IR 05000298/2017009

NRC Special Inspection Report 05000298/2017009

ML17179A282
Person / Time
Site:	Cooper
Issue date:	06/27/2017
From:	Jason Kozal NRC/RGN-IV/DRP/RPB-C
To:	Higginbotham K Nebraska Public Power District (NPPD)
JASON KOZAL
References
IR 2017009
Download: ML17179A282 (35)

Text

June 27, 2017

SUBJECT:

COOPER NUCLEAR STATION - NRC SPECIAL INSPECTION REPORT 05000298/2017009

Dear Mr. Higginbotham:

On February 17, 2017, the U. S. Nuclear Regulatory Commission (NRC) completed its initial assessment of a residual heat removal (RHR) system configuration control problem that was discovered on February 5, 2017, at your Cooper Nuclear Station. During the fall 2016 refueling outage, operations personnel failed to reposition the Division I RHR minimum flow isolation valves to the open position prior to reinstalling the valve sealing devices. As a result, these minimum flow paths remained isolated until this condition was discovered on February 5, 2017.

Based on this initial assessment, the NRC sent a special inspection team to your site on March 13, 2017.

On May 17, 2017, the NRC completed its special inspection and discussed the results of this inspection with you and other members of your staff. The results of this inspection are documented in the enclosed report.

NRC inspectors documented two findings of very low safety significance (Green) in this report.

Both of these findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC resident inspector at the Cooper Nuclear Station.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; and the NRC resident inspector at the Cooper Nuclear Station. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Jason Kozal, Branch Chief Project Branch C Division of Reactor Projects Docket No. 50-298 License No. DPR-46 Enclosure:

Inspection Report 05000298/2017009 w/ Attachments:

1. Supplemental Information 2. Detailed Risk Evaluation 3. Special Inspection Charter dated March 1, 2017 (ADAMS ML17060A687)

ML17179A282 SUNSI Review ADAMS: Non-Publicly Available Non-Sensitive By: MStafford/dll Yes No Publicly Available Sensitive OFFICE RI:DRP/B TL:SIT BC:DRP/C NAME NHernandez RSmith JKozal SIGNATURE /RA/ /RA/ /RA/

DATE 05/23/17 05/23/17 6/27/17

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 05000298 License: DPR-46 Report: 05000298/2017009 Licensee: Nebraska Public Power District Facility: Cooper Nuclear Station Location: 72676 648A Ave Brownville, NE Dates: March 13 through May 17, 2017 Team Leader: Richard Smith Nuclear System Engineer Response Coordination Branch Inspector: Nicholas Hernandez Resident Inspector, South Texas Project Approved By: Jason Kozal Chief, Project Branch C Division of Reactor Projects Enclosure

SUMMARY

IR 05000298/2017009; 03/13/2017 - 05/17/2017, Cooper Nuclear Station; Followup of Events and Notices of Enforcement Discretion.

The inspection activities described in this report were performed between March 13 and May 17, 2017, by the resident inspector at South Texas Project and one inspector from the NRCs Region IV office. Two findings of very low safety significance (Green) are documented in this report. These findings involved violations of NRC requirements. The significance of inspection findings is indicated by their color (i.e., Green, greater than Green, White, Yellow, or Red), which is determined using Inspection Manual Chapter 0609, Significance Determination Process, dated April 29, 2015. Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, Aspects within the Cross-Cutting Areas, dated December 4, 2014.

Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, dated July 2016.

Cornerstone: Mitigating Systems

Green.

The team reviewed a self-revealed, non-cited violation of Technical Specification 3.5.1, Emergency Core Cooling Systems - Operating, for the licensees failure to restore the Division I residual heat removal system (RHR) during clearance restoration, which resulted in exceeding the applicable technical specification action completion time. Specifically, from October 7, 2016, to February 5, 2017, the licensee failed to restore Division I RHR minimum flow isolation valves for RHR pumps A and C to the open position prior to reinstalling the valve sealing devices following maintenance performed during Refueling Outage 29. The licensees immediate corrective action was to restore the Division I RHR subsystem to operable status by sealing open the minimum flow isolation valves for RHR pumps A and C. The licensee entered this issue into their corrective action program as Condition Report CR-CNS-2017-00553.

The licensees failure to properly restore the Division I RHR system during clearance restoration resulted in exceeding the applicable technical specification action completion time, in violation of Technical Specification 3.5.1, which was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the human performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to follow technical specification requirements to ensure the availability, reliability, and capability of the Division I RHR subsystem directly affected the cornerstone objective.

Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, the inspectors determined that the finding required a detailed risk evaluation because it involved an actual loss of function of at least a single train for greater than its technical specification allowed outage time. A detailed risk evaluation (Attachment 2) calculated an increase in core damage frequency of 4.7E-7 for the 89 days, 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, and 49 minutes exposure period. Therefore, this violation was of very low safety significance (Green). The team determined the finding had a cross-cutting aspect within the human performance area, challenge the unknown, because individuals failed to perform adequate job-site reviews to identify and resolve unexpected conditions. Specifically, operations personnel restoring the Division I RHR subsystem did not ensure that the minimum flow isolation valves were repositioned to the correct position of sealed open [H.11]. (Section 4OA3)

Green.

The team reviewed a self-revealed, non-cited violation of Technical Specification 5.4.1.a, Procedures, for the licensees failure to maintain Station Procedure 2.0.2, Conduct of Operations Procedure, Operator Logs and Reports,

Revision 106, for conducting sealed valve audits. Specifically, this procedure only checked that the seals were installed, and did not check that the valves were in the correct position.

This resulted in an extended period of time that the Division I residual heat removal (RHR)system was unknowingly inoperable. The licensees immediate corrective action was to revise Station Procedure 2.0.2 to include directions to check the position of sealed valves in addition to checking that the valve sealing devices were installed. The licensee entered this issue into their corrective action program as Condition Report CR-CNS-2017-00553.

