Subsequently, due to the loss of the only running feedwater pump, the operators inserted a manual reactor trip as required by procedures.

The team identified two examples where the licensee failed to establish, implement, and maintain plant procedures to ensure the SGFP Recirculation Valves Master Controller and associated recirculation valves were in the correct configuration during power ascension.

The first example was the general operating procedure (GOP), 3/4-GOP-301, Hot Standby to Power Operation, which did not include a requirement to verify the status of the SGFP Recirculation valve controllers prior to entering Mode 1. The second example involved the alarm response procedure (ARP), 3/4-ARP-097-CR.D, Control Room Response - Panel D, which also did not have an operator action to ensure the Secondary Controls Auto/Manual controllers were in the correct position required to support power ascension.

The team reviewed modification EC 246935, that was part of the 2012 EPU which introduced a new SGFP recirculation valve controller scheme. This included the addition of two recirculation to condenser valves and one suction recirculation valve, as well as their associated controllers and one master controller for all three valves. The new controller system provided automatic valve control during power operations. The system included a design that transferred valve control from automatic to manual upon receipt of signals indicating variations in the flow transmitters for each of the three recirculation valves.

The new secondary controls provided many inputs to a single Control Room Annunciator D-4/5 (DCS Secondary Trouble).

The team determined that the EPU modification did not revise plant procedures 3/4-GOP-301 and 3/4-ARP-097-CR.D, as part of its implementation to ensure that the SGFP master controller and the associated recirculation valves would be verified for the proper configuration during power ascension.

Corrective Actions: The licensee took immediate corrective actions to update procedure 3-GOP-301 to include an operator action when the unit reaches 200 MWe, to verify the SGFP recirculation valves are closed and the valve controllers are in automatic. In addition, actions were added prior to entering Mode 1, to verify the SGFP control stations on the DCS display panel were in automatic for recirculation valves CV-3-1414, CV-3-1417, and CV-3-1418.

The licensee initiated a corrective action to revise ARPs 3/4-ARP-097.CR.D, to add an operator action to ensure the DCS Secondary Controls were in the proper configuration to support power ascension. Additional corrective actions were expected following the completion of the licensees root cause evaluation of the event that was ongoing at the time of the inspection.

Corrective Action References: AR 2366158

Performance Assessment:

Performance Deficiency: The licensees failure to ensure plant condensate and feedwater systems were properly aligned to support plant startup was a performance deficiency.

Specifically, GOP 3-GOP-301, Hot Standby to Power Operation, and ARP 3-ARP-097-CR.D, Control Room Response - Panel D, did not contain instructions to ensure that the SGFP Recirculation Valves Master Controller was in automatic and the associated feedwater pump recirculation valves were in the proper configuration during power ascension.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Configuration Control attribute of the Initiating Events cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, a manual reactor trip was initiated due to a configuration control problem on August 20, 2020.

Significance: The inspectors assessed the significance of the finding using IMC 0609, 4, Initial Characterization of Findings, for Initiating Events, and IMC 0609, Appendix A, The Significance Determination Process For Findings At-Power, and using Exhibit 1, Initiating Events, for Transient Initiators, determined the finding to be of very low safety significance (Green) because the finding did not cause both a reactor trip AND the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition (e.g., loss of condenser, loss of feedwater).

Cross-Cutting Aspect: Not Present Performance. No cross-cutting aspect was assigned to this finding because the inspectors determined the finding did not reflect present licensee performance. The EPU modification was implemented in 2012.

Enforcement:

Violation: TS 6.8.1.a, stated in part, that written procedures shall be established, implemented, and maintained covering the activities referenced in the applicable procedures required by the NextEra QATR. NextEra QATR, Appendix B, Procedures, stated in part, that NextEra Energy committed to use Appendix A, of Regulatory Guide 1.33, as guidance for establishing the types of procedures that are necessary. Regulatory Guide 1.33, Appendix A, item 2, General Plant Operating Procedures, included (2)(b) Hot Standby to Minimum Load, and item 5, included, Procedures for Abnormal, Off-normal, or Alarm Conditions. The licensee implemented 3/4-GOP-301, "Hot Standby to Power Operation," and 3/4-ARP-097-CR.D, Control Room Response - Panel D, as part of these procedure requirements.

Contrary to the above, from 2012 until the present, the licensee failed to establish, implement, and maintain plant procedures 3/4-GOP-301, "Hot Standby to Power Operation," and 3/4-ARP-097-CR.D, Control Room Response - Panel D, following the EPU modification.

Specifically, GOP 3-GOP-301, Hot Standby to Power Operation, and ARP 3-ARP-097-CR.D, Control Room Response - Panel D, did not contain instructions to ensure that the SGFP Recirculation Valves Master Controller was in automatic and the associated feedwater pump recirculation valves were in the proper configuration during power ascension. As a result, a manual reactor trip occurred due the lack of adequate condensate and feedwater system configuration controls associated with systems modified under the EPU modification.

Enforcement Action: This violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the Enforcement Policy.

Failure to Develop and Establish a Preventive Maintenance Schedule to Measure Source Range Nuclear Instrument (SRNI) Detector Performance Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems

Green NCV 05000250,05000251/2020050-06 Open/Closed

[P.5] -

Operating Experience 93812 An NRC-identified Green NCV of TS 6.8.1, Procedures and Programs, was identified for the licensees failure to develop and establish a preventive maintenance schedule to perform source range nuclear instruments (SRNI) detector baseline and trending tests.

Description:

During the Unit 3 reactor startup on August 19, 2020, control room operators observed that, SRNI N31 and N32, cps were deviating, specifically SRNI N32 was lagging N31. In response to the SRNI N32 behavior, the licensee initiated AR 2366002, "N31/N32 Source Range Detector Response Disparity." AR 2366002 was initiated after the reactor startup and subsequent automatic trip on SR neutron high flux and required reactor engineering to determine and document the acceptability of the disparity in response observed. The results of the reactor engineering evaluation were presented to the ORG that convened on August 20, 2020, at 0500 hours0.00579 days <br />0.139 hours <br />8.267196e-4 weeks <br />1.9025e-4 months <br /> and was additionally reviewed by a SM to support the operability screening. Although the SM recognized that the condition described in AR 2366002 called into question the operability of a TS required component, the SM inadvertently entered not applicable for the operability screening in the Nuclear Assets Management System (NAMS). Control room operators ultimately commenced a Unit 3 reactor startup on August 20, 2020, at 0730 hours0.00845 days <br />0.203 hours <br />0.00121 weeks <br />2.77765e-4 months <br /> with SRNI N32 inoperable.

