IR 05000293/2017007

Design Bases Assurance Inspection Report 05000293/2017007

ML17271A077
Person / Time
Site:	Pilgrim
Issue date:	09/28/2017
From:	Mel Gray Engineering Region 1 Branch 1
To:	Brian Sullivan Entergy Nuclear Operations
Gray M
References
IR 2017007
Download: ML17271A077 (28)

Text

[Type here]

UNITED STATES NUCLEAR REGULATORY COMMISSION

REGION I

2100 RENAISSANCE BLVD.

KING OF PRUSSIA, PA 19406-2713 September 28, 2017 Mr. Brian Sullivan Site Vice President Entergy Nuclear Operations, Inc.

Pilgrim Nuclear Power Station 600 Rocky Hill Road Plymouth, MA 02360-5508 SUBJECT: PILGRIM NUCLEAR POWER STATION - DESIGN BASES ASSURANCE INSPECTION REPORT 05000293/2017007

Dear Mr. Sullivan:

On August 17, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Pilgrim Nuclear Power Station (PNPS) and discussed the inspection results with Mr. D. Noyes, Acting Site Vice President, and other members of your staff. The results of this inspection are documented in the enclosed report.

In conducting the inspection, the team examined the adequacy of selected components and modifications to mitigate postulated transients or accidents, maintain containment integrity, and/or minimize the potential for initiating events. The inspection involved field walkdowns, examination of selected procedures, calculations and records, and interviews with station personnel.

NRC inspectors documented two findings of very low safety significance (Green) in this report.

Both of these findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCV) consistent with Section 2.3.2.a of the NRCs Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region I; the Director, Office of Enforcement; and the NRC Senior Resident Inspector at PNPS.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region I; and the NRC Senior Resident Inspector at PNPS. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Mel Gray, Chief Engineering Branch 1 Division of Reactor Safety Docket No. 50-293 License No. DPR-35

Enclosure:

Inspection Report 05000293/2017007 w/Attachment: Supplementary Information

REGION I==

Docket No. 50-293 License No. DPR-35 Report No. 05000293/2017007 Licensee: Entergy Nuclear Operations, Inc. (Entergy)

Facility: Pilgrim Nuclear Power Station (PNPS)

Location: 600 Rocky Hill Road Plymouth, MA 02360 Dates: July 31 through August 17, 2017 Inspectors: S. Pindale, Senior Reactor Inspector, Division of Reactor Safety (DRS),

Team Leader J. Ayala, Reactor Inspector, DRS N. Floyd, Reactor Inspector, DRS M. Orr, Reactor Inspector, DRS M. Yeminy, NRC Mechanical Contractor S. Kobylarz, NRC Electrical Contractor Approved By: Mel Gray, Chief Engineering Branch 1 Division of Reactor Safety Enclosure

SUMMARY

IR 05000293/2017007; 07/31/2017 - 08/17/2017; Pilgrim Nuclear Power Station; Engineering

Team Inspection.

The report covers the Design Basis Assurance Inspection conducted by a team of four U.S. Nuclear Regulatory Commission (NRC) inspectors and two NRC contractors. Two findings of very low safety significance were identified. The significance of most inspection findings is indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) and determined using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP),

dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310, Aspects Within the Cross-Cutting Areas, dated December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated November 1, 2016. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 6, dated July 2016.

Cornerstone: Mitigating Systems

Green.

The team identified a finding of very low safety significance (Green) involving a non-cited violation (NCV) of Title 10 of the Code of Federal Regulations (10 CFR) Part 50,

Appendix B, Criterion III, Design Control, in that Entergy did not translate the design basis limit for nil ductility transition (NDT) temperature into plant procedures. Specifically, Entergy specified in their procedures and tank heating setpoint calculation the low temperature limit for the two condensate storage tanks (CSTs) to be a non-conservative value, because it was based on the concern of CST freezing rather than the more limiting material service temperature of the downstream safety-related piping. In response, Entergy staff evaluated and confirmed current operability of the CST, and planned to evaluate and revise the affected procedures and tank heating setpoint calculation.

This finding was more than minor because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Specifically, the minimum CST temperature value stated in procedures, based on an incorrect tank freezing assumption, could potentially result in not providing the full margin of protection against brittle fracture behavior in safety-related piping leading to the reactor vessel. In accordance with IMC 0609.04, Initial Characterization of Findings, and Exhibit 2 of IMC 0609, Appendix A, The SDP for Findings At-Power, the team determined the issue screened as having very low safety significance (Green) because it did not represent an actual loss of safety function of the system or train, did not result in the loss of one or more trains of non-technical specification (TS) equipment, and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.1.4)

Green.

The team identified a finding of very low safety significance (Green) involving an NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, in that Entergy did not adequately verify that the emergency diesel generator (EDG) under-frequency alarm setpoint was in accordance with design basis requirements. Specifically, the EDG under-frequency alarm was set at a value less than the prescribed industry standard to protect equipment, and station procedures did not contain instructions to address the EDG under-frequency condition. In response, Entergy staff evaluated and confirmed current EDG operability and initiated actions to correct the under-frequency range in the alarm setpoint and to provide appropriate operator response guidance in operating procedures.