Failure to maintain Station Procedure 2.0.2 for conducting sealed valve audits, in violation of Technical Specification 5.4.1.a, was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it affected the configuration control attribute of the Mitigating Systems Cornerstone and adversely impacted the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to correctly identify and correct out of position Division I RHR minimum flow isolation valves resulted in unnecessarily and unknowingly extending the inoperability time of the Division I RHR subsystem by 39-45 days. Using Inspection Manual Chapter 0609, Attachment 04, Initial Characterization of Findings, and Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, the inspectors determined that the violation required a detailed risk evaluation because the finding represented a loss of safety function for greater than its technical specification allowed outage time. A senior reactor analyst performed the risk evaluation and determined that the violation was of very low safety significance (Green). The team determined the finding had a cross-cutting aspect within the human performance area, resources, because leaders did not ensure that personnel, equipment, procedures, and other resources were available and adequate to support nuclear safety. Specifically, the licensee had approved Station Procedure 2.0.2,

Conduct of Operations Procedure, Operator Logs and Reports, Revision 106, for conducting sealed valve audits without including the fundamental direction to ensure that the sealed valves were in the correct position [H.1]. (Section 4O3A)

REPORT DETAILS

4OA3 Followup of Events and Notices of Enforcement Discretion

Review of Events Surrounding the Isolation of RHR, Division I, Minimum Flow Piping at Cooper Nuclear Station On October 7, 2016, when lifting a clearance order during an outage, operations personnel failed to reposition the Division I residual heat removal (RHR) minimum flow isolation valves (RHR-V-58 and RHR-V-60) for RHR pumps A and C to the open position prior to reinstalling the valve sealing devices. As a result, these minimum flow paths remained isolated until this condition was discovered on February 5, 2017. From November 23 to November 29, 2016, operations personnel conducted a sealed valve audit, which failed to identify that these valves were in the incorrect position. During a subsequent sealed valve audit, conducted on February 5, 2017, operations personnel identified that these valves were in the incorrect position. The affected RHR pumps were operated approximately 10 times during the 4-month time period with the minimum flow paths isolated.

Management Directive (MD) 8.3, NRC Incident Investigation Program, was used to evaluate the level of NRC response for this event. In evaluating the criteria of MD 8.3, it was determined that the event met two of the deterministic criteria. This event potentially led to the loss of a safety function used to mitigate an actual event.

Specifically, it was determined that the Division II RHR was out of service for a total of approximately 71.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> during the time period that Division I RHR minimum flow paths were isolated. The condition of having the minimum flow isolation valves closed may have rendered one or more of the RHR system safety functions inoperable for Division I RHR when Division II RHR was unavailable. Additionally, this event involved questions or concerns pertaining to licensee operational performance. Specifically, this event raised questions regarding how operations personnel completed the system alignment and how they failed to identify the improperly positioned valves during a subsequent sealed valve audit. The preliminary estimated conditional core damage probability was determined to be 3.5 x 10-6.

Based on the deterministic criteria and risk insights related to the inadvertent isolation of the Division I RHR minimum flow paths, Region IV management determined that the appropriate level of NRC response was to conduct a special inspection. This special inspection was chartered to identify the circumstances surrounding this event and assess the adequacy of the licensees actions to address the causes of the event.

a. Inspection Scope

The special inspection team performed data gathering and fact-finding to address the following items from the inspection charter (Attachment 3):

1. Provide a recommendation to Region IV management as to whether the

inspection should be upgraded to an augmented inspection team response.

This recommendation should be provided by the end of the first day on site.

An augmented inspection team was not warranted. The scope of expertise utilized in the special inspection was adequate to review this event.

2. Develop a complete sequence of events related to the isolation of the Division I

RHR minimum flow paths that was discovered on February 5, 2017. The chronology should include plant mode changes; status of emergency core cooling systems (ECCS), as well as RHR shutdown cooling, RHR suppression pool cooling, and RHR containment spray systems; and operation of the affected Division I RHR pumps during the time period that the minimum flow isolation valve misalignment existed.

The following is a chronology of events just prior to the incorrect positioning of the Division I RHR minimum flow manual isolation valves and correction of the errors by the licensee. The technical specification aspects of this event will be covered in Item 7 below.

September 28, 2016, 6:20 p.m. - Reactor vessel level was greater than 21 feet above vessel flange and fuel pool gates are removed. Technical Specification (TS) 3.5.2, ECCS - Shutdown, is not applicable while in Mode 5 (refueling) with these conditions; therefore, no low pressure emergency core cooling systems are required to be operable (the plant was in this condition from September 28, 2016, at 6:20 p.m. until October 20, 2016, at 7:13 a.m.).

September 29, 2016, at approximately 5:38 p.m. - The Division I RHR subsystem was placed out of service to perform planned maintenance. This required that RHR minimum flow isolation valves RHR-58 and RHR-60 be danger tagged in the closed position.

September 30, 2016, 2:20 p.m. - All four fuel pool cooling (FPC) pumps were in service with three heat exchangers, and the alternate decay heat removal (ADHR)system is in service (the ADHR system adds FPC C and D pumps and an additional heat exchanger).

October 7, 2016, 3:06 p.m. - Reactor vessel was defueled (reactor is in a no-mode condition). All reactor fuel was in the spent fuel pool.

October 7, 2016 - The Division I RHR minimum flow isolation valves (RHR-58 and RHR-60) were authorized to have danger tags removed and sealed open.

Danger tags were removed but valves were not opened but seals were installed on the valves. Additionally, RHR maintenance work was still ongoing, therefore Division I RHR limiting condition for operation (LCO) was not exited until October 20, 2016.

October 17, 2016 - RHR pumps A and C were started for Surveillance Procedure 6.1.RHR.101, RHR Test Mode Surveillance Operation, Revision 35.

This surveillance was performed to support restoring the Division I RHR subsystem to an operable condition. The duration that each pump was run at less than the minimum flow, which is the smallest amount of flow required for pump protection (2731 gallons per minute (gpm)), was:

RHR pump A: 1 minute 50 seconds RHR pump C: 2 minutes 18 seconds.

October 18, 2016 - RHR pump A was started during Surveillance Procedure 6.1DG.302, Undervoltage Logic Functional, Load Shedding, and Sequential Loading Test, Revision 86. RHR pump A ran at less than the minimum required flow for 53 seconds.

October 19, 2016, 2:35 p.m. - The licensee entered Mode 5, Refueling Mode, and commenced fuel loading to the reactor vessel.

October 20, 2016, 3:19 a.m. - The licensee declared Division I RHR operable for all modes. At that time the system was in the low pressure coolant injection (LPCI) lineup. Due to the minimum flow valves remaining closed, which prevents a minimum flow path from being available, Division I RHR was actually inoperable. TS 3.5.2 was not applicable when in Mode 5 with cavity water level greater than 21 feet above the vessel flange and fuel pool gates removed.

TS 3.9.7 is met due to the ADHR system being in operation.

October 20, 2016 - RHR pump C was started during Surveillance Procedure 6.2DG.302. RHR pump C ran at less than minimum flow for 13 seconds.

