IR 05000315/2017002

NRC Integrated Inspection Report 05000315/2017002; 05000316/2017002

ML17223A420
Person / Time
Site:	Cook
Issue date:	08/11/2017
From:	Billy Dickson NRC/RGN-III/DRP/B2
To:	Gebbie J Indiana Michigan Power Co
References
IR 2017002
Download: ML17223A420 (56)

Text

UNITED STATES ust 11, 2017

SUBJECT:

DONALD C. COOK NUCLEAR POWER PLANT, UNITS 1 AND 2NRC INTEGRATED INSPECTION REPORT 05000315/2017002; 05000316/2017002

Dear Mr. Gebbie:

On June 30, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Donald C. Cook Nuclear Power Plant, Units 1 and 2. On July 26, 2017, the NRC inspectors discussed the results of this inspection with yourself and other members of your staff.

The enclosed report represents the results of this inspection.

Based on the results of this inspection, the NRC has identified five issues that were evaluated under the risk significance determination process as having very low safety significance (Green). The NRC has also determined that violations are associated with four of these issues.

Additionally, the inspectors identified an issue that was a Severity Level IV violation under the traditional enforcement process. Because the licensee initiated condition reports to address those issues, the violations are being treated as Non-Cited Violations (NCVs), consistent with Section 2.3.2 of the Enforcement Policy. These NCVs are described in the subject inspection report. Further, inspectors documented a licensee-identified violation which was determined to be Severity Level IV. The NRC is treating this violation as an NCV consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to: (1) the Regional Administrator, Region III; (2) the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and (3) the NRC Resident Inspector at the Donald C. Cook Nuclear Power Plant. In addition, if you disagree with the cross-cutting aspect assignment to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region III, and the NRC Resident Inspector at the Donald C. Cook Nuclear Power Plant.

This letter, its enclosure, and your response (if any) will be made available for public inspections and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Billy Dickson, Chief Branch 2 Division of Reactor Projects Docket Nos. 50-315; 50-316 License Nos. DPR-58; DPR-74 Enclosure:

IR 05000315/2017002; 05000316/2017002 cc: Distribution via LISTSERV

SUMMARY

Inspection Report (IR) 05000315/2017002, 05000316/2017002; 04/01/2017 - 06/30/2017;

D. C. Cook Nuclear Power Plant, Units 1 & 2; Heat Sink Performance; Operability Determinations and Functional Assessments; Plant Modifications; Follow-Up of Events and Notices of Enforcement Discretion This report covers a 3-month period of inspection by resident inspectors and announced baseline inspections by regional inspectors. Five Green findings were identified by the inspectors. Four findings involved Non-Cited Violations (NCVs) of the U.S. Nuclear Regulatory Commission (NRC) requirements. The significance of inspection findings is indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) and determined using Inspection Manual Chapter (IMC) 0609, "Significance Determination Process," dated April 29, 2015.

Cross-Cutting aspects are determined using IMC 0310, "Aspects Within the Cross-Cutting Areas," dated December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated February 4, 2015. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 6, dated July 2016.

Cornerstone: Mitigating Systems

Green.

The inspectors identified a finding of very-low safety significance (Green) and associated NCV of Title 10 of the Code of Federal Regulations, (CFR) Part 50, Appendix B, Criterion XI, Test Control, for the licensees failure to establish a heat exchanger monitoring program for the Unit 2 east component cooling water (CCW) heat exchanger that demonstrated it would perform satisfactorily in service and remain operable within its required range of physical conditions for the entire interval between heat exchanger maintenance inspections and cleanings. The licensee entered this finding into their Corrective Action Program (CAP) and, after a review of the Ultimate Heat Sink temperatures, determined the Unit 2 East CCW heat exchanger remained operable because the Ultimate Heat Sink temperatures had remained below the point where operability of the heat exchanger could be challenged.