This finding was more than minor because it was associated with the design control attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with IMC 0609.04, Initial Characterization of Findings, and Exhibit 2 of IMC 0609, Appendix A, The SDP for Findings At-Power, the team determined that this finding was of very low safety significance (Green) because it was a design deficiency confirmed not to result in the loss of operability or functionality. The team determined that this finding had a cross-cutting aspect in the area of Human Performance, Avoid Complacency, because Entergy did not plan for the possibility of latent issues while processing a plant modification where the bases for EDG alarm functions were incorrect. [H.12] (Section 1R21.2.2.1)

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R21 Design Basis Assurance Inspection

.1 Inspection Sample Selection Process

The team selected six risk significant components for review using information contained in the PNPS Probabilistic Risk Assessment and the NRCs Standardized Plant Analysis Risk model for PNPS. Additionally, the team referenced the Risk-Informed Inspection Notebook for PNPS in the selection of potential components for review. In general, the selection process focused on components that had a risk achievement worth factor greater than 1.3 or a risk reduction worth factor greater than 1.005. The components selected were associated with both safety-related and non-safety-related systems and included a variety of components such as pumps, transformers, electrical busses, and valves. Manual operator actions were also considered.

The team also selected six modifications that potentially affected the design or licensing basis of the plant; or affected the performance capability of the associated structures, systems, and components. The team selected modifications completed in the last three years that had not been previously inspected by an NRC modification team using Inspection Procedure 71111.17T. The team selected modifications that were performed on risk significant components that were associated with the Initiating Events, Mitigating Systems, or Barrier Integrity cornerstones. The team selected a sample of electrical and mechanical modifications. Additionally, the complexity of the modification was considered in selecting the modifications reviewed.

The team initially compiled a list of components based on the risk factors previously mentioned and risk significant modifications that had been completed. Additionally, the team reviewed the previous Component Design Bases Inspection and Evaluations of Changes, Tests, or Experiments and Permanent Plant Modifications inspection reports.

The team then performed an assessment to narrow the focus of the inspection to six components, six modifications, and two operating experience (OE) items. The team selected two samples based on large early release frequency implications. The teams assessment evaluated the possibility of low design margin, and considered original design issues, margin reductions due to modifications, or margin reductions identified as a result of material condition/equipment reliability issues. The assessment also included items such as failed performance test results, corrective action history, repeated maintenance, Maintenance Rule (a)(1) status, operability reviews for degraded conditions, NRC resident inspector insights, and industry OE. Finally, consideration was given to the uniqueness and complexity of the design and the available defense-in-depth margins.

The inspection performed by the team was conducted as outlined in NRC Inspection Procedure 71111.21M, Design Bases Assurance Inspection (Teams). This inspection effort included walkdowns of selected components and modifications; interviews with operators, system engineers, and design engineers; and reviews of associated design documents and calculations to assess the adequacy of the components to meet design basis, licensing basis and risk-informed beyond design basis requirements.

Additionally, for the modification portion of the inspection, the team determined whether the modifications were adequately implemented; and that procedures and design and license basis documentation affected by modification had been adequately updated to reflect any changes to the design or license basis of the facility. The team verified that any changes to the design and/or licensing bases had been performed in accordance with NRC guidance and regulations.

Summaries of the reviews performed for each component, modification, and OE sample are discussed in the subsequent sections of this report. Documents reviewed for each section of this report are listed in the Attachment.

.2.1.1 B Salt Service Water Pump

a. Inspection Scope

The team inspected the B salt water pump, P208B, to evaluate if it was capable of performing its design basis functions. Specifically, the team evaluated whether the salt water pump provided adequate flow so that the salt water system was capable of transferring the maximum heat loads from plant primary and secondary heat sources to the environment. The team reviewed applicable portions of the Updated Final Safety Analysis Report (UFSAR) to identify the design basis requirements for the pump in order to evaluate whether the pump capacity was sufficient to provide adequate flow to the safety-related components supplied by the salt water system. The team reviewed design calculations and drawings to assess available pump net positive suction head, submergence requirements, worst case pump run-out conditions, and to evaluate the capability of the pump to provide the required flow to supplied components under design basis conditions. The team reviewed the salt water pump in-service test (IST) results and salt water system flow verification tests to determine if adequate system flow was available. Specifically, the team reviewed pump data trends for vibration, pump differential pressure, and flow rate test results to verify that acceptance criteria were met and acceptance limits were adequate. The team also reviewed IST procedures and test results to ascertain that the pump discharge check valve was capable of proper closure in order to prevent loss of flow rate through the discharge check valve of an idle pump.

Motor data and voltage drop calculation results were reviewed to confirm that the pump motor would have sufficient voltage and power available to perform its safety function at degraded voltage conditions. The maximum power demand of the pump motor was reviewed to verify it was properly reflected in the alternating current (AC) distribution system and diesel generator loading analyses. The team conducted a walkdown of the pump and interviewed the system and design engineers to evaluate the pumps material condition and assess the pump's operating environment. Finally, the team reviewed corrective action documents to determine whether there were adverse operating trends and to assess Entergy's ability to evaluate and correct problems.

b. Findings

No findings were identified.

.2.1.2 B Emergency Diesel Generator (Electrical)

a. Inspection Scope

The team inspected the B EDG to determine whether it was capable of meeting its design basis functions. The team reviewed design and licensing documents, including the UFSAR and TSs, the system design basis document (SDBD), drawings, and other design documents to determine the specific EDG design functions. The team also reviewed the generator electrical protective relaying scheme, including drawings, calculations, calibration records, and procedures to determine whether the generator was adequately protected and to evaluate whether the output breaker was subject to spurious tripping. Additionally, the team reviewed maintenance schedules, procedures, and completed work records to determine whether the EDG was being properly maintained; and reviewed completed surveillances to determine whether the EDG was being tested in accordance with TS requirements. The team reviewed loss of voltage and degraded voltage relay protection calculations to verify the relay setpoint time delays were acceptable. The team reviewed completed surveillances for the voltage relays, including applicable time delays, to ensure test acceptance criteria and results were consistent with design requirements. The team interviewed system and design engineers and walked down the EDG to independently assess the material condition and to determine if the operating environment was consistent with design requirements, assumptions, and operating requirements. Finally, the team reviewed corrective action documents to evaluate whether there were adverse operating trends and to assess Entergy's ability to evaluate and correct problems.

b. Findings

No findings were identified.