October 21, 2016, 1:14 a.m. - The licensee declared Division II RHR inoperable for planned maintenance (core spray (CS) A, CS B operable). TS 3.5.2 was not applicable when in Mode 5 with cavity water level greater than 21 feet above the vessel flange and fuel pool gates removed. TS 3.9.7 was met due to the ADHR system being in operation.

October 21, 2016 - RHR pumps A and C were started for Surveillance Procedure 6.RHR.308, RHR Pump and Valve Control Logic Reactor Vessel Pressure Less Than or Equal to 72 psig Functional Test, Revision 15. The duration of each pump run at less than the minimum flow was:

RHR pump A: 1 minute 52 seconds RHR pump C: 54 seconds.

October 27, 2016 - RHR pumps A and C were started for Surveillance Procedure 6.RHR.301, RHR Initiation and Containment Spray Logic System Functional Test. The duration of each pump run at less than the minimum flow was:

RHR pump A: 31 seconds RHR pump C: 34 seconds October 28, 2016, 2:58 a.m. - Licensee operations personnel aligned Division I RHR for shutdown cooling (SDC):

• Minimum flow valve RHR-MO-16A (Division I minimum flow motor operated isolation valve) was danger tagged closed and deactivated from October 28, 2016, until November 6, 2016, with exception of one period from November 1, 2016, at 5:30 p.m. until November 2, 2016, at 11:44 p.m.

This was to support a reactor vessel pressure test. The valve is closed and deactivated per station procedures to prevent a drain down event from the reactor vessel to the suppression pool.

• TS 3.5.2 was not applicable when in Mode 5 with reactor cavity water level greater than 21 feet above the vessel flange and fuel pool gates removed.

• Per the TS Bases for TS 3.5.2, LPCI subsystem may be considered operable during alignment and operation for decay heat removal (i.e. SDC),if capable of being manually realigned. Alignment and operation for decay heat removal includes when the required RHR pump is not operating or when the system is realigned from or to the RHR SDC mode. If Division I RHR is required for LPCI mode, station procedures allow operations personnel to realign the subsystem from SDC mode to LPCI mode without opening or removing the danger tag from the RHR-MO-16A (Division I minimum flow motor operated isolation valve).

• TS 3.9.7 was met due to the ADHR system in service.

October 28, 2016, 8:51 a.m. - Started Division I RHR in SDC mode.

October 28, 2016, 9:24 a.m. - Secured Division I RHR from SDC.

October 29, 2016, 2:25 p.m. - Started Division I RHR in SDC mode.

October 29, 2016, 9:40 p.m. - Secured fuel pool cooling (FPC) pump C (one of two ADHR pumps).

October 29, 2016, 11:05 p.m. - Secured FPC pump D (second ADHR pump secured, ADHR no longer in service). Normal FPC system remained in service.

October 30, 2016, 7:13 a.m. - The licensee installed the fuel pool gates. The status of ECCS pumps was as follows: the CS A subsystem was operable, Division I RHR subsystem was operable for the SDC mode of operation, and manual realignment to the LPCI mode was available per station procedures and TS bases for TS 3.5.2. TS 3.9.7 was met with Division I RHR in SDC operation.

October 30, 2016, 4:15 p.m. - The licensee secured RHR pump A from SDC mode of operation.

October 30, 2016, 4:23 p.m. - Operations personnel commenced reactor cavity drain down. When reactor cavity level was below 21 ft above the reactor vessel flange, TS 3.9.8, RHR - Low Water Level, was applicable and met due to having two operable RHR pumps in Division I for SDC and meeting the required actions for TS 3.9.8 Condition C by having a reactor recirculation water pump in operation and monitoring coolant temperature every hour.

October 30, 2016, 9:10 p.m. - Reactor pressure vessel (RPV) level was lowered by operations personnel to at the flange of the vessel.

October 30, 2016, 9:40 p.m. - The licensee started Division I RHR in SDC mode.

October 31, 2016, 6:30 a.m. - RPV head was set in place. The vessel head was installed, not tightened, with a breathable foreign material exclusion (FME) barrier on the head vent flange.

October 31, 2016, 10:23 p.m. - The licensee declared Division II RHR operable.

The current status of ECCS systems is as follows: CS A and Division II RHR are operable. The Division I RHR minimum flow valves continue to be closed for SDC operations, and the Division I RHR subsystem remains available for LPCI mode with a manual realignment from SDC mode. TS 3.9.8 is met due to having two operable RHR pumps in Loop A and B for SDC.

November 1, 2016, 4:46 a.m. - The RPV head is tensioned and the licensee entered Mode 4, Cold Shutdown. TS 3.5.2 is now met with the following two operable low pressure ECCS subsystems available: Division II RHR and CS A.

November 1, 2016, 11:36 a.m. - The RPV head vent piping is installed piping installed with the RPV head vent valves open prior to installation, per procedure.

The RPV head vent path maintained during entire evolution.

November 1, 2016, 5:12 p.m. - The licensee secured Division I RHR from the SDC mode of operation.

November 1, 2016, 5:30 p.m. - The clearance on the RHR motor operated minimum flow valve, RHR-MO-16A, is temporarily removed to place RHR in the LPCI lineup for RPV pressure test. TS 3.5.2 is met with the following two operable low pressure ECCS subsystems available: CS A and Division II RHR subsystems.

November 1, 2016, 10:41 p.m. - RPV head vent valves are closed for the RPV pressure test.

November 2, 2016, 11:44 p.m. - The motor operated minimum flow valve, RHR-MO-16A, is closed and deactivated to return Division I RHR to a SDC lineup.

TS 3.5.2 is met with CS A and Division II RHR subsystems operable. Division I RHR is available for manual realignment to LPCI mode.

November 3, 2016, 3:15 a.m. - The licensee started Division I RHR in the SDC mode of operation.

November 3, 2016, 6:20 a.m. - Reactor coolant temperature is less than 212 degrees Fahrenheit and RPV head vents are opened, restoring the plant to Mode 4 from the RPV pressure test.

November 3, 2016, 9:40 p.m. - Operations staff declared CS B subsystem operable. TS 3.5.2 is met with CS A, CS B, and RHR Loop B operable. Division I RHR is available for manual realignment to LPCI mode.

November 5, 2016, 3:24 p.m. - The licensee secured Division I RHR from SDC.

November 5, 2016, 5:22 p.m. - The licensee started Division I RHR in SDC mode.