The performance deficiency was determined to be more-than-minor because it was associated with the Mitigating Systems cornerstone attribute of Equipment Performance and it adversely affected the associated cornerstone objective to ensure the availability, reliability, and capability of the CCW system to respond to initiating events to prevent undesirable consequences. Specifically, the monitoring program established for the Unit 2 East CCW heat exchanger did not ensure its availability, reliability, and capability for the entire interval between heat exchanger maintenance inspections and cleanings.

The finding screened as of very-low safety significance (Green) because although it affected the design or qualification of the Unit 2 East CCW heat exchanger, it did not result in the loss of operability or functionality of the heat exchanger. The inspectors determined this finding had an associated cross-cutting aspect, Design Margins, in the Human Performance cross-cutting area [H.6] because the licensee did not ensure the Unit 2 East CCW heat exchangers heat transfer margin was carefully guarded after discovering excessive tube plugging above the acceptance criteria in 2016. Specifically, special attention was not placed on maintaining the safety-related heat exchanger to ensure it would remain capable of performing its specified safety function within the required range of physical conditions during the entire interval between heat exchanger maintenance inspections and cleanings. (Section 1R07.1.b.(1))

Green.

A finding of very low safety significance was self-revealed on March 23, 2017, when one of the Unit 2 Containment Equalization (CEQ) Fans, 2-HV-CEQ-1, failed its surveillance. Technical Specification (TS) 5.4.1, Procedures, requires that the applicable procedures covered in Regulatory Guide 1.33 are established, implemented, and maintained. Regulatory Guide 1.33 requires that maintenance that can affect the performance of safety-related equipment should be properly preplanned and performed in accordance with documented instructions appropriate to the circumstances. Contrary to these requirements, a preventative maintenance activity to grease the backdraft damper bearings of the CEQ fan resulted in the fan being left inoperable until the next scheduled surveillance approximately a month later. Due to inadequate work instructions, the damper was not cycled enough times following greasing, which resulted in a condition where more force than allowed by the Technical Specifications was required to open the damper. Due to an inadequate post-maintenance test, this was not detected until the next surveillance was performed. Upon failure of the surveillance, technicians re-greased the bearings, cycled the damper, and tested it satisfactorily.

Although qualified, the technicians who first performed the maintenance were unaware of certain nuances associated with the CEQ fan dampers. This information was not described in the work instructions and the post-maintenance test did not validate the opening force. The issue was entered into the CAP and an apparent cause evaluation was performed by the licensee.

The issue was greater than minor because it adversely affected the Procedure Quality attribute of the Mitigating Systems cornerstone. Specifically, the inadequate maintenance procedures adversely affected the availability, reliability, and capability of a system that responds to initiating events to prevent undesirable consequences (i.e., core damage). The finding screened to Green, or very low safety significance, based on IMC 0609 Appendix H, Containment Integrity Significance Determination Process, because CEQ fans are not important contributors to Large Early Release Frequency and Hydrogen Igniters remained available. The inspectors determined there was a cross-cutting aspect associated with the finding, namely, H.5., Work Management.

Specifically, the licensee did not identify and manage risk nor coordinate between different work groups when it was recognized the normal maintenance group would not be working on the CEQ Fan. Further, the apparent cause evaluation identified a need to better coordinate the preventative maintenance activities with the surveillance tests.

(Section 1R15.1.b.(1))

Green.

A self-revealed finding and associated violation occurred on April 2, 2012, when the licensee failed to prevent installation of relays identified in a Part 21. Although the performance deficiency occurred in 2012, the consequence of the error did not manifest until March 2017, when a defective relay caused the Unit 2 control room indicating and display (CRID) 3 inverter to transfer and remain on the alternate power supply. Title 10 CFR 50 Appendix B, Criterion XV requires, in part, that Measures shall be established to control materials, parts, or components which do not conform to requirements in order to prevent their installation. Contrary to this requirement, on April 22, 2012, the licensee failed to prevent installation of an AMETEK board, PC201 with a defective relay. This led to a failure of the CRID 3 inverter on March 27, 2012.

The licensee replaced the circuit board and restored CRID 3 to an operable status.