.2.1.3 1C Inboard Main Steam Isolation Valve

a. Inspection Scope

The team inspected the 1C inboard main steam isolation valve (MSIV), AO-203-1C, to verify the valve was capable of performing its design basis function to close on various isolation instrumentation signals. The team reviewed the UFSAR, the SDBD, and drawings to identify the design basis requirements for the MSIV. The team reviewed surveillance test procedures to verify that design basis stroke times were enveloped by test acceptance criteria, and that the leak rate through the valve when isolated was consistent with 10 CFR Part 50, Appendix J requirements. The team reviewed the vendor manual and operating history to evaluate whether the recommended maintenance had been established through the preventive maintenance program. The team interviewed engineering personnel to determine whether surveillance test data was appropriately trended and evaluated for indications of potential component degradation.

The team reviewed Entergys responses to a selection of relevant NRC Information Notices. Work orders were reviewed to verify that qualified replacement parts were installed and in accordance with station procedures. The team also reviewed the MSIV leak rate history and vibration-induced challenges with the valve internals. Finally, the team reviewed CRs to determine whether there were any failures or adverse operating trends and to assess Entergys ability to evaluate and correct problems. At the end of the inspection, the NRC resident inspectors were reviewing MSIV leakage issues documented in PNPS Licensee Event Reports 2016-010-01 and 2017-005-00. It is anticipated NRC inspection conclusions regarding these licensee event reports will be documented in a future NRC integrated inspection report.

b. Findings

No findings were identified.

.2.1.4 High Pressure Coolant Injection Pump

a. Inspection Scope

The team inspected the high pressure coolant injection (HPCI) pump to determine whether it was capable of fulfilling its design basis requirements of delivering flow to the reactor vessel in the event of a postulated accident. The team interviewed the system and design engineers, and reviewed pump testing results for the HPCI pump and selected associated system components to assess HPCI system performance. The UFSAR, TSs, and the SDBD were reviewed to assure consistency between the pump parameters and the tested design basis flow rate and pressure. The team reviewed pump operation with suction supply from the two condensate storage tanks (CST) as well as operation while taking suction from the suppression pool to determine whether the formation of air vortices could jeopardize pump operation. Additionally, in order to determine adequate pump performance at limiting conditions, the team reviewed whether there would be sufficient net positive suction head while the pump suction was aligned to either the CST or the suppression pool, and also verified the availability of the CST vent path. The team reviewed the heat load in the HPCI pump area to assess whether the pump is capable of performing its safety function with only natural circulation room cooling.

The team conducted walkdowns of the CSTs, the HPCI system, and associated support systems to assess Entergys configuration control, the material condition, and the operating environment. The team also reviewed the limits associated with CST parameters (e.g., level, volume, design temperatures) to assure that the CSTs contain sufficient volume available for the HPCI and reactor core isolation cooling (RCIC)systems; and to ascertain that the CST water temperature will not violate plant design parameters such as NDT temperatures. Finally, the team reviewed corrective action documents to determine if there were adverse trends associated with the HPCI pump and to assess Entergys ability to evaluate and correct problems.

b. Findings

Introduction.

The team identified a finding of very low safety significance (Green)involving an NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, in that Entergy did not translate the design basis limit for NDT temperature into plant procedures. Specifically, Entergy specified in their procedures and tank heating setpoint calculation the low temperature limit for the two CSTs to be a non-conservative value, because it was based on the concern of CST freezing rather than the more limiting material service temperature of the downstream safety-related piping.

Description.

The CSTs provide a source of water for the RCIC and HPCI systems to inject directly into the reactor vessel via a branched connection to the common reactor feedwater system during both normal and accident conditions. Because the RCIC and HPCI systems become part of the reactor coolant pressure boundary, there are requirements for the design and operation of the associated piping. Pilgrim UFSAR Section A.4.2, Brittle Fracture Control for Ferritic Steels, states, in part, that the fracture toughness properties and the operating temperature of ferritic materials of the reactor coolant pressure boundary are controlled to ensure adequate toughness by maintaining a material service temperature at least 60°F above NDT temperature. The purpose of maintaining a service temperature above this specified value is to avoid conditions where brittle fracture of the piping is possible.

The material specification sheet for the associated RCIC, HPCI, and feedwater piping, 6498-M-300, Sheet 304A, Revision 6, specified an impact test temperature of - 20°F for the purposes of establishing the NDT and controlling the fracture toughness properties of the material. This test temperature correlates to minimum service temperature of 40°F, above which the piping must be maintained. However, the team identified that the 40°F lowest service temperature limit affected by CST water is not recognized in the following plant documents: procedure 2.2.35, Condensate Storage and Transfer System; procedure 8.C.40, Seasonal Weather Surveillance; calculation IN1-289, CST Temperature Control - TS-9042; and UFSAR Table 10.9-1, Design Temperatures (Winter).