November 5, 2016, 9:53 p.m. - Operations staff declared the service water system and RHR service water B operable in order to support RHR TS requirements for Modes 1, 2, 3.

November 6, 2016, 4:56 p.m. - The licensee secured Division I RHR from SDC for reactor startup. Division I RHR is now inoperable due to the closed minimum flow valves, RHR-58 and RHR-60, for TS 3.5.1, ECCS - Operating. This condition will last until February 5, 2017, at 8:02 a.m.

November 6, 2016, 7:13 p.m. - Licensee enters Mode 2, Reactor Startup.

November 7, 2016 - RHR pump A was started in suppression pool cooling (SPC)mode for 150 psig startup testing of high pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC) systems. The duration that the pump ran at less than the minimum flow was 1 minute and 58 seconds.

November 8, 2016 - RHR pump A was started in SPC mode for 1000 psig startup testing of the RCIC system. The duration that the pump ran at less than the minimum flow was 1 minute and 4 seconds.

November 8, 2016 - RHR pump A was started in SPC mode for 1000 psig startup testing of the HPCI system, the automatic depressurization system (ADS), and the RCIC system. The duration that the pump ran at less than the minimum flow was 1 minute and 7 seconds.

November 26, 2016 - RHR pump A was started in SPC mode for torus water transfer. The duration that the pump ran at less than the minimum flow was 1 minute and 6 seconds.

December 1, 2016 - RHR pumps A and C were started for Surveillance Procedure 6.1.RHR.101, RHR Test Mode Surveillance Operation, Revision 35.

The duration that each pump ran at less than the minimum flow was:

• RHR pump A: 1 minute 36 seconds

• RHR pump C: 1 minute 38 seconds.

December 10, 2016 - RHR pump A was started in SPC mode for torus water transfer. The duration that the pump ran at less than the minimum flow was 1 minute and 36 seconds.

December 24, 2016 - RHR pump A was started in SPC mode for torus water transfer. The duration that the pump ran at less than the minimum flow was 1 minute and 24 seconds.

January 7, 2017 - RHR pump A was started in SPC mode for torus water transfer.

The duration that the pump ran at less than the minimum flow was 54 seconds.

February 5, 2017, 8:02 a.m. - RHR-V-58 and RHR-V-60 minimum flow manual isolation valves for the Division I RHR pumps were opened after being discovered in the closed positions. TS 3.5.1, ECCS - Operating, is met for the required low pressure ECCS subsystems being operable.

3. Review the licensees root cause analysis and extent of condition review

efforts and determine if the evaluation is being conducted at a level of detail commensurate with the significance of the problem.

The Division I RHR system minimum flow valve misalignment issue was entered into the licensees corrective action program as Condition Report CR-CNS-2017-00553, which was characterized as a Category A condition report. This characterization requires a root cause evaluation (RCE), which the licensee had not completed by the end of the onsite week of the special inspection. The team noted that the licensee correctly concluded that the Division I RHR unavailability event discussed in Condition Report CR-CNS-2017-00553 resulted in an unrecognized entry into TS Sections: 3.5.1, ECCS - Operating, Condition A, Restore low pressure ECCS injection/spray subsystem(s) to operable status within seven days; 3.6.1.9, Residual Heat Removal (RHR) Containment Spray, Condition A, Restore RHR containment spray subsystem to operable status within seven days; and 3.6.2.3, Residual Heat Removal (RHR) Suppression Pool Cooling, Condition A, Restore RHR suppression pool cooling subsystem to operable status within seven days.

The licensees immediate corrective actions were to open the two minimum flow manual isolation valves to restore the system to an operable condition and exit the above listed TSs.

The licensee continues to finalize their RCE, but they did perform an extent of condition review for this event. The extent of condition review actions conducted by the licensee to date are as follows:

• The minimum flow valves on the opposite loop of RHR were immediately verified open.

• All ECCS and RCIC system component lineups were checked. The licensee did not identify any incorrectly configured components during their review.

• The licensee extended a check of all clearance order release activities performed during the refueling outage by the two individuals involved with the activities that resulted in incorrectly configured Division I RHR minimum flow manual isolation valves. The licensee did not identify any incorrectly configured components during their review.

• The licensee conducted a sealed valve log audit. The audit scope was expanded to include verifying the position of the sealed valves, in addition to checking the integrity of the seals. The licensee did not identify any incorrectly configured components during their audit.

• The licensee conducted component lineups of numerous systems at the plant, including safety-related systems such as the emergency diesel generators and nonsafety-related systems such as the circulation water system. The licensee did not identify any incorrectly configured components during their review.

The inspectors interviewed the licensees RCE team and determined that the licensees preliminary conclusion of the root cause was the stations lack of commitment to a strong configuration control program. The RCE team was still in the process of determining the root cause, contributing causes, and corrective actions to prevent recurrence. The teams assessment was that the stations evaluation is being conducted at a level of detail commensurate with the significance of the problem.

4. Determine the probable cause(s) for the misalignment of the Division I RHR

minimum flow isolation valves.

Overall, the licensees unfinished RCE for the isolation of Division I RHR minimum flow piping concluded that the direct cause of the event was that the first nonlicensed operator performing the clearance restoration on October 7, 2016, failed to open the shut valves (RHR-58 and RHR-60) prior to applying the sealing devices to the valves, and then the independent verifier failed to identify that the valves were sealed shut, vice sealed open. The team also concluded that this was likely the direct cause of the event. The licensee has implemented some corrective actions that included a station wide Red Memo about the event. The operations department held an all hands meeting to understand what had happened, to ensure the various roles and responsibilities of operations personnel were understood, to stress the importance of operations personnel to maintain a questioning attitude, to maintain an awareness of equipment status while performing rounds or other activities in the plant, and to challenge each other during day to day activities. The licensee had an opportunity to identify this error during a sealed valve audit the week of November 23 - 29, 2016, but failed to identify the valves were out of position. Because of this the licensee revised the sealed valve audit procedure not only to check that the sealing devices are installed, but to check valve positions as well.

The licensee had not completed the RCE; therefore, no corrective actions that would preclude repetition had been developed at the time of the special inspection.

5. Review the licensees operability evaluation to determine the current

operability status of the affected Division I RHR pumps.

On October 7, 2016, when lifting a clearance order during an outage, operations personnel failed to reposition the Division I residual heat removal (RHR) minimum flow isolation valves (RHR-V-58 and RHR-V-60) for RHR pumps A and C to the open position prior to reinstalling the valve sealing devices. As a result, these minimum flow paths remained isolated until this condition was discovered on February 5, 2017.