The inspectors determined that the failure to prevent installation of defective parts into the safety related CRID system was a performance deficiency that warranted a significance determination. Using Attachment 0609.04, Initial Characterization of

Findings, dated October 7, 2016, Table 2, the inspectors determined that the finding affected the Mitigating Systems cornerstone. As a result, the inspectors evaluated the finding using IMC 0609, Attachment 1 Exhibit 2, dated June 19, 2012. The inspectors answered no to all the questions, therefore the finding screened as

Green.

Using Attachment 0609.04, Initial Characterization of Findings, dated October 7, 2016,

Table 2, the inspectors determined that the finding affected the Mitigating Systems cornerstone. The inspectors did not identify a cross-cutting aspect associated with this finding because it was not reflective of current performance. (Section 1R15.1.b(2))

Green.

The inspectors identified a finding of very low safety significance (Green) and an associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the failure to have adequate design control measures verify that the Essential Service Water to Containment Spray (CTS) heat exchanger outlet valves were not leaking in excess of the limits of the Large Break Loss of Coolant Accident (LBLOCA) analysis. This finding was entered into the licensees CAP to evaluate adequate design control measures.

The performance deficiency was determined to be more than minor because the finding was associated with the Mitigating Systems cornerstone attribute of design control and affected the cornerstone objective of ensuring the capability of the CTS system to respond to an initiating event to prevent undesirable consequences. The finding screened as of very low safety significance (Green) because it did not result in the loss of operability or functionality of one of the trains of the CTS system. The inspectors did not identify a cross-cutting aspect associated with this finding because it was not reflective of current performance. (Section 1R18.b.(2))

Green.

A self-revealed finding occurred on March 30, 2017, when operation of a work station for the control room annunciators caused a loss of all annunciators in the Unit 1 control room. Specifically, a software error coupled with an overflowing cache caused a single point failure of the Unit 1 annunciator. When in use by a control room operator,

Server 1 for the annunciator system failed and transferred functions to Server 2.

Server 2 also failed causing a loss of all annunciators for the Unit 1 control room. The licensee restored the system a few hours later and entered the condition into the corrective action program.

The inspectors determined that the failure to design the system to preclude loss of a single active component from causing a loss of the annunciator system was a performance deficiency that warranted a significance determination. Using IMC 0612, the inspectors determined the finding was more than minor because it adversely impacted the mitigating system cornerstone objective to ensure the availability of systems that respond to initiating event. Using IMCC 0609, the inspectors determined that support of the Senior Risk Analyst (SRA) was needed because the condition resulted in the loss of a function, the annunciators. The SRA performed a simple detailed analysis and concluded the finding was of very low safety significance. The inspectors did not identify a cross-cutting aspect associated with this finding because it was not reflective of current performance. (Section 4OA3)

Miscellaneous

• SL IV. The inspectors identified a Severity Level IV Violation of 10 CFR Part 50.46,

Acceptance Criteria for Emergency Core Cooling Systems for Light-Water Nuclear Power Reactors. Specifically, the licensee failed to report the effects of the errors in the

LBLOCA Evaluation Model for the Unit 1 emergency core cooling systems. The inspectors determined that the failure to estimate and report the errors in the LBLOCA analyses were contrary to the requirements of 10 CFR 50.46 and was a performance deficiency.

The performance deficiency was determined to be minor because the failure to report was not willful, did not impact a performance indicator, was not a material condition issue which could lead to a more significant safety issue, and did not impact the Mitigating Systems cornerstone objectives. The inspectors determined the failure to report was a Severity Level IV violation in accordance with Section 6.9 of the Enforcement Policy. A cross-cutting aspect was not assigned since the performance deficiency is minor. (1R18.b.(2))

Other Findings

Violations of very low safety or security significance or Severity Level IV that were identified by the licensee have been reviewed by the NRC. Corrective actions taken or planned by the licensee have been entered into the licensees CAP. These violations and CAP tracking numbers are listed in Section 4OA7 of this report.