The team determined that Pilgrim procedure 2.2.35, Section 5.1,Precautions, stated Keep the temperature of Condensate Storage Tanks above 45°F to avoid freezing in winter and then referenced UFSAR Table 10.9-1. UFSAR Table 10.9-1 stated the winter design temperature of the CST is 45°F. Procedure 8.C.40, Attachment 2, Severe Cold Weather Actions, Step 3, stated to Ensure a minimum temperature of 45°F, which is to be performed when the outdoor air temperatures is less than or equal to 20°F.

Calculation IN1-289 determined the setpoint for the temperature switch, TS-9042, associated with the CST temperature controller, to be 45°F and decreasing based on the assumption that the temperature of the water in the CST shall not decrease below 35°F.

The team concluded the statements and requirements in these documents did not identify the limiting NDT temperature requirements (40°F) and did not provide an adequate margin of protection against potential brittle fracture behavior. If the non-safety-related CST heaters are not available during winter periods, the water in the two outdoor, uninsulated CSTs can be subjected to temperatures significantly lower than 40°F and can challenge the low service temperature limit of the associated piping if not properly monitored and controlled.

The team noted that on February 4, 2015, CR-PNP-2015-00883 was issued because the heating system for both of the CSTs was not available while the plant was shut down during a winter storm. Operators completed local measurements directly on the two CSTs using a contact pyrometer that indicated 40°F for one CST and 41°F for the other CST. Entergy staff also measured the CST temperature to be 48°F using indicator TI-9055 and determined the issue was acceptable. However, the team noted that the more accurate, local tank temperatures were at the low service temperature limit. The team further noted that the readings were taken once a day and may not represent the minimum CST temperature for that day. However, in this instance, the team concluded that low CST temperatures did not impact downstream safety-related pipe margin against potential brittle fracture behavior because the plant was in cold shutdown conditions and the HPCI and RCIC systems were not required to be available. The team reviewed a 10-year trend of CST temperatures and did not identify other occurrences where the limit of 40°F was reached.

The team observed that the temperature indicator, TI-9055, which could be relied upon by plant operators using the procedures discussed above, is located on a separate downstream CST line rather than locally in the tank. Specifically, the indicator is approximately 65 feet away from the tank on a pipe inside the auxiliary bay where normal winter building temperatures range from 60°F to 80°F. When water does not flow through this pipe, the temperature indicator will read warmer than the outdoor tank and provide an inaccurate temperature measurement. The team determined that the difference between the 40°F service temperature limit and the 45°F procedure limit did not provide margin to account for the uncertainty associated with the location of temperature indicator, uncertainty of instrument measurement error, or possible failures of the CST heating system.

In response to the issues described above, Entergy staff initiated CRs 2017-08071,

-08173, and -08248. Current operability was based on the fact that ambient temperatures are well above the limiting material service temperatures for the affected components. Entergys corrective actions included evaluating and revising the affecting procedures, and included requiring more frequent checks of the temperature of the CST water in the winter, and requiring that the temperature be checked in the appropriately representative location. Entergy staff also planned to correct the error in the calculation that determined the existing temperature limit. The team reviewed Entergys response and found it to be appropriate.

Analysis.

Entergys failure to translate the correct design basis into site procedures 2.2.35, Condensate Storage and Transfer System, and 8.C.40, Seasonal Weather Surveillance, for minimum CST temperature was a performance deficiency that was reasonably within Entergys ability to foresee and correct. Specifically, the procedures stated that the CST temperature shall be maintained at or above 45°F, which was a value based on an incorrect assumption that the minimum design temperature of the CST fluid was 35°F (i.e., to prevent freezing) instead of the lowest service temperature of 40°F based on NDT requirements. As a result, Entergy did not provide adequate protection against brittle fracture behavior in the safety-related HPCI, RCIC, and feedwater piping leading to the reactor vessel.

This issue is more than minor because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Specifically, the minimum CST temperature value stated in procedures, based on an incorrect tank freezing assumption, could potentially result in not providing the full margin of protection against brittle fracture behavior in safety-related piping leading to the reactor vessel. In accordance with IMC 0609.04, Initial Characterization of Findings, and Exhibit 2 of IMC 0609, Appendix A, The SDP for Findings At-Power, the team determined the issue screened as having very low safety significance (Green) because it did not represent an actual loss of safety function of the system or train, did not result in the loss of one or more trains of non-TS equipment, and did not screen as potentially risk significant due to seismic, flooding, or severe weather. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis for structures, systems, and components are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, since original plant operation, the CST minimum temperature limit to preclude brittle fracture behavior in the associated piping system were not correctly translated into station procedures. Specifically, Pilgrim procedure 2.2.35, Condensate Storage and Transfer System, Section 5.1, Precautions, stated Keep the temperature of Condensate Storage Tanks above 45°F to avoid freezing in winter, and procedure 8.C.40, Seasonal Weather Surveillance, Attachment 2, Step 3, states to Ensure a minimum temperature of 45°F but allows the use of a temperature indicator located in a warmer environment than the CST. These procedures did not provide adequate margin above the 40°F lowest service temperature limit when considering uncertainties associated with instrument location, measurement error, and measurement frequencies during periods when the tank heating system is unavailable. Entergys immediate actions included initiating CRs to evaluate the condition, to evaluate operability, and identify corrective actions. Because this issue was determined to be of very low safety significance (Green) and Entergy has entered this issue into their corrective action program (CR-PNP-2017-08071, CR-PNP-2017-08173, and CR-PNP-2017-08248) this finding is being treated as an NCV, consistent with Section 2.3.2.a of the Enforcement Policy. (NCV 05000293/2017007-01, Failure to Incorporate the Correct Design Limit for the CST Water Temperature)