Cooper Nuclear Station entered TS 3.5.1, Condition A, required Action A.1: restore LPCI subsystem to operable status within 7 days; TS 3.6.1.9, Condition A, required Action A.1: restore containment spray system to operable status within 7 days; and TS 3.6.2.3, Condition A, required Action A.1: restore SPC subsystem to operable status within 7 days. The licensee reopened the minimum flow manual isolation valves, made an immediate operability determination that a reasonable assurance of operability existed, and exited the TS actions listed above. This immediate operability call was based on a review of performance data obtained during quarterly surveillance testing done from March 2016 through December 2016. The licensee requested engineering personnel to perform a more detailed review, and additionally, on February 6, 2017, the licensee performed Surveillance Procedure 6.1.RHR.101,RHR Test Mode Surveillance Operation (IST) (DIV I), Revision 35, a 2-year inservice test (IST) for the Division I RHR system.

The licensee determined that the pumps had been operated 15 times during the time period that the minimum flow valves were isolated, and the longest time any pump was continuously operated in this condition was 2 minutes and 18 seconds. They also performed a detailed analysis of the 2-year comprehensive surveillance data, comparing test results from October 2007 through February 6, 2017. The licensees evaluation of operability concluded that no degradation had occurred to the Division I RHR pumps. This conclusion was based on the following:

• The minimal amount of time the pumps were operated with flow less than the prescribed minimum flow of 2731 gpm was a total operating time of 21 minutes and 28 seconds.

• The licensees review of vendors guidance and operating experience considering the applicable thermal and hydraulic mechanisms.

• The fact that the operational characteristics of pump differential pressure and vibrations for the RHR pumps had not changed, indicating degradation had not occurred. All surveillance parameters reviewed were within specification limits.

The team reviewed the operability determination evaluation and interviewed the site resident inspectors who monitored the February 6, 2017, test. Through a review of the data and the information provided by the site residents, the team determined that the licensees conclusion that the Division I RHR pumps were operable was reasonable.

6. Review the licensees operability evaluation to determine whether the

condition of having the Division I RHR minimum flow paths isolated rendered any of the safety functions (e.g. low pressure coolant injection (LPCI), RHR containment spray, RHR suppression pool cooling) associated with Division I RHR inoperable, and whether a loss of safety function occurred due to concurrent unavailability of Division II RHR.

The team reviewed the licensees operability evaluation and determined that when the Division I RHR minimum flow paths were discovered isolated, the licensee correctly entered TS 3.5.1, Condition A, required Action A.1: restore low pressure coolant injection subsystem to operable status within 7 days; TS 3.6.1.9, Condition A, required Action A.1: restore containment spray system to operable status within 7 days; and TS 3.6.2.3, Condition A, required Action A.1: restore SPC subsystem to operable status within 7 days. Therefore, the licensee had declared those safety functions associated with the Division I RHR subsystem to be inoperable at the time of discovery of the system configuration problem.

Additionally, the team reviewed other licensee documents and operating logs pertaining to the event and recognized that the licensee had determined that for approximately 90.62 hours7.175926e-4 days <br />0.0172 hours <br />1.025132e-4 weeks <br />2.3591e-5 months <br /> during the time period that the Division I RHR minimum flow lines were isolated, both trains of RHR were inoperable for the safety functions of LPCI, containment spray, and SPC. If the licensee had known the actual status of the Division I RHR subsystem alignment during this time, they would not have allowed the Division II RHR subsystem to be made inoperable. However, since the licensee was not aware of the inoperable status of the Division I RHR subsystem, the licensee allowed Division II RHR to be taken to an inoperable status, resulting in total loss of safety functions for the RHR system.

The team reviewed a licensee preliminary engineering calculation that had determined how long the RHR pumps could run with no minimum flow protection without causing substantial damage to the pumps and rending them inoperable for performing their safety functions. The licensees calculation determined that they could run the Division I RHR pumps for approximately 32 minutes before an inoperable condition would occur due to pump damage. The licensee contracted a consulting firm to perform a more detailed analysis to determine the actual time the pumps could operate in this condition before failure. The consulting firms calculation determined that they could run the Division I RHR pumps for approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> before an inoperable condition would occur due to pump damage. The team reviewed this consulting firms calculation and determined it to be reasonable.

7. Determine whether any technical specification requirements associated with

the RHR system were not met, including TSs 3.5.1, 3.5.2, 3.6.1.9, 3.6.2.3, 3.9.7, and 3.9.8.

The team developed a chronology of events in Item 2 above, and from that, determined technical specifications implications for TSs 3.5.1, 3.5.2, 3.6.1.9, 3.6.2.3, 3.9.7 and 3.9.8.

• TS 3.5.1, ECCS - Operating: Following entry to Mode 2 on November 6, 2016, at 7:13 p.m. until February 5, 2017, at 8:02 a.m., the Division I RHR subsystem was inoperable and did not meet TS 3.5.1, a total time of 89 days, 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, and 49 minutes.

• TS 3.5.2, ECCS - Shutdown: This TS was met during the time period of interest due to the ability to manually realign the Division I RHR subsystem to the LPCI mode, as allowed by TS 3.5.2 basis, using available station procedures.

• TS 3.6.1.9, Residual Heat Removal (RHR) Containment Spray: Following entry to Mode 2 on November 6, 2016, at 7:13 p.m. until February 5, 2017, at 8:02 a.m., the Division I RHR subsystem was inoperable and did not meet TS 3.6.1.9, a total time of 89 days, 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, and 49 minutes.

• TS 3.6.2.3, Residual Heat Removal (RHR) Suppression Pool Cooling:

Following entry to Mode 2 on November 6, 2016, at 7:13 p.m. until February 5, 2017, at 8:02 a.m., the Division I RHR subsystem was inoperable and did not meet TS 3.6.2.3, a total time of 89 days, 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, and 49 minutes.

• TS 3.9.7, Residual Heat Removal - High Water Level and TS 3.9.8, Residual Heat Removal - Low Water Level: These TSs were always met during the entire exposure period.