REPORT DETAILS

Summary of Plant Status

Unit 1 Unit 1 remained at or near 100 percent power for the inspection period.

Unit 2 Unit 2 remained at or near 100 percent power for the inspection period.

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R01 Adverse Weather Protection

.1 Readiness of Offsite and Alternate AC Power Systems

a. Inspection Scope

The inspectors verified that plant features for operation and continued availability of offsite and onsite alternate alternating current (AC) power systems during the summer season were appropriate. The inspectors verified the licensees procedures affecting these areas and the communications protocols between the transmission system operator and the plant had not changed since the last review.

Documents reviewed are listed in the Attachment to this report. The inspectors performed a walkdown of the switchyard and various transformers. Outstanding work orders (WOs) and condition reports affecting offsite power equipment were also reviewed. The inspectors also reviewed corrective action program (CAP) items to verify that the licensee was identifying adverse weather issues at an appropriate threshold and entering them into their CAP in accordance with station corrective action procedures.

This inspection constituted one readiness of offsite and alternate AC power systems sample as defined in Inspection Procedure (IP) 71111.01-05.

b. Findings

No findings were identified.

.2 Readiness for Impending Adverse Weather ConditionSevere Thunderstorm Watch

a. Inspection Scope

Since thunderstorms with potential tornados and high winds were forecast in the vicinity of the facility for April 6 through 10, the inspectors reviewed the licensees overall preparations/protection for the expected weather conditions. On April 6 and 7, the inspectors walked down the service water screen house because their safety-related functions could be affected or required as a result of high winds and rough lake conditions. The inspectors evaluated the licensee staffs preparations against the sites procedures and determined that the staffs actions were adequate. During the inspection, the inspectors focused on plant-specific design features and the licensees procedures used to respond to specified adverse weather conditions. The inspectors evaluated operator staffing and accessibility of materials and indications for those systems required to control the plant. Additionally, the inspectors reviewed the Updated Final Safety Analysis Report (UFSAR) and performance requirements for systems selected for inspection, and verified that operator actions were appropriate as specified by plant specific procedures. The inspectors also reviewed a sample of CAP items to verify that the licensee identified adverse weather issues at an appropriate threshold and dispositioned them through the CAP in accordance with station corrective action procedures. Documents reviewed are listed in the Attachment to this report.

This inspection constituted one readiness for impending adverse weather condition sample as defined in IP 71111.01-05.

b. Findings

No findings were identified.

1R04 Equipment Alignment

.1 Quarterly Partial System Walkdowns

a. Inspection Scope

The inspectors performed partial system walkdowns of the following risk-significant systems:

• Security electrical distribution;

• Unit 2 east essential service water; and

• Unit 1 west charging system with east out of service.

The inspectors selected these systems based on their risk significance relative to the Reactor Safety cornerstones at the time they were inspected. The inspectors attempted to identify any discrepancies that could impact the function of the system and, therefore, potentially increase risk. The inspectors reviewed applicable operating procedures, system diagrams, UFSAR, Technical Specification (TS) requirements, outstanding WOs, condition reports, and the impact of ongoing work activities on redundant trains of equipment in order to identify conditions that could have rendered the systems incapable of performing their intended functions. The inspectors also walked down accessible portions of the systems to verify system components and support equipment were aligned correctly and operable. The inspectors examined the material condition of the components and observed operating parameters of equipment to verify that there were no obvious deficiencies. The inspectors also verified that the licensee had properly identified and resolved equipment alignment problems that could cause initiating events or impact the capability of mitigating systems or barriers and entered them into the CAP with the appropriate significance characterization. Documents reviewed are listed in the to this report.

These activities constituted three partial system walkdown samples as defined in IP 71111.04-05.

b. Findings

No findings were identified.

.2 Semi-Annual Complete System Walkdown

a. Inspection Scope

On May 8, 2017, the inspectors finished a complete system alignment inspection of the Unit 1 Train A and Train B direct current electrical distribution system to verify the functional capability of the system. This system was selected because it was considered both safety significant and risk significant in the licensees probabilistic risk assessment.