On August 20, 2020, an off-shift SRO recognized that AR 2366002, did not receive an immediate operability determination and was screened as not applicable. The off-shift SRO initiated AR 2366093, "Potential Inoperability of NI-31 [-32]," and notified the control room operators of the concern. While the SM inadvertently screened AR 2366002 as not applicable, the intention was to screen the issue as operable but degraded. The resident inspectors also disagreed with the SMs assessment of the operability of SRNI N32 and applied the guidance in IMC 0326, Operability Determinations, (ADAMS Accession No.

ML19273A878), Section 06.12, Issue Resolution and Internal Alignment. Regional NRC staff consulted with Headquarters technical experts in the Office of Nuclear Reactor Regulation (NRR) and together, prepared questions and information requests for the licensee to respond. NRC staff recognized that Unit 3 had returned to Mode 1 and the SRNI operability was no longer applicable in Mode 1. NRC staff intended to challenge the licensee on its assessment of the operability of SRNI N32 as soon as possible in the event of an unscheduled Mode 3 entry that would require two operable SRNIs in accordance with TS 3.3.1, Reactor Trip System Instrumentation. Subsequently, on the evening of August 20, 2020, Unit 3 was manually tripped. On August 21, 2020, the resident inspectors presented the questions and information requests regarding the operability assessment of SRNI N32 to licensee management with the expectation that the questions and information requests should be responded to prior to Unit 3 reactor startup. The resident inspectors and NRC technical experts disagreed with the SMs operability assessment and reactor engineers conclusions in the associated technical evaluation. The resident inspectors concern for disparity between SRNIs N31 and N32 was communicated to licensee management on August 19, 2020, after the reactor trip on SR high neutron flux when it was identified that SRNI N32 was reading almost two decades below SRNI N31 when the automatic reactor trip occurred.

On August 22, 2020, the licensee completed its prompt operability determination for the observed disparity between the SRNI N31 and N32 channels and concluded that N32 was unable to achieve its specified safety function due to a slow response to changing neutron flux. The prompt operability determination was informed by a vendor review of the historical data and determined the sensitivity of N32 was degrading over time as the detector approached the end of its service life. The degradation progressed to the point that continued operability of N32 was challenged as it would not likely provide a trip signal when conditions in the core would warrant one, as occurred on August 19, 2020. On August 22, 2020, control room operators declared N32 inoperable at 0017 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br />.

During correspondence with the vendor, the licensee was informed that they were not following the guidance described in vendor document RRS-VICO-02-326, A Predictive Maintenance and Evaluation Guide for Ex-Core and In-Core Detectors used in Westinghouse Pressurized Water Reactors, dated May 2002. The SRNI detectors were boron trifluoride (BF3) gas proportional counters. Specifically, the Unit 3 and Unit 4 SRNI detectors were Westinghouse NY-10032 low voltage detectors. SRNI N32 on Unit 3 had been in service since April 2006 and was the SRNI detector with the longest time in service for both Units 3 and 4. Unit 3 SRNI N31 was installed in May 2015, Unit 4 SRNI N31 in April 2011, and Unit 4 SRNI N32 was installed in September 2017. The BF3 proportional counters had aging characteristics and failure mechanisms that would reduce their sensitivity to neutron flux.

The expected service life of the NY-10032 detectors was ten to twenty years.

The guidance in vendor document RRS-VICO-02-326 was intended to provide reactor engineers with specific criteria for deciding when ex-core and in-core detectors were approaching their end-of-life and should be replaced. As an alternative, the licensee also had not established a preventive maintenance schedule to periodically replace the SRNI detectors prior to their expected end of service life.

Although the vendor recommended program described in RRS-VICO-02-326, was dated May 2002, a more recent opportunity existed for the licensee to identify its lack of a preventive maintenance schedule to routinely measure SRNI detector gas multiplication factors. Surry Nuclear Power Station entered report number 452589, dated October 27, 2018, and last updated on April 5, 2019, into Institute of Nuclear Power Operations (INPO)

Consolidated Event System (ICES). ICES report 452589 was titled, Unusually Low Reading on Source Range Nuclear Instrument Channel During Shutdown, and described a disparity between SRNI channels with one channel reading significantly lower than expected due to a low gas multiplication factor. The ICES report referenced RRS-VICO-02-326 and the associated recommended testing and trending to identify the low gas multiplication factor.

Corrective Actions: The licensee implemented a repair plan with vendor support to restore the sensitivity of the SRNI N32 detector to an operable condition in WO 40738044, U3 N32 Increase Detector Sensitivity. WO 40738044 increased N32 high voltage detector setting from a nominal 1,500 Volts Direct Current (VDC) to 1,750 VDC. A successful post maintenance test for SRNI N32 was completed on August 24, 2020, during a Unit 3 reactor startup, which invoked TS 3.0.6 to demonstrate SRNI N32 operability by comparing cps levels at six discrete points in the reactor startup sequence and verifying that SRNI N31 and N32 channels did not deviate beyond 1.0 decade.

The licensee also initiated AR 2366359, Apply Multiplication Factor Trends to NI Detector Monitoring. AR 2366359 included actions to replace the SRNI N32 detector during the next refueling outage and to perform multiplication factor trending during the fall 2021 Unit 4 refueling outage for both SRNIs.

Corrective Action References: WO 40738044 and AR 2366359

Performance Assessment:

Performance Deficiency: The licensees failure to implement a preventive maintenance plan consistent with vendor document RRS-VICO-02-326, to ensure the SRNI N32 detector was replaced prior to age-related degradation rendering the instrument inoperable was a performance deficiency.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to establish a preventive maintenance for the SRNIs which rendered a required SRNI N32 inoperable and unable to perform its specified safety function.

Significance: The inspectors assessed the significance of the finding using IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power. Using the screening questions in IMC 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions, section C, Reactor Protection System (RPS), the performance deficiency screened to very low safety significance (Green) because the finding only affected a single RPS trip signal to initiate a reactor trip AND the function of other redundant trips or diverse methods of reactor shutdown (e.g., other automatic RPS trips, alternate rod insertion, or manual reactor trip capacity) was not affected. The redundant channel of the SR High Flux RPS trip was operable and IR Hi Flux and Power Range Low Power High Flux RPS trips were also not affected by the performance deficiency and remained available.

Cross-Cutting Aspect: P.5 - Operating Experience: The organization systematically and effectively collects, evaluates, and implements relevant internal and external operating experience in a timely manner. Specifically, the licensee did not appropriately evaluate the relevancy of the operating experience in ICES report 452589 and recognize their failure to implement vendor recommended testing described in vendor document RRS-VICO-02-326.