.2.1.5 High Pressure Coolant Injection System Electrical Circuitry/Logic

a. Inspection Scope

The team inspected the electrical control circuit associated with the HPCI system to determine whether the electrical system was capable of performing its design basis requirements. The UFSAR, TSs, and SDBD were reviewed to assure consistency between design parameters and the installed configuration. The team reviewed one-line diagrams, electrical schematics, and protective relay diagrams to evaluate the adequacy of the electrical structure and logic circuitry of the HPCI system. The team interviewed plant engineers and reviewed the maintenance and operating history of the circuits to evaluate the adequacy of maintenance and configuration control. The team also walked down HPCI systems electrical controls, alarms, indications trip relays, pressure and temperature instrumentation, alternate control panel, and associated support systems to assess the material condition and operating environment of the equipment. The team reviewed completed surveillance tests associated with HPCI valves and components from the alternate control panel to ensure that applicable test acceptance criteria were met related to the alternate control panel were met. Finally, the team reviewed corrective action documents and applicable test results to determine if there were adverse operating trends, and to assess Entergys ability to evaluate and correct problems.

b. Findings

No findings were identified.

.2.1.6 Residual Heat Removal Injection Motor-Operated Valve 1001-29B

a. Inspection Scope

The team inspected the residual heat removal system injection motor-operated valve (MOV) 1001-29B to verify that it was capable of performing its design basis function. The valve is a normally closed MOV that is required to open to provide low pressure emergency core cooling flow to the reactor in the event of a postulated accident. The team reviewed design and licensing documents, including the UFSAR, TSs, SDBD, IST basis document, drawings, and other design documents to determine the specific design requirements of the valve.

The team reviewed MOV diagnostic test results and stroke-timing test data to verify acceptance criteria were met. The team also evaluated whether the MOV safety functions, performance capability, and design margins were adequately monitored and maintained in accordance with NRC Generic Letter 96-05 guidance and Entergys MOV Program. The MOV weak link calculation was reviewed to ensure the ability of the valve to remain structurally functional while stroking under design basis conditions; and the team verified that the valve analysis used the maximum differential pressure expected across the valve during worst case operating conditions. Additionally, the team reviewed motor data and degraded voltage conditions to confirm that the MOV would have sufficient voltage and power available to perform its safety function at degraded voltage conditions. The team discussed the design, operation, and component history of the valve with engineering staff and conducted walkdowns of the MOV and associated system components to assess material condition and to determine if the installed configuration and operating environment was consistent with its design bases. Finally, the team reviewed the maintenance and operating history of the valve, associated corrective action documents, and applicable test results to determine whether there were any adverse operating trends, and to assess Entergy's ability to identify, evaluate, and correct adverse conditions.

b. Findings

No findings were identified.

.2.2.1 EC 62307, Revise Tolerance Value for Emergency Diesel Generator Alarm Relays

a. Inspection Scope

The team reviewed Engineering Change (EC) 62307 that revised the tolerance value for the voltage and frequency alarm relays for the A and B EDGs. The team assessed whether the modification affected the licensing and design basis functions of the emergency power system and the equipment served by the 4160 Vac emergency service busses. The team conducted interviews with responsible engineers and walked down the EDGs to observe the conditions for operator response to the subject alarms.

Finally, the team reviewed the design verification checklist, impact screening, and 10 CFR 50.59 screening determination associated with this modification to evaluate whether Entergy properly evaluated the modification in accordance with design and licensing basis requirements.

b. Findings

Introduction.

The team identified a finding of very low safety significance (Green)involving an NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, in that Entergy did not adequately verify that the EDG under-frequency alarm setpoint was in accordance with design basis requirements. Specifically, the EDG under-frequency alarm was set at a value less than the prescribed industry standard utilized in the design basis, and station procedures did not contain instructions to address an EDG under-frequency condition.

Description.

EC 62307 was approved to expand the setpoint tolerance for the EDG under-frequency alarm at 55 Hz, to +/- 2 Hz (or 53 Hz minimum) from the original design value of 55 Hz, +/- 1 Hz (or 54 Hz minimum). The team observed that Pilgrim SDBD-61, Design Basis Document for EDGs, identified National Electrical Manufacturers Association (NEMA) Standard MG-1, Motors and Generators, as the range basis for acceptable motor frequency. This standard identified that motors were designed to operate successfully with variations of +/- 5% rated frequency (60 Hz) at rated voltage, or 57 Hz to 63 Hz. The SDBD also stated that the design basis for the under-frequency alarm for the EDG was to alert the operator before the EDG or the emergency power system loads are adversely affected by under frequency conditions.

However, the team observed that the existing alarm setpoint of 55 Hz for under-frequency was not in accordance with the NEMA standard minimum frequency for motor and generator operation (57 Hz). The team also reviewed operating procedures to verify the adequacy of the operator actions taken to address the EDG low frequency alarm condition, and found that operating procedures did not contain instructions to address that condition.

The team found that neither the original (1971) under-frequency setpoint nor the EC-determined setpoint and calibration tolerance was in conformance with the NEMA standard minimum frequency specified to assure successful operation for generators and motors, which is 57 Hz minimum. The team determined that if an EDG governor failure resulted in adverse under-frequency conditions, the engineered safeguards equipment motors could become damaged and fail due to operating during that condition because the alarm may not detect those conditions in a timely fashion. Furthermore, for the case of a single failed EDG governor, the team was concerned that safeguards equipment motors that could potentially fail while operating on the EDG would then not be able to respond to mitigate the postulated accident from power provided by the secondary offsite AC power source, as described in UFSAR Sections 8.1 and 8.3.2.