The inspectors walked down the system to review mechanical and electrical equipment lineups; electrical power availability; system pressure and temperature indications, as appropriate; component labeling; component lubrication; component and equipment cooling; hangers and supports; operability of support systems; and to ensure that ancillary equipment or debris did not interfere with equipment operation. A review of a sample of past and outstanding WOs was performed to determine whether any deficiencies significantly affected the system function. In addition, the inspectors reviewed the Corrective Action Plan (CAP) database to ensure that system equipment alignment problems were being identified and appropriately resolved. Documents reviewed are listed in the Attachment to this report.

These activities constituted one complete system walkdown sample as defined in IP 71111.04-05.

b. Findings

No findings were identified.

1R05 Fire Protection

.1 Routine Resident Inspector Tours

a. Inspection Scope

The inspectors conducted fire protection walkdowns which were focused on availability, accessibility, and the condition of firefighting equipment in the following risk-significant plant areas:

• Unit 1 auxiliary cable vault;

• Unit 2 auxiliary cable vault;

• Unit 1 AB emergency diesel generator (EDG); and

• Unit 2 AB EDG.

The inspectors reviewed areas to assess if the licensee had implemented a fire protection program that adequately controlled combustibles and ignition sources within the plant, effectively maintained fire detection and suppression capability, maintained passive fire protection features in good material condition, and implemented adequate compensatory measures for out-of-service, degraded or inoperable fire protection equipment, systems, or features in accordance with the licensees fire plan.

The inspectors selected fire areas based on their overall contribution to internal fire risk as documented in the plants Individual Plant Examination of External Events with later additional insights, their potential to impact equipment which could initiate or mitigate a plant transient, or their impact on the plants ability to respond to a security event.

Using the documents listed in the Attachment to this report, the inspectors verified that fire hoses and extinguishers were in their designated locations and available for immediate use; that fire detectors and sprinklers were unobstructed; that transient material loading was within the analyzed limits; and fire doors, dampers, and penetration seals appeared to be in satisfactory condition. The inspectors also verified that minor issues identified during the inspection were entered into the licensees CAP. Documents reviewed are listed in the Attachment to this report.

These activities constituted four quarterly fire protection inspection samples as defined in IP 71111.05-05.

b. Findings

No findings were identified.

1R07 Heat Sink Performance

.1 Triennial Review of Heat Sink Performance

a. Inspection Scope

The inspectors reviewed completed surveillances, vendor manual information, associated calculations, performance test results, and inspection results associated with the 1(2)-HE-47EDG combustion air after coolers and the 1(2)-HV-AFP-T1AC and 1(2)-HV-AFP-T2ACturbine driven auxiliary feed pump (TDAFP) room coolers. These coolers were chosen based on their risk-significance in the licensees probabilistic safety analysis, their important safety-related mitigating system support functions, and their operating history.

For the EDG combustion air after coolers and the TDAFP coolers, the inspectors reviewed the testing, inspection, maintenance, and monitoring of biotic fouling and macrofouling programs to assess the heat transfer capability of the heat exchangers.

The inspectors reviewed whether:

(1) the methods used to inspect and clean the heat exchangers were consistent with as found conditions identified and expected degradation trends;

(2) the licensees inspection and cleaning activities had established acceptance criteria; and

(3) the as found results were recorded, evaluated, and dispositioned such that the as left condition was consistent with the established criteria.

In addition, the inspectors reviewed the condition and operation of the EDG combustion air after coolers and the TDAFP coolers to determine consistency with design assumptions in heat transfer calculations and as described in the UFSAR. The inspectors reviewed whether the licensee evaluated the potential for water hammer, and reviewed periodic flow testing at or near maximum design flow for both heat exchangers.

In addition, Eddy Current Test Reports and visual inspection records were reviewed to determine the structural integrity of the heat exchangers.