Enforcement:

Violation: Unit 3, TS 6.8.1.a, stated in part, that written procedures shall be established, implemented, and maintained covering the activities referenced in the applicable procedures required by the NextEra QATR. NextEra QATR, Appendix B, Procedures, in part stated, NextEra committed to use Appendix A, of Regulatory Guide 1.33, as guidance for establishing the types of procedures that are necessary. Regulatory Guide 1.33, Appendix A, item 9, Procedures for Performing Maintenance, subsection b, stated in part, preventive maintenance schedules should be developed to specify inspection of parts that have a specified lifetime. The SRNI BF3 detectors had a specified lifetime of ten to twenty years.

Contrary to the above, from the beginning of plant operation until this inspection, the licensee failed to establish or implement a preventive maintenance schedule or predictive monitoring program to ensure the SRNI BF3 detectors were replaced prior to the end of their useful life.

Enforcement Action: This violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the Enforcement Policy.

EXIT MEETINGS AND DEBRIEFS

The inspectors verified no proprietary information was retained or documented in this report.

• On September 18, 2020, the inspectors presented the initial special inspection results to Mr. Michael Pearce, Site Vice President (SVP), and other members of the licensee staff.

• On October 30, 2020, the inspectors presented the final special inspection results to Mr. Michael Pearce, SVP, and other members of the licensee staff.

A A

Sequence of Events for Event #1

Turkey Point Unit 3 Event #1 - Manual Reactor Trip on 08/17/2020 Date/Time Description

~2012 The licensee implemented EPU modification at Unit 3. As part of the EPU modification, the TCS runback logic was modified to initiate an automatic turbine runback to a setpoint of 85 percent (Medium Runback) if CV-3-2011, the low pressure feedwater heater bypass control valve, indicated open by 1-out-of-2 valve position limit switches, whenever the turbine was initially operating greater than 88 percent turbine load.

8/17/2020 pre-event plant status Unit 3 was operating at rated thermal power by average power range nuclear instrumentation at a turbine load of 888 MWe. The operators recently completed successful surveillance testing of the 3A emergency diesel generator (EDG), and the engine was being returned to standby alignment. A thunderstorm with heavy rain and lightning was ongoing during the late evening hours.

8/17/2020

~21:08:30 CV-3-2011 spuriously opened resulting in actuating an automatic Medium Runback to a setpoint of 85 percent turbine power per the TCS runback logic circuitry.

The operations crew identified that a Medium Runback occurred with the spurious opening of CV-3-2011 and entered off-normal operating procedure 3-ONOP-089, Turbine Runback.

~21:08:30-21:08:56 During this period the TCS began closing the turbine control valves to the turbine medium runback setpoint and narrow range SG water levels initially lowered from their nominal starting point of 50 percent to around 45 percent. Lowering SG levels resulted in the opening of the feedwater regulating valves to restore level back to program level.

~21:08:56 The automatic turbine runback setpoint was reached, although the runback stopped at ~87 percent versus 85 percent. Also, turbine power did not remain stable at the setpoint, it began to gradually rise and then the turbine runback circuitry actuated again and stopped at ~82 percent turbine power. This cycling around the 82-85 percent turbine power setpoint continued multiple times.

~21:09:15 SG water levels returned to their nominal 50 percent level setpoints but continued to rise.

~21:10:00 The operations crew observed continued unexpected rising SG water levels, especially pronounced were the 3B and 3C SG water levels, that were around 65 percent narrow range level.

~21:10:30 The US directed the operators to take manual control of feedwater regulating valve for SG 3C, which was at ~75 percent level at the time and highest of the three SG.

~21:10:50 With reactor power at ~91 percent, the SM observed that all SG water levels were continuing to rise with the 3C SG narrow range water level reaching ~78 percent. Since an automatic turbine trip occurred at a setpoint of 80 percent level which would result in an automatic reactor trip, the SM directed the operations crew to manually initiate a reactor trip. Following the manual reactor trip, the operations crew entered emergency operating procedure 3-EOP-E-0, Reactor Trip or Safety Injection.

A A

Sequence of Events for Event #1 (Cont.)

~21:12:00 While performing the immediate operator actions associated with procedure 3-EOP-E-0, the operators identified that the position indication lights for valve MOV-3-1432, 3B MSR Main Steam stop valve, was not illuminated. This valve receives an automatic closure signal as part of a turbine trip actuation. Attempts to manually close the valve from the control room were unsuccessful. In accordance with procedure 3-EOP-E-0, the operators took action to close the upstream Main Steam Isolation Valves (MSIVs) in order to isolate all sources of steam from the SGs and prevent an unnecessary RCS cooldown.

~21:12:05 All MSIVs were shut in accordance with 3-EOP-E-0.

~21:15 The operations crew completed the required actions for procedure 3-EOP-E-0 and entered procedure 3-EOP-ES-0.1, Reactor Trip Response, in order to stabilize and control the plant following a reactor trip without a safety injection present. The plant was stabilized in Mode 3 at normal operating temperature and pressure. No further noteworthy plant complications were encountered while completing the actions in procedure 3-EOP-ES-0.1.

~21:57 The operations crew completed the required actions for procedure 3-EOP-ES-0.1 and entered GOP 3-GOP-103, Power Operation to Hot Standby, in order to maintain the plant in Mode 3, conduct plant repairs, and prepare the plant for restart.

Sequence of Events for Event #2

Turkey Point Unit 3 Event #2 - Automatic Reactor Trip on 08/19/2020 Date/Time Description 8/19/2020

~12:19 Reactor startup commenced, SRNI N31 was reading 44 cps and SRNI N32 was reading 36 cps according to plant computer data as determined by the licensees PTR. Plant startup procedure 3-GOP-301, Hot Standby to Power Operation, recorded N31 as the highest reading SRNI at 60 cps for initial count rate in

1. After 12:19

during 2nd or 3rd control rod bank withdrawal The reactor OATC on control rods and RO peer checker identified a disparity between N31 and N32 source count levels and discussed with the reactivity SRO and Unit 3 SRO. SROs discussed with SM and concurred that SRNIs were trending similarly and were operable. The SM provided direction to SROs and ROs to continue to monitor the SRNI behavior. No additional monitoring criteria were discussed.

12:53 Mode 2 entered 13:19 The OATC declared the reactor critical with control rod bank D (CBD) at 83 steps.

~13:22 The Reactivity SRO directed the OATC not to exceed 1.0 dpm SUR and to raise power in the IR to a level at 10-8 amps.

13:24:30 The OATC initiated a continuous 53 step rod pull from CBD 83 to CBD 136. The OATC was still attempting to withdraw control rods at the time of the automatic reactor trip

~13:24:47 SR and IR SURs on PI data reaches 0.7 dpm which was the OATCs intended stop point.