The team considered the periods of inadvertent simultaneous inoperability of both divisions of the RHR system as stated in Item 6 above, other maintenance and testing activities that resulted in the inoperability of core spray pumps A and B, and Division I and Division II emergency diesel generators. The team determined that there were times in which the station should have entered LCO 3.0.3. This LCO establishes the actions that must be implemented when an LCO is not met and an associated action is not provided for the existing condition. In this case, times where both divisions of the RHR system were inoperable, times where one division of both the RHR and core spray systems were inoperable, and times where one division of the RHR system and an emergency diesel generator being inoperable are conditions not allowed by the associated TS LCOs. The licensee should have entered LCO 3.0.3, which would have required a unit shutdown the same day, if the condition continued to exist for more than 7 consecutive hours. Conditions such as these existed for a total of 150.85 hours9.837963e-4 days <br />0.0236 hours <br />1.405423e-4 weeks <br />3.23425e-5 months <br /> during the time the Division I RHR minimum flow lines were isolated.

Furthermore, the team reviewed LCO 3.0.4, which states, in part, when an LCO is not met and associated actions to be entered do not permit continued operation in the applicable mode for an unlimited period of time, entry into a mode or other specified condition in the applicability shall only be made after the performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the mode or other specified condition in the applicability, and establishment of risk management actions, if appropriate. The licensee entered Mode 2 on November 6, 2016, when they were unaware of the inoperability of the Division I RHR subsystem. They were prohibited by TS 3.0.4 from entering Mode 2 since a risk assessment had not been performed and associated actions of applicable LCOs did not permit continued operation in the mode for an unlimited period of time.

8. Evaluate the licensees actions to comply with reporting requirements

associated with this event.

The team reviewed plant conditions from October 7, 2016, to February 5, 2017, the chronology of events from Item 2 above, Condition Report CR-CNS-2017-00553, technical specifications that should have been entered but were not, the reporting requirements of 10 CFR 50.73(a)(2)(i)(B) for conditions prohibited by technical specifications, and 10 CFR 50.73(a)(2)(v)(B) for loss of a safety function. The team concluded that the licensees planned submittal of a licensee event report no later than April 6, 2017, complies with regulatory requirements.

9. Determine whether there were any deficiencies in operator training that

contributed to the RHR minimum flow configuration control problem.

The team reviewed initial operator training materials and continuing training materials for valve operations and the residual heat removal system, including lesson plans, simulator scenarios, and loop flow trainer scenarios. The team also conducted interviews with licensed operators, nonlicensed operators, and instructors. The team observed a training session in the sites loop flow trainer. The team also observed that the site conducted as-found valve position verification scenarios in the loop flow trainer. Inspectors concluded that operator training was adequate and followed a systematic approach to training.

10. Evaluate the licensees compliance with, and adequacy of, procedural guidance for performing system alignments, and for performing equipment tag-outs, as it pertains to the cause(s) of the event. Determine whether the licensees processes for plant configuration control were appropriate.

The team reviewed licensee procedures for system alignments, tag-outs, configuration control, and condition reports written over the previous 2 years addressing issues pertaining to these applicable procedures, and conducted interviews with licensed and nonlicensed operations personnel.

The team conducted field observations of the following activities:

• The Control Room issuing tag-outs

• The Control Room issuing a switch line-up for maintenance restoration

• Operations personnel clearing tags on electrical components and valves

• Operations personnel repositioning valves, using multiple valve position indications to determine initial and final position of the valves, and verifying expected system response The team determined that the licensee is complying with site procedures and has adequate guidance in place with the following exceptions. The team reviewed a self-revealing violation for an inadequate procedure discussed in Section 4OA3 of this report, and two additional minor violations for failure to follow site procedures.

While conducting interviews, a nonlicensed operator disclosed that he had discovered two service water valves (SW-V-105 and SW-V-124) not properly sealed in accordance with Procedure 2.0.2, Conduct of Operations Procedure, Operator Logs and Reports, Revision 110. Step 4.2.2 requires that valve seals be installed in such a manner as to prevent valve operation without breaking the seal. Contrary to the above, these two valves had a chain passing through the handwheel, but the lead wire seal was installed such that it did not prevent operation of the valve without breaking the seal (i.e. there was enough slack in the chain to allow operation of the valve). The operator verified that the valves were in the correct positions and corrected the sealing devices. The licensee entered this issue into their corrective action program as Condition Report CR-CNS-2017-01366. Failure to properly seal the valves constituted a violation of minor significance that is not subject to enforcement action in accordance with Section 2 of the Enforcement Policy. This violation was identified by the licensee and is of minor significance because there was no safety impact to the service water system and because no other instances of valve sealing devices being installed incorrectly were identified.

Additionally, during the interview with same nonlicensed operator, the team questioned whether the operator had initiated a condition report for this identified adverse condition, and he stated that he had not. The licensee investigated this issue and determined that this event occurred either February 20 or 21, 2017, and that since then a sealed valve audit had been performed in which these valves were found in their correct position and sealed correctly per procedure. Additionally, the nonlicensed operator stated that he had contacted the control room about what he had identified in the field, but no control room supervisory personnel from that day could remember talking to the nonlicensed operator about this issue, and a condition report was never initiated for this adverse condition.

The purpose of the special inspection team being on site was to perform follow up from the improper positioning of Division I RHR minimum flow manual isolation valves that were discovered to be sealed in the incorrect position on February 5, 2017. This event underscored the importance of initiating a condition report for such a configuration control condition. Additionally, the nonlicensed operator acted alone to ensure these valves were properly sealed and position-checked without independent verification per station procedure requirements. The licensee entered this issue into their corrective action program as Condition Report CR-CNS-2017-01366.

10 CFR Part 50, Appendix B, Criterion V, Instruction, Procedures, & Drawings, states, in part, that activities affecting quality shall be accomplished in accordance with documented instructions, procedures, or drawings of a type appropriate to the circumstances. Licensee Procedure 0-CNS-LI-102, Corrective Action Process, Revision 6, an Appendix B quality-related procedure, provides instructions for implementing the corrective action program. Step 5.3.6 states, in part, Any individual...who discovers an adverse condition is expectedThe condition is promptly documented on a condition report (no later than the end of shift). Contrary to the above, on February 20 or 21, 2017, an individual who discovered an adverse condition did not promptly document the condition on a condition report. Specifically, a nonlicensed operator failed to initiate a condition report when he had identified two safety-related service water valves that were not properly sealed in place by a chain and a wire seal in accordance with requirements of station procedures. The nonlicensed operator corrected the condition by reinstalling the chain and sealing device to comply with station procedure requirements. Not initiating a condition report for service water valves that were improperly sealed could have prevented the discovery of other possible configuration problems associated with the valves, such as being placed in the incorrect position. The licensee determined that after the date of this event a sealed valve audit had been performed by operations which determined these valves were in their correct position and properly sealed per station procedures. Failure to write a condition report constituted a violation of minor significance that is not subject to enforcement action in accordance with Section 2 of the Enforcement Policy. This violation was identified by the NRC and is of minor significance because there was no safety impact to the service water system and because no other instances of valve sealing devices being installed incorrectly were identified.