For the EDG combustion air after coolers, the inspectors reviewed the number of plugged tubes to ensure:

(1) they were within the pre-established limits;

(2) they were based on the heat transfer capacity of the heat exchanger; and

(3) they were a part of the design heat transfer assumptions for the heat exchanger. The inspectors also verified that the number of plugged tubes was appropriately accounted for in the heat exchanger performance calculations.

The inspectors reviewed the performance of Ultimate Heat Sink (UHS) and safety-related service water systems and their subcomponents such as piping, intake screens, pumps, valves, etc. by tests or other equivalent methods to ensure availability and accessibility to the inplant cooling water systems. Specifically, the inspectors reviewed the UHS in accordance with U.S. Nuclear Regulatory Commission (NRC)

Inspection Procedure 71111.07, Heat Sink Performance, Section 02.02, Sub-Sections d.4 and d.6.

The inspectors reviewed the licensees operation of the service water system and UHS.

This included a review of procedures for a loss of the service water system or UHS, and a review of the availability and functionality of instrumentation which is relied upon for decision making. In addition, the inspectors assessed whether macrofouling was adequately monitored, trended, and controlled by the licensee to prevent clogging. The inspectors reviewed whether the licensees biocide treatments for biotic control were adequately conducted and the results monitored, trended, and evaluated. The inspectors reviewed the service water systems susceptibility to strong pump-weak pump interaction. In addition, the inspectors reviewed design changes to the service water system and the UHS to verify they were not adversely impacted by the changes.

The inspectors performed a system walkdown of the service water and closed cooling water systems to assess their structural integrity. In addition, the inspectors reviewed:

(1) available testing and inspections results;

(2) the licensee's disposition of any active thru wall pipe leaks; and

(3) the history of thru wall pipe leakage to identify any adverse trends since the last NRC inspection. For the closed cooling water system, the inspectors reviewed operating logs and interviewed the system engineer, to identify adverse make-up trends that could be indicative of excessive leakage out of the closed system. For buried or inaccessible piping, the inspectors reviewed the licensee's pipe testing, inspection, or monitoring program to verify structural integrity, and to ensure that any leakage or degradation was appropriately identified and dispositioned by the licensee. The inspectors reviewed whether the periodic piping inspection program adequately detected and corrected protective coating failure, corrosion, and erosion.

The inspectors also reviewed operational history and in service testing vibration monitoring results for the deep draft vertical pumps to ensure the licensee adequately monitored and resolved any adverse trends related to them.

In addition, the inspectors reviewed corrective action documents related to heat exchangers, coolers, and heat sink performance issues to verify that the licensee had an appropriate threshold for identifying issues and to evaluate the effectiveness of their corrective actions. The documents that were reviewed are included in the Attachment to this report.

These inspection activities constituted three heat sink inspection samples as defined in Inspection Procedure (IP) 71111.07-05.

b. Findings

Failure to Ensure the Unit 2 Component Cooling Water Heat Exchangers Monitoring Program Could Demonstrate Its Continued Operability Between Maintenance Intervals

Introduction:

The inspectors identified a finding of very-low safety significance (Green)and associated Non-Cited Violation (NCV) of 10 Code of Federal Regulations (CFR) 50, Appendix B, Criterion XI, Test Control. The licensee failed to establish a heat exchanger Monitoring Program for the Unit 2 East component cooling water (CCW) heat exchanger that demonstrated it would perform satisfactorily in service and remain operable within its required range of physical conditions for the entire interval between heat exchanger maintenance inspections and cleanings.

Description:

The CCW system provides cooling to safety-related heat loads by transferring the heat from the components to the essential service water (ESW) system through the CCW heat exchangers. The system has two independent trains per unit (East and West), each capable of meeting all design basis heat load requirements.

Theres a total of four CCW heat exchangers, one per train. The heat exchangers are of the shell and tube type and ESW circulates through the tubes while CCW circulates through the shell side. The heat exchangers are cooled by the ESW system which is a raw water system that uses Lake Michigan as the UHS. Therefore, the heat exchangers are included in the sites Generic Letter (GL) 89-13 Program. The licensee performs maintenance inspections and cleanings of the heat exchangers every refueling outage, in lieu of thermal performance testing, as part of their heat exchanger monitoring program to ensure the heat exchangers maintain their heat transfer capability as discussed in GL 89-13, Service Water System Problems Affecting Safety-Related Equipment.