A A

Sequence of Events for Event #2 (Cont.)

~13:24:50 1.0 dpm SR SUR on plant computer data, OATC and all other operators and observers stated they never saw any SUR meters exceed 0.7 dpm which was the OATCs intended control rod withdrawal

~13:24:55 Permissive (P-6) light was received. The third RO had been previously directed to deenergize SRNIs and was standing by to do so. Continuous rod withdrawal was still in progress. Operators may have been distracted by the P6 light and evolution to deenergize SRNIs.

13:25:19 Automatic reactor trip was initiated on N31 SR High flux neutron cps at about 76,660 cps. N32 was reading 814 cps (from PTR). Plant computer data indicated SUR for N31, N35, and N36 was about 3 dpm. N32 SUR was approximately 1.5 dpm. N31 was 89,421 cps and N32 was at 820 cpm per Plant computer data.

8/19/2020 The NRC Senior Resident Inspector (SRI) was informed prior to leaving the control room that N31 was about 80,000 cps and N32 was about 800 cps when the automatic reactor trip occurred.

8/19/2020 The SRI was informed by the SVP that the automatic reactor trip occurred as a result of operator error and that a 45 second/50 step rod withdrawal occurred when the OATC was attempting to establish a SUR less than 1.0 dpm. The SRI stated to the SVP that there was an instrument anomaly issue between the two SRNIs that required explanation.

8/19/2020 21:23 AR 2366002 was originated titled, N31/32 SR Detector Response Disparity.

AR 2366002 was initiated to require reactor engineering to determine and document the acceptability of the disparity in response observed.

8/20/2020 02:45 WO 40737616 was completed to troubleshoot N31/N32/N35/N36 instrument level and SUR indications. No issues were identified. No troubleshooting for detector or cabling was directed to be performed. All troubleshooting was performed at the control room consoles and vertical panels.

~05:00 ORG convened and approved plant restart. The ORG reviewed the plant trip review restart report and discussed the status of plant equipment, including N31 and N32 responses during the August 19, 2020, reactor startup and automatic high flux trip, and human performance enhancements to ensure Unit 3 was ready for restart. Reactor Engineers verbally presented the results of an engineering evaluation performed in response to AR 2366002. The Reactor Engineering evaluation was not provided in advance or during the ORG meeting.

07:37 Unit 3 reactor startup sequence was initiated by withdrawing shutdown bank A.

AR 2366002 did not have a documented immediate operability review by an SRO, but according to the Operations Director (OD), it was reviewed and verbally discussed between the SM and OD. When the SM eventually screened AR 2366002 in NAMS, the SM inadvertently screened AR 2366002 as, not applicable, but intended to screen the N32 low count rate issue compared to N31 as operable but degraded.

A A

Sequence of Events for Event #2 (Cont.)

14:30 NRC Region II and NRR technical staff conferenced to discuss N32 operability.

Region II and NRR technical experts prepared several questions and information requests for the licensee to answer and provide. NRC staff recognized that Unit 3 had returned to Mode 1 and SRNI operability was not applicable in Mode 1.

However, the NRC staff intended to challenge the licensee on its assessment of the operability of SRNI N32 as soon as possible in case of an unplanned shutdown and Mode 3 entry that required two SRNIs be operable in accordance with TS 3.3.1, Reactor Trip System Instrumentation.

8/20/2020 An off-shift SRO recognized that AR 2366002 did not receive an immediate operability determination and was screened as not applicable. The off-shift SRO initiated AR 2366093, Potential Inoperability of N31 [32], and notified the control room operators of the concern.

23:59 Unit 3 was manually tripped and stabilized in Mode 3, Hot Standby. TSs required two SRNIs be operable in accordance with TS 3.3.1, Reactor Trip System Instrumentation.

8/21/2020 AR 2366002 operability notes changed from not applicable to operable but degraded and a prompt operability determination was scheduled to complete at 2300 on 8/21/2020.

8/21/2020 14:11 NRC Resident Inspectors provided questions and information requests to the licensee that challenged N32 operability and requested those answers be provided prior to the next Unit 3 reactor startup.

8/22/2020 AR 2366002 Prompt Operability Determination was completed and associated with AR 2366093. The conclusion was N32 would not have been able to perform its safety function and was made after vendor support countered the original reactor engineering evaluation and suspected that the order of magnitude of the sensitivity disparity between the SR channels was larger than previously documented and appeared to be increasing over time.

8/22/2020 00:17 Control room operators declared N32 inoperable.

8/24/2020 The licensee implemented a repair plan with vendor support to restore the sensitivity of the SRNI N32 detector to an operable condition in WO 40738044, U3 N32 Increase Detector Sensitivity. WO 40738044 increased N32 high voltage detector setting from a nominal 1,500 VDC to 1,750 VDC. A successful post maintenance test for N32 was completed on August 24, 2020, during a Unit 3 reactor startup and invoking TS 3.0.6 to demonstrate N32 operability by comparing its cps level at six discrete points in the reactor startup sequence and verifying that N31 and N32 channels did not deviate beyond 1.0 dpm.

8/24/2020 The licensee initiated AR 2366359, Apply Multiplication Factor Trends to NI Detector Monitoring. AR 2366359 included actions to replace the N32 detector during the next refueling outage and to perform multiplication factor trending during the fall 2021 Unit 4 refueling outage for both Unit 4 SRNIs.

A A

Sequence of Events for Event #3

Turkey Point Unit 3 Event #3 - Manual Reactor Trip on 08/20/2020 Date/Time Description 08/20/2020 07:52 Unit 3 reactor was critical 08/20/2020 15:30 Unit 3 entered Mode 1 08/20/2020 19:23 The operating crew received a Distributed Control System (DCS) Secondary Trouble Alarm and checked the ARP, 3-ARP-097-CR.D, Control Room Response - Panel D. An operator navigated to step A to the DCS Secondary Trouble page that identified the 3A/3B/3C/3D MSR, 3A RHDT, and 3A/3B HDT controllers were in manual instead of automatic.

Operators restored Level Control Valves for 3A/3B/3C/3D MSR, 3A RHDT, and 3A/3B HDT to Automatic Control on DCS to support Unit 3 going online.

08/20/2020 23:53 When reactor power was 34 percent, operators noted lowering SG water level below program band of 50 percent and the feedwater regulating valves demand was higher than the expected 60 percent.

08/20/2020 23:54 The operating crew took manual control of the feedwater regulating valves and opened the valves. SG level continued to lower.

08/20/2020 23:54

The operating crew received a SG C Level Deviation / Cntrl Trouble alarm at 40 percent level. The operating crew followed the ARP to open FCV-3-499, FW Bypass Valve, and take manual control of the feedwater controller to maintain SG level. The 3C SG level was stabilized at 35 percent.