In response to this concern, Entergy staff confirmed that the minimum setpoint tolerance of EC 62307 had not yet been implemented in maintenance calibration procedures, and took immediate corrective action to remove implementation of the EC in the station.

Entergy staff initiated CR-PNP-2017-07714 to correct the error in their application of the NEMA Standard MG-1 under-frequency range in the alarm setpoint. In addition, Entergy staff initiated CR-PNP-2017-08069 to address the teams concern that the EDG operating procedures do not provide guidance for operator action in response to frequency variance from 60 Hz. In determining a reasonable expectation for operability, Entergy staff confirmed that surveillance tests demonstrated that EDG frequency has been maintained and/or returned to prescribed limits in accordance with TS requirements, and that there was no evidence that the EDGs operated at any other frequency than 60 Hz nominally. Also, as an interim action, Entergy staff planned to revise operating procedures to include a cautionary statement regarding frequency variations and associated operator actions to take in response. The team reviewed Entergys response to this issue and found them to be appropriate.

Analysis.

The team determined that Entergys failure to establish the EDG under-frequency limit in accordance with the design basis NEMA Standard MG-1 for generators and motors was a performance deficiency that was reasonably within Entergys ability to foresee and correct. Specifically, the failure to alarm at the proper EDG under-frequency limit could result in a condition where there is a reasonable doubt on the ability of safety-related motors to safely operate at the under-frequency conditions during a postulated design basis event; and which could result in damage to safety-related motors. This issue was more than minor because it is associated with the design control attribute of the Mitigating Systems cornerstone and adversely affected its objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with IMC 0609.04, Initial Characterization of Findings, and Exhibit 2 of IMC 0609, Appendix A, The SDP for Findings At-Power, the team determined that this finding was of very low safety significance (Green) because it was a design deficiency confirmed not to result in the loss of operability or functionality. The team determined that this finding has a cross-cutting aspect in the area of Human Performance, Avoid Complacency, because Entergy did not plan for the possibility of latent issues while developing a plant modification package, where the bases for EDG alarm function were incorrect. [H.12]

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis for structures, systems, and components are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, between approximately 1971 and August 2017, Entergy had not adequately implemented an EDG under-frequency limit into their procedures and/or setpoint specifications. Specifically, Entergy had not verified that the EDG under-frequency alarm setpoint was in accordance with design basis requirements. Entergys immediate actions included initiating CRs to evaluate the condition, to evaluate operability, and identify corrective actions. Because this issue was determined to be of very low safety significance (Green) and Entergy has entered this issue into their corrective action program (CR-PNP-2017-07714 and CR-PNP-2017-08069), this finding is being treated as an NCV, consistent with Section 2.3.2.a of the Enforcement Policy.

(NCV 05000293/2017007-02, Inadequate Design Verification of EDG Under-Frequency Alarm Setpoint)

.2.2.2 EC 51759, Replace Solenoid Valve SV-5033B

a. Inspection Scope

The team reviewed EC 51759 that replaced solenoid valve SV-5033B. The team determined SV-5033B is the solenoid operated valve for the air-operated nitrogen purge supply valve AO-5033B. It provides a signal to operate AO-5033B. When a primary containment isolation signal is initiated, SV-5033B will de-energize to close AO-5033B.

AO-5033B will close on a reactor building isolation initiation signal; therefore, SV-5033B performs an active safety function and is part of the containment isolation. The modification was implemented because SV-5033B was leaking air out the vent line with the valve in the closed position. A significant degradation of SV-5033B could impact the operability of AO-5033B. The valve was replaced with a different model due to the original valve being obsolete. Entergy staff determined the new valve was of the same form, fit, and function. However, because there were changes in the valve stem and seat material, Entergy staff processed this activity as an equivalency change.

The team reviewed the modification to verify that the design bases, licensing bases, and performance capability of the nitrogen purge supply valve (AO-5033B) had not been adversely impacted by the modification. The team also reviewed the safety-related component qualification and environmental qualification for the new solenoid valve to determine whether it was acceptable. Additionally, the team evaluated the new valve to ensure that it did not introduce any new failure modes for the valve, which could impact the containment isolation function associated with AO-5033B. The team reviewed the installation work order and post-modification test plan and results to ensure valve performance met the established acceptance criteria for the new design. The team interviewed design engineers, reviewed evaluations, and performed a walkdown of accessible portions of the valve to determine if the modification was installed in accordance with the design, and to assess the overall material conditions of the valve following the modification.

b. Findings

No findings were identified.

.2.2.3 EC 62448, Engineering Evaluation for Vulnerable Motor-Operated Valves to NRC

Information Notice 2013-14

a. Inspection Scope

The team reviewed EC 62448 that dispositioned the concerns address in NRC Information Notice 2013-14. The information notice addressed a potential control circuit design deficiency in MOVs that could result in incorrect valve position indication with the valve in an improper position during a postulated loss-of-coolant accident. Specifically, if power was interrupted to the actuator of certain MOVs during the shedding of loads associated with the plants as-designed loss-of-coolant accident response, the MOVs may not automatically resume operation once power was restored. Additionally, the valve position indicating lights could incorrectly indicate that the valves were fully closed when the actual valve position may actually be partially open. The MOVs were considered vulnerable because they are containment isolation valves that used the LS-8 limit switch as a permissive to close the MOV on an accident signal.