11. Determine whether applicable internal or external operating experience involving similar configuration management issues existed, and assess the effectiveness of any action(s) taken by the licensee in response to any such operating experience.

The team reviewed the licensees operating experience program. Specifically, the team reviewed the licensees process for receiving operating experience; the use of industry and site databases for collecting and identifying operating experience; and the process of identifying operating experience applicable to the site, disseminating the information to the appropriate departments, and incorporating the information into procedures and training. The team interviewed the site operating experience coordinator. No deficiencies were identified.

The team determined that configuration control operating experience examples did exist, and that the site had taken appropriate action to incorporate multiple examples into training and procedures.

12. Collect data necessary to support completion of the significance determination process for any associated finding(s). In particular, evaluate the ability of operators to align a flowpath for the affected RHR pumps in design basis accident scenarios before pump damage would occur, including factors such as procedure availability, procedure quality, training, complexity, stress, and available time.

Findings were developed and documented below.

b. Findings

(1) Exceeding the Technical Specification Allowed Out of Service Time of the Division I RHR System

Introduction.

The team reviewed a self-revealed, Green, non-cited violation of Technical Specification (TS) 3.5.1, Emergency Core Cooling Systems (ECCS) - Operating, for the licensees failure to restore the Division I residual heat removal (RHR) system during clearance restoration, which resulted in exceeding the applicable technical specification action completion time. Specifically, from October 7, 2016, to February 5, 2017, the licensee failed to restore Division I RHR minimum flow isolation valves for RHR pumps A and C to the open position prior to reinstalling the valve sealing devices following maintenance performed during Refueling Outage (RE) 29.

Description.

On October 7, 2016, when removing a clearance order during RE 29, operations personnel failed to reposition the Division I RHR minimum flow isolation valves (RHR-V-58 and RHR-V-60) for RHR pumps A and C to the open position prior to reinstalling the valve sealing devices. As a result, these minimum flow paths remained isolated until this condition was discovered during the February 5, 2017, sealed valve audit. Additionally, from November 23 to November 29, 2016, operations personnel conducted a sealed valve audit, which failed to identify that these valves were in the incorrect position. The licensee entered this issue into their corrective action program as Condition Report CR-CNS-2017-00553.

The licensee concluded upon discovery that the unavailability of the Division I RHR subsystem resulted in entry into technical specification actions: 3.5.1, ECCS -

Operating, Condition A, Restore low pressure ECCS injection/spray subsystem(s) to operable status within 7 days; 3.6.1.9, Residual Heat Removal (RHR) Containment Spray, Condition A, Restore RHR containment spray subsystem to operable status within 7 days; and 3.6.2.3, Residual Heat Removal (RHR) Suppression Pool Cooling, Condition A, Restore RHR suppression pool cooling subsystem to operable status within 7 days. The licensee reopened the minimum flow manual isolation valves, made an immediate operability determination that a reasonable assurance of operability of the Division I RHR system existed, and exited the TS actions listed above. This immediate operability call was based on a review of performance data obtained during quarterly surveillance testing done from March 2016 through December 2016. The licensee requested engineering personnel to perform a more detailed review. Additionally, on February 6, 2017, the licensee performed Surveillance Procedure 6.1.RHR.101, RHR Test Mode Surveillance Operation (IST) (DIV 1), Revision 35, a 2-year inservice test (IST) for the Division I RHR system. This test yielded acceptable performance results for the Division I RHR system.

The licensee determined that the affected pumps had been operated 15 times during the time the minimum flow valves were isolated, and that the longest time any pump was continuously operated in this condition was 2 minutes and 18 seconds. They also performed a detailed analysis of the 2-year comprehensive surveillance data, comparing test results from October 2007 through February 6, 2017. The licensees evaluation of operability concluded that no degradation had occurred to the Division I RHR pumps.

The team reviewed the operability determination evaluation and interviewed the site resident inspectors who monitored the February 6, 2017, test. Through a review of the data and the information provided by the site residents, the team determined that the licensees conclusion of operability was reasonable. Also, the team reviewed the licensees extent of condition evaluation for this event and determined that it was appropriate for the safety significance of the event.

Additionally, the team reviewed LCO 3.0.4, which prohibits entry into a mode of applicability of an LCO when that LCO is not met, unless the performance of a risk assessment is completed or actions to be entered permit continued operation in the mode for an unlimited period of time. The licensee entered Mode 2 on November 6, 2016, when they were unaware of the inoperability of the Division I RHR system. They were prohibited by LCO 3.0.4 from entering Mode 2 in this condition since a risk assessment had not been performed.

Analysis.

The licensees failure to properly restore the Division I RHR system during clearance restoration resulted in exceeding the applicable technical specification action completion time, is a violation of TS 3.5.1, which was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the human performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the failure to follow technical specification requirements to ensure the availability, reliability, and capability of the Division I RHR system directly affected the cornerstone objective. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, the inspectors determined that the finding required a detailed risk evaluation because it involved an actual loss of function of at least a single train for greater than its technical specification allowed outage time. A detailed risk evaluation (Attachment 2) calculated an increase in core damage frequency of 4.7E-7 for the 89 days, 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, and 49 minutes exposure period. Therefore, this violation was of very low safety significance (Green).

The team determined the finding had a cross-cutting aspect within the human performance area, challenge the unknown, because individuals failed to perform adequate job-site reviews to identify and resolve unexpected conditions. Specifically, operations personnel restoring the Division I RHR system did not ensure that the minimum flow isolation valves were left in the correct position of sealed open [H.11].

Enforcement.

TS 3.5.1, ECCS - Operating, requires, in part, that each ECCS injection/spray subsystem shall be operable in Modes 1, 2, and 3. TS 3.5.1, Condition A, Required Action A.1, requires that one inoperable low pressure ECCS injection/spray subsystem be restored to an operable status within 7 days. Condition B, Required Actions B.1 and B.2, require that if the required action and associated completion time of Condition A is not met, the unit shall be in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. Contrary to the above, from November 13, 2016, to February 5, 2017, the Division I RHR system was not restored to an operable status within 7 days, and the unit was not placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. Specifically, Division I RHR minimum flow isolation valves (RHR-V-58 and RHR-V-60) for pumps A and C were not restored to the correct position of open prior to reinstalling the valve sealing devices, causing the system to be inoperable. As immediate corrective actions, the licensee restored the Division I RHR subsystem to an operable status by sealing open these minimum flow valves, and assessed operability of pumps A and C. Because this finding was determined to be of very low safety significance (Green) and has been entered into the licensees corrective action program as Condition Report CR-CNS-2017-00553, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy.