08/20/2020 23:55 The operating crew discovered the feedwater recirculation master controller was in manual and all three recirculation valves were fully open. The SM directed the operator to close the recirculation valves. The master control was selected in manual and demanded closure of the feedwater recirculation valves.

08/20/2020 23:55

The feedwater recirculation valves were closed from 100 percent to 60 percent.

Due to the lowering of feedwater pump suction pressure, the 3B SGFP tripped on low suction pressure (220 psig).

08/20/2020 23:58 The SM directed the operators to insert a manual reactor trip due to the loss of the only running SGFP.

08/20/2020 23:59 Unit 3 reactor trip occurred.

08/20/2020 23:59 Auxiliary Feedwater (AFW) auto started and provided feedwater to the SGs as expected.

08/20/2020 23:59 Due to lowering RCS T-average and pressurizer level, the MSIVs were closed to limit the cooldown 08/21/2020 00:02 SG level continued to rise until AFW flow was reduced by the operators to control level.

B B

B-1

August 28, 2020

MEMORANDUM TO:

John Zeiler, Senior Resident Inspector, Team Lead

Projects Branch 4

Division of Reactor Projects

FROM:

Laura A. Dudes /RA/

Regional Administrator

SUBJECT:

SPECIAL INSPECTION CHARTER TO EVALUATE PLANT

PERFORMANCE DURING MULTIPLE REACTOR TRIPS AT

TURKEY POINT NUCLEAR POWER STATION

You have been selected to conduct a Special Inspection (SI) to assess the circumstances surrounding three reactor trips that occurred at Turkey Point Unit 3 on August 17, August 19; and August 20, 2020.

A. Background

During the week of August 17, 2020, Turkey Point Unit 3 experienced three reactor trips, one of which was automatically initiated by the reactor protection system and two were the result of plant operators taking action to manually trip the reactor. The first trip, manually initiated by plant operators, occurred on August 17, 2020, at 2113 from approximately 92 percent power in response to rising steam generator water levels that approached the automatic turbine trip setpoint. The second trip was automatically initiated by the plants reactor protection system and occurred on August 19, 2020, at 1324. Specifically, the source range nuclear instrument (SRNI) N31 sensed a high neutron flux condition and initiated the trip during reactor startup. The third trip, manually initiated by plant operators, occurred on August 20, 2020, at 2354 from approximately 35 percent power in response to the loss of the single operating steam generator feedwater pump (SGFP).

Management Directive (MD) 8.3, NRC Incident Investigation Program, and Inspection Manual Chapter 0309, Reactive Inspection Decision Basis for Reactors, directs staff to provide a detailed list of deterministic criteria that can be used on their own or in conjunction with a probabilistic risk assessment as a basis for decision making when considering a Special Inspection (SI) following a significant operational event. In the case of the Turkey Point unit 3 reactor trips that occurred during the week of August 17, 2020, operational performance, equipment performance and licensee decision making was deemed to meet the deterministic-only criteria specified in enclosure 2 of MD 8.3. As a result, Region II decided to initiate an Sl.

CONTACT:

Randall Musser, RII/DRP (404) 997-4603 B

B B-2 B. Scope

The Special Inspection Team (Team) will review the causes of the events, and Turkey Points organizational and operator responses to the events. The Team will perform interviews to understand the scope of operator actions performed during the events.

To accomplish these objectives, the Team will:

1. Review the circumstances leading up to the events on August 17, 2020, August 19,

2020, and August 20, 2020, and develop a Sequence of Events leading up to the incidents and the actions taken by Turkey Point to date to address issues raised by the events;

2. For each event, review and assess crew operator performance and crew decision

making, including their adherence to procedures, expected roles and responsibilities, including reactivity management by the operators, reactivity management plans provided by nuclear engineering, the command and control function associated with reactivity manipulations, the use of procedures, log keeping, and overall communications;

3. Review the adequacy of just-in-time training and licensed operator startup certification

training as it relates to reactivity control;

4. Evaluate the extent of condition for identified issues with respect to the other operating

crews;

5. Review and assess the effectiveness of the licensees response to these events and

corrective actions taken to date;

6. Review and evaluate the actions and reviews taken by the licensee prior to authorization

for each restart of Turkey Point Unit 3, including the effectiveness of the Onsite Review Group;

7. Assess the decision making and actions taken by the licensees personnel to determine

if there are any implications related to schedule pressure or the site's safety culture;

9. Evaluate equipment reliability and configuration control for the systems that were

challenged during the trips which occurred on August 17 and August 20, considering the relationship with the Extended Power Uprate (EPU) with additional focus on EPU single point trip vulnerability.

10. Conduct an entrance and exit meeting; and

11. Document the inspection findings and conclusions in a Special Inspection Team final report within 45 days of inspection completion.

B B

B-3 C. Guidance

Inspection Procedure (IP) 93812, Special Inspection Team, provides additional guidance to be used during the conduct of the inspection. Your duties will be as described in IP 93812 and should emphasize fact-finding in its review of the circumstances surrounding the events. Safety concerns identified that are not directly related to the event should be reported to the Region II office for appropriate action. You will conduct an entrance and begin inspection no later than August 31, 2020. Decisions regarding whether and what activities need to be performed onsite will take into account concerns related to COVID-19.

Discuss any planned onsite activities with regional management before proceeding.

It is anticipated that the on-site portion of the inspection will be completed during the same week. An initial briefing to Region II management will be provided at approximately 4:00 p.m., August 31, 2020. In accordance with IP 93812, you should promptly recommend a change in inspection scope or escalation if information indicates that the assumptions used in the MD 8.3 analysis were not accurate. If, during your investigation you identify matters that involve potential wrongdoing on the part of licensee employees or licensee contract employees, you are reminded to follow the guidance in MD 8.8, Management of Allegations. At the completion of the inspection you should provide recommendations for improving the Reactive Inspection (RI) process based on any lessons learned.

This charter may be modified should you develop significant new information that warrants review.

ADAMS ACCESSION NUMBER:ML20241A055 OFFIC RII:DRPRP RII:DRP RII:ORA

NAME R. Musser M. Miller L. Dudes

DATE 8/27/2020 8/27/2020 8/28/2020 C

C C-1 IMC 0609 Appendix M, Significance Determination Process Using Qualitative Criteria (ADAMS Accession No. ML18183A043)

EXHIBIT 1 - Results of the Initial Evaluation

1. Describe the influential assumptions used in the initial evaluation. Because the performance

deficiency involved errors of commission and involved multiple errors by an entire crew of licensed operators, it was assumed that time critical operator actions will have some level of dependency to the original error. SPAR-H and THERP would treat all of these Human Error Probabilities (HEPs) as being completely dependent due to the same crew, in the same spot, in a very short time frame, with mostly the same cues, must diagnose the plant conditions in order to take the required actions. This assumption was overly conservative.