The team reviewed Entergys evaluation to verify that the design bases, licensing bases, and performance capability of MOVs potentially affected by this design vulnerability.

The team reviewed design calculations to determine whether the condition identified in the information notice could affect these MOVs. In addition, the team interviewed design engineers and reviewed the affected valve stroke times and design basis accident profile to determine valve position during the postulated condition. Finally, the team verified that the design of the limit switch and torque switch configurations (i.e., the limit switch setpoint relative to torque switch actuation) were such that the susceptible configuration did not exist at PNPS.

b. Findings

No findings were identified.

.2.2.4 EC 40625, Flooding Topical Design Basis Evaluation

a. Inspection Scope

The team reviewed EC 40625, which implemented an engineering evaluation to ensure that PNPS is capable of shutting down and maintaining safe shutdown conditions following postulated plant flooding events. Specifically, Entergy developed two new calculations to analyze the most limiting internal flooding sources for all credible locations; and incorporated these new design scenarios into a single design basis document. This design basis document was a result of a corrective action from CR-PNP-2011-04503, where the previous assumptions about flooding barriers and operator actions were not sufficiently defined and subsequent analysis was necessary to ensure that safety-related equipment would not be impacted by internal flooding.

The team reviewed the flooding calculations to verify that the assumptions were appropriate, including the break locations/size and flow paths of the water; and to verify that the worst case operating conditions were analyzed. The team also conducted interviews with responsible engineers and walked down flood paths in various buildings to verify barriers and inputs used in the calculations were consistent with the plant configuration. The team reviewed the newly developed operator actions for flood mitigation that required a response time of less than 30 minutes to determine whether Entergy staff could identify and successfully complete the tasks. The team also reviewed the alarm response procedures and the associated leak detection equipment, which were credited in the operator actions, to verify that the equipment and alarms would be available during postulated accidents conditions (i.e., loss of offsite power).

Additionally, the team reviewed the calibration history of the leak detection level switches and the completed preventive maintenance activities of the flood doors to verify that the flood mitigating equipment was being properly maintained. Finally, the team reviewed the 10 CFR 50.59 screening determination associated with this modification to evaluate whether Entergy had been required to obtain NRC approval prior to implementing the changes.

b. Findings

No findings were identified.

.2.2.5 EC 70430, Seal Weld Body-to-Bonnet Joint on 2A Main Steam Isolation Valve

a. Inspection Scope

The team reviewed EC 70430, which provided the technical basis for seal welding the body-to-bonnet joint on the outboard MSIV 2A (AO-230-2A). The body-to-bonnet joint on the Atwood and Morrill MSIVs is a bolted and gasketed connection with surfaces that provide for seal welding as an alternative to gasket replacement in the event of a steam leak. The 2A MSIV did not have an active leak but was identified via an adverse condition analysis as having the same body-to-bonnet dimensional gap as measured on a previously-found leaking 2D MSIV. Entergy staff implemented the modification during the latest outage as a pre-emptive measure to reduce risk of leakage during the next operating cycle.

The team reviewed the modification to determine if the design basis, licensing basis, or performance capability of the MSIV had been degraded by the modification. The team interviewed design and system engineers, and reviewed design drawings to determine material compatibility and verify there was no impact on other components or proper operation of the valve. Additionally, the team reviewed the results of post-modification testing to determine if the changes were properly implemented and whether sufficient margin for valve operation and mechanical stresses remained.

b. Findings

No findings were identified.

.2.2.6 EC 54660, High Pressure Coolant Injection, Reactor Core Isolation Cooling, Residual

Heat Removal, and Core Spray Pump Mechanical Seals Safety Classification Change

a. Inspection Scope

The team reviewed EC 54660, which changed the classification of components in the HPCI, RCIC, residual heat removal, and core spray systems from non-safety-related to augmented quality. Specifically, the purpose of this EC was to evaluate the safety classification of the pumps mechanical seals and their internal components; and to revise design documents as required. The EC involved only warehouse inventory parts and did not affect installed components in the plant. The internal components of the mechanical seals reviewed and reclassified in this EC are the shaft sleeve, seal faces, rotating face holder and springs, and the internal cap, set screws, and pins. Entergy staff considered that none of these components were within the scope of the American Society of Mechanical Engineers Code Section III for pump design or pressure boundary components. The reclassification to augmented quality was considered an enhancement that instituted additional controls to ensure the correct parts were procured; and to ensure validation of the part numbers, configuration, materials and dimensions.

The teams review was performed to determine if the design basis, licensing basis, or performance capability of the respective systems could have been degraded by the component classification change. The team discussed the impact of the modification with responsible engineers, and reviewed the affected design documents and drawings to determine whether they had been properly updated.

b. Findings

No findings were identified.

.2.3 Results of Review of Industry Operating Experience (2 samples)

The team reviewed selected OE issues for applicability at PNPS. The team performed a detailed review of the OE issues listed below to verify that Entergy had appropriately assessed potential applicability to site equipment and initiated corrective actions when necessary.