(NCV 050000298/2017009-01, Exceeding the Technical Specification Allowed Out of Service Time of the Division I RHR System)

(2) Failure to Implement an Adequate Procedure for Equipment Control

Introduction.

The team reviewed a self-revealed, Green, non-cited violation of Technical Specification 5.4.1.a, Procedures, for the licensees failure to maintain Station Procedure 2.0.2, Conduct of Operations Procedure, Operator Logs and Reports, Revision 106, for conducting sealed valve audits. Specifically, this procedure only checked that the seals were installed, and did not check that the valves where in the correct position. This resulted in an extended period of time that the Division I residual heat removal (RHR) system was unknowingly inoperable.

Description.

On October 7, 2016, when lifting a clearance order during an outage, operations personnel failed to reposition the Division I RHR minimum flow isolation valves (RHR-V-58 and RHR-V-60) for RHR pumps A and C to the open position prior to reinstalling the valve sealing devices. As a result, these minimum flow paths remained isolated until this condition was discovered on February 5, 2017.

Station Procedure 2.0.2, Conduct of Operations Procedure, Operator Logs and Reports, Revision 106, Step 4.4 required that each quarter the sealed valves shall be verified to have a seal properly installed, but did not require that the position of the valves also be checked. From November 23, 2016, to November 29, 2016, the licensee conducted this sealed valve audit in accordance with Step 4.4 of Procedure 2.0.2, and failed to identify the Division I RHR minimum flow isolation valves were in the incorrect position. The following quarter, on February 5, 2017, the licensee again conducted the sealed valve audit and found that the Division I RHR minimum flow isolation valves were in the incorrect position. This procedure inadequacy, to only check that the seals were installed vice also checking valve positions, unnecessarily extended the length of time that the Division I RHR system was unknowingly inoperable. The licensee restored the Division I minimum flow isolation valves to the open position, verified the Division II minimum flow isolation valves were also in the correct position, and revised Procedure 2.0.2 to include direction to check the position of sealed valves in addition to the installation status of the valve sealing devices. While the licensee did revise the procedure, the licensee initially viewed a strict adherence to the language in the procedure to only check that valve seals were installed as acceptable. This was due to the licensees reliance on other processes such as valve lineups and clearance restoration to ensure valves/equipment would be placed in the correct position. The licensee entered this into their corrective action program as Condition Report CR-CNS-2017-00553.

Analysis.

Failure to maintain Station Procedure 2.0.2 for conducting sealed valve audits, in violation of Technical Specification 5.4.1.a, was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it affected the configuration control attribute of the Mitigating Systems Cornerstone and adversely impacted the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the failure to correctly identify and correct out of position Division I RHR minimum flow isolation valves resulted in unnecessarily and unknowingly extending the inoperability time of the Division I RHR system by 39-45 days. Using Inspection Manual Chapter 0609, Attachment 04, Initial Characterization of Findings, and Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, the inspectors determined that the violation required a detailed risk evaluation because the finding represented a loss of safety function for greater than its technical specification allowed outage time. A senior reactor analyst used the same detail risk evaluation from the violation above and determined that the violation was of very low safety significance (Green).

This finding had a cross-cutting aspect within the human performance area, resources, because leaders did not ensure that personnel, equipment, procedures, and other resources were available and adequate to support nuclear safety. Specifically, the licensee had approved Procedure 2.0.2, Conduct of Operations Procedure, Operator Logs and Reports, Revision 106, for conducting sealed valve audits without including the fundamental direction to ensure that the sealed valves were sealed in the correct position [H.1].

Enforcement.

Technical Specification 5.4.1.a, requires, in part, that procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Appendix A to Regulatory Guide 1.33, Quality Assurance Program Requirements, Revision 2, dated February 1978. Regulatory Guide 1.33, Appendix A, Section 1.c, requires procedures for Equipment Control including configuration control activities such as locking and tagging. Contrary to the above, prior to February 24, 2017, the licensee failed to maintain procedures for equipment control.

Specifically, Procedure 2.0.2, Conduct of Operations Procedure, Operator Logs and Reports, Revision 106, did not require that the position of the valves be checked. This resulted in an extended period of time that the Division I RHR system was unknowingly inoperable. The licensee restored compliance by revising the procedure to include direction to check the position of sealed valves in addition to the installation status of the valve sealing devices. Because this violation was of very low safety significance (Green)and has been entered into the licensees corrective action program as Condition Report CR-CNS-2017-00553, this violation is being treated as a non-cited violation (NCV),consistent with Section 2.3.2.a of the NRC Enforcement Policy.

(NCV 05000298/2017009-02, Failure to Implement an Adequate Procedure for Equipment Control)

4OA6 Meetings, Including Exit

Exit Meeting Summary

On May 17, 2017, the inspectors presented the inspection results by telephone to Mr. Ken Higginbotham, Vice President-Nuclear and Chief Nuclear Officer, and other members of the licensee's staff. The licensee acknowledged the issues presented. The inspectors asked whether any of the material examined during the inspection should be considered proprietary.

No proprietary information was identified.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

D. Buman, Director, Nuclear Safety and Assurance

L. Dewhirst, Manager, Corrective Action and Assessment

K. Dia, Director, Engineering

T. Forland, Engineer, Licensing

D. Frankland, Assistant Operation Manager, Training

G. Gardner, Engineering Design Manager

D. Goodman, Manager, Operations

B. Haaelbring, Assistant Operation Manager, Shift

K. Higginbotham, Vice President-Nuclear and Chief Nuclear Officer

R. Kouba, Control Room Supervisor

S. Nelson, Risk and Fire Programs Supervisor

P. Pope, Chief Executive Officer, NPPD

J. Shaw, Licensing Manager

M. Tackett, Outage Manager

C. Walters, System Engineer

M. Wilmers, Design Engineer

NRC Personnel

P Voss, Senior Resident Inspector

LIST OF ITEMS

Opened and Closed

Exceeding the Technical Specification Allowed Out of Service

05000298/2017009-01 NCV Time of the Division I RHR System (Section 4OA3)

Failure to Implement an Adequate Procedure for Equipment

05000298/2017009-02 NCV Control (Section 4OA3)