Using Appendix M allows an opportunity to make more realistic assumptions with respect to operator actions.

Additionally the normal 100 percent power models, used by both the licensee and SPAR models, do not accurately capture the unique nature of a SR Continuous Rod Withdrawal Casualty (No temperature moderation, more positive moderator temperature coefficient, Xenon not at equilibrium since less than 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> since shutdown, system designed to mitigate an ATWS were not in service such as AMSAC and ESFAS, and minimal decay heat loading, and AFW system already being in service for startup.) The licensee and SRA developed a Low Power Model of this event using WCAP-15381-NP-A revision 2, WOG Risk-Informed ATWS Assessment and Licensing Implementation Process, (ADAMS Accession No. ML072550560). This methodology addressed dependency of operator actions and the unique equipment line up.

A modified Initiating events risk assessment approach was being proposed for use in this case vice a conditional assessment as this event was centered around the performance of a single crew of operators during a normal start up evolution. The unaffected base case sequences for an ATWS were subtracted from the conditional case (Where HEPs were adjusted for dependency and influence of the performance deficiency.) This ensured the change in risk due to the performance deficiency was accurately illustrated.

1) Dummy IEV, Operator Action for Reactivity Management Causes Source Range High Flux set point to be reached was set to 1.0 2) All other IEs were set to False.

3) Since a reactor startup was in progress per 3-GOP-301, Hot Standby to Power Operation, Rev. 53, the following equipment was in service: Both Primary PORVs were in service and unblocked, the motor driven start up feedwater pump (a credited AFW source) was in service and lined up to feed both Steam Generators. Therefore the Basic Events PPR-MOV-FC-535, PORV 1 (PCV-456) BLOCK VALVE 535 CLOSED DURING POWER, and PPR-MOV-FC-536, PORV 2 (PCV-455A) BLOCK VALVE 536 CLOSED DURING POWER were set to FALSE since the valves were open, and AFW-XHE-XM-START, OPERATOR FAILS TO START AFW GIVEN NO SIGNAL was set to FALSE since AFW was already in service.

4) Operator Actions RPS-XHE-XM-OAMG, Operators fail to manually trip reactor by opening breakers to MG set, and OAMG-XE-BRKLOC, Operators fail to open RPS trip breakers locally were not considered dependent on the performance deficiency since they only performed if RPS trip Breakers fail mechanically and diagnosis was implied on that path.

C C

C-2 5) Operator Action OAMG-XE-CRIN, Operators failed to manually insert control rods for 60 secs, can occur during all paths even without diagnosis as the next major cue the operator will get was power in the IR reaching 10-8 amps and the order 3-GOP-301 was to level power at 10-8 amps. The HEP would have to be adjusted to account for fact operator would have to be monitoring IR power levels which was affected by the performance deficiency (but operator does not have to recognize an RPS failure has occurred.)

6) RPS-XHE-XE-NSIGNL, Operators manually trip reactor with RPS failure and no RPS signal present was Set to TRUE for all Conditional Cases. The same operators would have to diagnose the same cues, in the same location and recognize an RPS action did not occur. SPAR-H and THERP tools would determine this action was completely dependent upon the original human performance error.

7) Operator Actions RPS-XHE-XE-SIGN, Operators manually trip reactor with RPS failure and RPS signal present, CVC-XHE-XM-BORATION, Operator fails to initiate emergency boratian and OAMG-XE-CRIN, Operators fail to manually insert control rods for 60 secs, were not assumed to be completely dependent to the original error due to the additional cues and additional time for the operators to take those actions despite the SPAR-H and THERP guidance. These HEPs were varied from Nominal to True using the human error tools discussed in order to develop the conditional cases presented below.

8) All rod motion was assumed to stop at the time the RPS actuation did or should have occurred. If RPS failed and the operator continued to withdraw control rods, there would be less time available and HEPs would have to be adjusted to reflect this. The conditional cases performed for sensitivity would address this fact.

2. Provide sensitivity results on the key influential assumptions. The uncertainty associated

with the HEPs interrelation and magnitude of adjustments creates some degree of sensitivity so multiple cases were being presented around the most representative case as part of the quantitative section of the Appendix M worksheet. Four HEPs were adjusted from Nominal to 1.0 using multiple approaches to develop a sensitivity. SPAR-H and THERP dependency principles, use of the IDHEAS-ECA human reliability calculator tool developed by NRC Research, the guidance in the WCAP, and analysis judgement. The Operators failing to initiate Emergency Boration HEP was the most sensitive. The conditional case table attached illustrates these sensitivities.

3. Identify any information gaps in defining the influential assumptions used in the initial

evaluation. The human factors presented several problems. The same operating crew must properly diagnose the condition using many of the same cues within a relatively short time period. However, the large number of observers and operators on shift does make it more likely that someone would diagnose the ATWS before power reached the Power Range and direct action to be taken. Since the operator response times were based off an ATWS from 100 percent power, the crew would have had additional time available.

To account for this the immediate actions by the operator were treated separately from emergency boration when performing the sensitivities.

Initial Evaluation Result: 3.95E-7.

C C

C-3 EXHIBIT 2 - Considerations for Evaluation of Decision Attributes

Table 1 - Qualitative Decision-Making Attributes for NRC Management Review

Decision Attribute

Basis for Input to Decision - Provide qualitative and/or quantitative information for management review and decision making.

Defense-in-Depth Degraded by PD. Operators actions were credited to backup RPS and trip the plant and to Emergency Borate in order to prevent core damage in some accident sequences.

PD also affect probability of future human errors since the follow up operator actions were dependent on the original PD human error. (Note: Factor is accounted for in the SPAR models as existing HEPs)

Safety Margin RPS has 3 levels of protection for a continuous rod withdrawal casualty, SR Hi Flux, IR Hi Flux, and Power Range Low Range Hi Flux trips. Both SR and IR trips only require one trip signal of two available channels to cause a scram. The accident analysis does not credit operator action for this event. Overall change in safety margin was minimal. Note: the accident analysis was not required to consider an RPS Failure/ATWS at that time.

Extent of Condition None. Inspectors concluded this PD was specific to this crew and these specific circumstances.

Degree of Degradation Entire crew and observers present failed to diagnose the condition prior to the scram.

Not limited to one operator. Same crew would have to diagnose and take required operator actions as plant conditions changed.