.2.3.1 Flowserve 10 CFR Part 21 - Double Disc Gate Valve Wedge Pin Failures

a. Inspection Scope

The team assessed Entergys applicability review and disposition of a Flowserve 10 CFR Part 21 report associated with double disc gate valve wedge pin failures. The Part 21 report discussed issues concerning a wedge pin failure of an Anchor Darling double disc gate valve at Browns Ferry Nuclear Plant Unit 1. An investigation revealed that the wedge pin had broken due to excessive load on the pin, and the disc retainer had fallen from the wedge assembly to between the valve discs. A topical report, developed by the Boiling Water Reactor Owners Group (BWROG), provided a recommended industry response to the Flowserve 10 CFR Part 21 report. Entergy staff documented an evaluation and recommended actions from the BWROG report in CR-PNP-2013-00640.

Entergys associated evaluation noted that the Part 21 report was applicable to five valves at Pilgrim, three of which were determined to be susceptible to the wedge pin damage mechanism based on an active safety-related function and use of torque switches to seat the valve. Entergy staff completed the short-term recommendations prescribed in the BWROG report for each susceptible valve. Specifically, Entergy staff conducted a wedge pin shear capability evaluation that concluded the loads were within the shear capacity of all three wedge pins and reviewed diagnostic test data on each valve with no anomalies identified. Entergy staff planned to continue to perform a review of the diagnostic test data as part of the MOV program; however, there were no plans to perform visual inspections of stem rotation during valve stroke testing due to accessibility and lack of accurate rotation measurements. In response to a revision of the BWROG report in June 2017, which included recent OE and additional Flowserve information, Entergy staff confirmed that its initial evaluation of the Part 21 was acceptable per the new industry guidance, and documented plans in CR-PNP-2017-07785 to proactively replace the stem, discs, wedges, and pin in MOV-1001-29B as a forced outage activity in the future.

The team interviewed the MOV program engineer, reviewed the valve diagnostic test results and trending, reviewed the surveillance test results for the susceptible valves (including torque and limit switch calibrations), performed a walkdown of the one valve accessible outside the drywell, and reviewed associated system health reports and corrective action documents to independently assess PNPSs susceptibility to this failure mechanism and the adequacy of the corrective actions to date. No anomalies were present and the team noted that there had been no recent maintenance activities on any of the three valves to allow for an internal inspection of the stem/wedge connection.

Finally, the team performed an independent calculation of the wedge pin shear capability to verify that Entergys conclusion was acceptable and included the appropriate parameters such as operating and testing torques, material properties, temperature, and coefficient of friction.

b. Findings

No findings were identified.

.2.3.2 MPR Associates 10 CFR Part 21 - Basler Electric SBSR Automatic Voltage Regulator

Card Solder Joints

a. Inspection Scope

The team assessed Entergys applicability review and disposition of a 10 CFR Part 21 report, submitted by MPR Associates, regarding a defect identified in Basler Electric SBSR Automatic Voltage Regulator (AVR) card solder joints. The 10 CFR Part 21 report discussed issues with the soldered electrical connections between the L1 magnetic amplifier module and the card. Specifically, over a period of years in service (~15 years), cracks can form in the solder joint connections due to thermal expansion.

Entergys evaluation noted that the Part 21 issue was applicable to the Pilgrim EDGs.

Entergy documented recommended actions from the Part 21 report that included an inspection and repair plan. These actions included an inspection program that should occur on a fuel cycle periodicity after 15 years of service; and if cracks are found, the card should be replaced, or the solder joints repaired. The team interviewed the EDG system engineer, reviewed associated corrective action program documents and AVR card inspection work orders, reviewed planned AVR card inspection preventive maintenance activities, and reviewed related industry OE to independently assess Entergys susceptibility to this potential defect and their corrective actions.

b. Findings

No findings were identified.

4OA2 Identification and Resolution of Problems

a. Inspection Scope

The team reviewed a sample of problems that Entergy had previously identified and entered into the corrective action program. The team reviewed these issues to verify an appropriate threshold for identifying issues and to evaluate the effectiveness of corrective actions. In addition, CRs written on issues identified during the inspection were reviewed to verify adequate problem identification and incorporation of the problem into the corrective action system. The specific corrective action documents that were sampled and reviewed by the team are listed in the Attachment.

b. Findings

No findings were identified.

4OA6 Meetings, including Exit

On August 17, 2017, the team presented the inspection results to Mr. D. Noyes, Acting Site Vice President, and other members of the PNPS staff. The team reviewed proprietary information, which was returned to Entergy at the end of the inspection. The team verified that no proprietary information was documented in the report.

ATTACHMENT:

SUPPLEMENTARY INFORMATION

KEY POINTS OF CONTACT

Entergy Personnel

B. Ahern, Electrical Engineer

B. Barrus, NSSS Lead System Engineer

R. Byrne, Senior Engineer

W. Carroll, Systems Program Engineer

S. Das, Senior Design Engineer

J. Davis, Design Engineer

N. Eisenmann, Supervisor Systems and Component Engineering

A. Fiumara, I&C Engineer

P. Gallant, Assistant Operations Manager

M. Green, Systems Engineer

D. Grimes, Design Engineer

P. Harizi, Senior Design Engineer

R. Ho, Programs Engineer

A. Madeiras, Engineering Supervisor

M. McClellan, Design Engineer

R. Morris, Mechanical Systems Engineer

D. Peyvan, Senior Component Engineer

J. Tucker, Mechanical/Civil Design Engineering Supervisor

LIST OF ITEMS

Opened and Closed

05000293/2017007-01 NCV Failure to Incorporate the Correct Design Limit for the Condensate Storage Tank Water Temperature (Section 1R21.2.1.4)

05000293/2017007-02 NCV Inadequate Design Verification of Emergency Diesel Generator Under-

Frequency Alarm Setpoint (Section 1R21.2.2.1)