Group think was observed by this organization with respect to the operability of the SRNI N32 the following day, so it cannot be ruled out. However, given the number of additional cues which would present themselves as the event progressed (power entering IR and PR, PORVs Lifting, steaming to condenser, AFW flows increasing) it was likely to break the dependency particularly later in the event given the number of crew and observers present. (Note: this factor was represented in the SPAR model through the HEP adjustments considering dependency.)

C C

C-4 Exposure Time Limited to this reactor startup. Not believed to be a generic negative training issue among operators.

Recovery Actions Recovery would require operators diagnosing the condition. The milestone the crew was looking for was 10-8 amps in the IR. It would be expected that this cue would cause the operator to stop shimming out and shim rods in to attempt to level power (arresting the CRW) and draw attention to other plant parameter including SUR. Diagnosis of an ATWS should be clearly obvious and credited operator actions directed and taken (IE attempt to manually trip the reactor, initiate auxiliary feedwater and emergency boration.)

As additional cues become available, and with the crew size and number of observers, the probability of diagnosing the condition increases. Recovery actions could still be performed, from the control room and provide mitigation even if performed late.

(Note: The quantitative review conservatively did not consider recovery.)

Additional Qualitative Considerations SUR NI 32 was inoperable and SR SUR indication for N32 was lagging N31 and IR SUR channels N35 and N36. This false indication may have confused operators but even N32 SUR was <1.5 DPM at the time of the scram and would help diagnosis. Note:

this factor was considered using the HEP tool IHDEAS-ECA.)

The SR N32 Instrument Channel was functional and would eventually have processed a Hi Flux Scram, albeit in a untimely manner (Approximately 60+

seconds late).

C C

C-5 While this event certainly warranted a reactive inspection via the IMC 0309, Reactive Inspection Decision Basis for Reactors, (ADAMS Accession No. ML111801157), and MD 8.3 processes, quantitative tools were developed and identified to address the wide range of uncertainty and better model the specifics of this event. The representative case has a CCDP of 3.95E-7 which was consistent with the results the licensee developed (once modeling differences were resolved.) The methodology used has been reviewed by the NRC and a Safety Evaluation Report (SER) was developed, (Final Safety Evaluation for Pressurized Water Reactor Owners Group (PWROG) Topical Report (TR) WCAP-15831-P, Revision 1, "WOG Risk-Informed ATWS Assessment and Licensing Implementation Process" (TAC NO. MB5741)

(ADAMS Accession No. ML070880469), dated May 8, 2007).

Taking the qualitative factors into account, the SRA compared this event with four other reactivity management events, most of which used, Appendix M; respectively, (with SDP):

Millstone (White), Pilgrim (White), Callaway (Green) and Oyster Creek (Green). In each event, operators failed to adequately monitor key reactor plant parameters during reactivity additions and involved multiple members of the operating crew. The events where positive reactivity was being added to the core by the operators were considered more significant.

1)

The Millstone example sets a particularly high bar. Operators defeated an automatic RPS trip 4 times during the event and were independently adding multiple sources of both positive and negative reactivity simultaneously. Since this operator action reduced defense in depth in addition to initiating the event, this event was clearly more significant than Turkey Points event.

2)

The Pilgrim example; the reactivity control team was operating independently with respect to inserting and withdrawing control rods to control heat up rate. They did not consult with reactor engineering and did not have any direct oversight by the SROs or Shift Manager.

They inadvertently drove the reactor subcritical and then did not account for changes in temperature when restoring rods to their original positions. It was discovered that this knowledge gap was not isolated to one crew. It should be noted there was no quantitative analysis to balance this evaluation. The underlying Turkey Point event was much more significant but based upon the qualitative factors alone Pilgrim was more significant due to multiple errors, more widespread extent of condition, and not engaging oversite or support.

3)

The Callaway example was less significant than Turkey Points event since in the Callaway event no positive reactivity was being added, operators were distracted by other indications and stopped in the startup procedure.

4)

The Oyster Creek example was similar to Callaways in that operators stopped in the shutdown procedure and had two re-criticality events due to plant cool down. Operators were aware of the condition and ranged up IR Channels. Turkey Point was more significant in that positive reactivity was being added and the Oyster Creek event did not result in a transient.

The analyst also considered the fact that IMC 0609, Appendix M, has been revised since 2011 and more human performance evaluation tools were available. If the new tools and procedures were applied to the Pilgrim case, it was the analysts opinion that Pilgrim would be characterized as a Green while Millstone would remain a White. This was based upon the emphasis in section I of the worksheet to consider the best available quantitative review of the event with uncertainties and consider that along with qualitative factors. For the Pilgrim case, the trip occurred in the IR due to multiple channels over ranging and the reactor was above the POAH.

Any reactivity mismatch would be self-corrected by temperature feedback without any actions required. Even if RPS had failed, thermal limits would not have been challenged.

C C

C-6 While in the Millstone event, operators actively defeated RPS, a level of defense in depth designed to mitigate the condition seen, as well as mismanage reactivity. Additionally, this was an act of commission which the PRA models do not account for and HRA tools still cannot accurately quantify.

Based on these factors, the qualitative factors in the Turkey Point case did not justify escalating the findings significance an order of magnitude above the quantitative evaluation results.

Conclusion:

Considering both the quantitative and qualitative factor involved and comparing this case to past precedence, the SRA recommended characterizing this PD as very low safety significance (Green) based upon the quantitative factors and using qualitative factors to address sensitivity.

DOCUMENTS REVIEWED

D

D

D-1

Inspection

Procedure

Type

Designation

Description or Title

Revision or

Date

93812

Calculations

CN-CPS-09-67

Steam Generator Water Level Analysis for the Turkey Point

Units 3 and 4 Extended Power Uprate

Rev. 0

CN-PCSA-12-10

Steam Generator Water Level Analysis to Support Feedwater

Control System Tuning at EPU Conditions for Turkey Point 3

Rev. 0

PTN-BSHM-08-011

Feedwater & Condensate System Equipment Selection,

Performance Evaluation, and Operation Transients Review

Rev. 3

Corrective

Action

Documents

AR 2299046

Slow Response from FCV-3-478 during Unit 3 Manual Runback

1/23/2019

AR 2365707

Indicating lights lost during reactor trip

8/17/2020

AR 2365708

CV-3-2011 valve failed open

8/17/2020

AR 2365714

3B and 3C feedwater regulating valves slow to respond during

turbine runback

8/18/2020

AR 2365716

Unit 3 reactor manually tripped

8/18/2020

AR 2365716

PTR Restart Report - Unit 3 Manual Reactor Trip for CV-3-2011

Failed Open

8/17/2020

AR 2365717

Unexpected response during turbine runback in TCS

8/18/2020

AR 2365722

Low pressure turbine reheat intercept valve 3-10-012 has bad

indication

8/18/2020

AR 2365723

Low pressure turbine reheat stop valve 3-10-015 has bad

indication

8/18/2020

AR 2365970

PTR Restart Report - Unit 3 Automatic Trip on Source Range

High Flux N31

8/19/2020

AR 2366158

PTR Restart Report - Unit 3 Manual Reactor Trip on Loss of Las

Feed Pump

8/20/2020

PCR 2366174

GOP-301 procedure changes to check controllers in Auto

8/21/2020

Drawings

5613-M-3074

Feedwater System PI&D

Rev. 36

Engineering

Changes

EC-246849

Turbine Digital Control System

Rev. 1

EC-246870

Design Change Package Description: Feedwater Regulating

Valve Upgrade

Rev. 8

EC-246935

Main Feedwater Pump Rotating Assembly Replacement -

Extended Power Uprate

Rev. 3

EC-295196

Temporary Modification Change: Disable Unit 3 Medium

Runback on CV-3-2011

Rev. 0

DOCUMENTS REVIEWED

D

D

D-2

Inspection

Procedure

Type

Designation

Description or Title

Revision or

Date

93812

Miscellaneous

ORG Agenda/Meeting Number 20-028: Unit 3 Post Trip Review

(Event on 08/19/20)

8/20/2020

ORG Agenda/Meeting Number 20-029: Disable Unit 3 Medium

Runback on CV-3-2011 Opening

8/20/2020

ORG Agenda/Meeting Number 20-030: U3 Manual Reactor Trip - Loss of last Feed Pump (3B SGFP Tripped)

8/26/2020

ORG Agenda/Meeting Number 20-027: Unit 3 Post Trip Review

(Event on 08/17/2020)

8/19/2020

JIT Training

Just in Time Training documents related to Events #1 - #3

8/18/2020-

8/20/2020

Operator Logs

Unit 3 operator logs between 08/16/2020 - 08/26/2020

Procedures

3-ARP-097.CR.C

Annunciator Response Procedure Control Room Response -

Panel C

Rev. 8

3-ARP-097.CR.D

Annunciator Response Procedure Control Room Response -

Panel D

Rev. 21

3-EOP-E-0

Reactor Trip or Safety Injection

Rev. 16

3-EOP-ES-0.1

Reactor Trip Response

Rev. 16

3-GOP-103

Power Operation to Hot Standby

Rev. 31A

3-GOP-301

Hot Standby to Power Operations, completed for 8-19-20

startup

Rev. 53

3-ONOP-089

Turbine Runback

Revs. 3, 4

EN-AA-205-1100

Design Change Packages

Rev. 4

ENG-QI-1.5

Calculations

Rev. 12

LI-AA-1000

On-Site Review Group

Rev. 14

OP-AA-1000

Conduct of Infrequently Performed Tests or Evolutions

Rev. 16

Work Orders

40629402

FCV-3-498 SG C main feedwater flow control valve link test

11/04/2018

40649557

FCV-3-498 slow response (runback) - install valve link laptop

3/12/2019

40657590

Boroscope inspect feedwater piping with valve FCV-3-478 out of

service

4/05/2020

40737414

Investigate CV-3-2011 valve failed open

8/17/2020

40737415

MOV-3-1432 indicating lights lost during 8/17/20 manual reactor trip event

8/17/2020

LIST OF ACRONYMS

E

E

E-1

ADAMS

Agencywide Documents Access and Management System

AFW

Auxiliary Feedwater

AMSAC

ATWS Mitigating System Actuation Circuitry

AR

Action Request

ARP

Alarm Response Procedure

ATWS

Anticipated Transient Without Scram

BF3

Boron Trifluoride

CAP

Corrective Action Program

CBD

Control Rod Bank D

CCDP

Conditional Core Damage Probability

cps

Counts Per Second

DCS

Distributed Control System

dpm

Decade Per Minute

ECC

Estimated Critical Configuration

ECP

Employee Concerns Program

EDG

Emergency Diesel Generator

EOP

Emergency Operating Procedure

EPU

Extended Power Uprate

ESFAS

Engineered Safety Features Actuation System

FIN

Finding

FMEA

Failure Modes and Effects Analysis

GOP

General Operating Procedure

HDT

Heater Drain Tank

HEP

Human Error Probabilities

ICES

INPO Consolidated Event System

IMC

Inspection Manual Chapter

INL

Idaho National Laboratory

INPO

Institute of Nuclear Power Operations

IP

Inspection Procedure

IR

Intermediate Range

IRNI

Intermediate Range Nuclear Instrument

I&C

Instrumentation and Control

JIT

Just-in-Time

LCO

Limiting Condition for Operation

LER

Licensee Event Report

MD

Management Directive

MSIV

Main Steam Isolation Valve

MSR

Moisture Separator Reheater

MW

Megawatts

MWe

Megawatts Electric

NAMS

Nuclear Assets Management System

NCV

Non-Cited Violation

NPP

Not Present Performance

NRC

Nuclear Regulatory Commission

NRR

Office of Nuclear Reactor Regulation

NSCMP

Nuclear Safety Culture Monitoring Panel

OATC

Operator at the Controls

OCC

Outage Control Center

OD

Operations Director

OP

Operating Procedure

ORG

Onsite Review Group

LIST OF ACRONYMS

E

E

E-2

P-6

Source Range Block Permissive

pcm

Percent Mille

PD

Performance Deficiency

POAH

Point of Adding Heat

PORV

Power-Operated Relief Valve

PRA

Probabilistic Risk Analysis

PTR

Post Trip Report

PWROG Pressurized Water Reactor Owners Group

QATR

Quality Assurance Topical Report

RCS

Reactor Coolant System

RHDT

Reheater Drain Tank

RO

Reactor Operator

RPS

Reactor Protection System

SDP

Significance Determination Process

SER

Safety Evaluation Report

SERP

Significance and Enforcement Review Panel

SG

Steam Generator

SGFP

Steam Generator Feedwater Pump

SI

Special Inspection

SIT

Special Inspection Team

SLT

Site Leadership Team

SM

Shift Manager

SOER

Significant Operating Experience Report

SPAR

Simplified Plant Analysis Risk

SR

Source Range

SRA

Senior Risk Analyst

SRI

Senior resident inspector

SRNI

Source Range Nuclear Instrument

SRO

Senior Reactor Operator

SUR

Startup Rate

SVP

Site Vice President

TCS

Turbine Control System

TS

Technical Specification

US

Unit Supervisor

VDC

Volts Direct Current

WO

Work Order

1/M

Inverse Count Rate