During the 2015 Unit 2 refueling outage, while performing the maintenance inspections, the licensee identified that both the East and West CCW heat exchangers were plugged with beachgrass, a type of grass found in Lake Michigan, in excess of the tube plugging limit allowed for the heat exchangers. In accordance with Calculation MD-12-MSC-068-N, Tube Plugging Allowances for Safety-Related Heat Exchangers, the CCW heat exchangers are only allowed a total of 67 plugged tubes to ensure they remain capable of performing their specified safety function within the required range of physical conditions they can be subjected to. Those physical conditions include a maximum UHS temperature of 88.8 degrees Fahrenheit. The licensee generated corrective action documents Action Request (AR) 2015-4207 and AR 2015-4872 for the failure to meet the heat exchangers tube plugging limit acceptance criteria. As a corrective action, the licensee implemented periodic flushing of the heat exchangers to prevent the accumulation of the beachgrass on the heat exchanger tubesheets.

During the 2016 Unit 2 refueling outage, the East CCW heat exchanger was again found to be plugged with beachgrass in excess of the tube plugging limit. Therefore, the previous corrective action to periodically flush the heat exchangers was not sufficient to prevent the excessive accumulation of beachgrass on the Unit 2 East CCW heat exchanger tubesheet. The licensee generated corrective action document AR 2016-12568 for the failure to meet the heat exchangers tube plugging limit criteria.

As a corrective action, the licensee planned to revise the tube plugging limit analysis to regain margin and increase the amount of tube plugging allowed for the CCW heat exchangers.

During a review of AR 2016-12568, the inspectors identified that no additional corrective actions had been taken to address the excessive accumulation of beachgrass on the Unit 2 East heat exchanger in excess of the tube plugging limit between the heat exchanger refueling outage maintenance inspections and cleanings. The corrective action planned had not been completed, and there were no actions to ensure the Unit 2 East heat exchanger would remain capable of performing its specified safety function within the required range of physical conditions it could be subjected to during the entire interval between heat exchanger maintenance inspections and cleanings. As discussed in GL 89-13, licensees should determine the best frequency for testing to provide assurance that the equipment will perform the intended safety functions during the intervals between tests. Therefore, the licensee failed to establish a heat exchanger Monitoring Program for the Unit 2 East CCW heat exchanger that demonstrated it would perform satisfactorily in service during the entire interval between its maintenance inspections and cleanings.

The issue was entered into the licensees CAP as AR 2017-6226. The licensees immediate corrective action was to review the UHS temperature to ensure that it was below the temperature that could challenge operability of the Unit 2 East CCW heat exchanger assuming a maximum number of plugged tubes (as observed during the 2016 Unit 2 East CCW heat exchanger inspection). Lower UHS temperatures increase the amount of plugged tubes allowed for the CCW heat exchangers. The licensees planned corrective action is to regain margin in the heat exchanger analyses in order to increase the amount of tube plugging allowed between heat exchanger inspections.

During the exit, the licensee discussed with the inspectors the installation of an additional CCW heat exchanger as another potential, long-term corrective action.

Analysis:

The inspectors determined the failure to establish a heat exchanger monitoring program for the Unit 2 East CCW heat exchanger that demonstrated it would perform satisfactorily in service and remain operable within its required range of physical conditions for the entire interval between heat exchanger maintenance inspections and cleanings, was contrary to 10 CFR Part 50, Appendix B, Criterion XI, Test Control, and was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Mitigating Systems cornerstone attribute of Equipment Performance and it adversely affected the associated cornerstone objective to ensure the availability, reliability, and capability of the CCW system to respond to initiating events to prevent undesirable consequences. Specifically, the monitoring program established for the Unit 2 East CCW heat exchanger did not ensure its availability, reliability, and capability for the entire interval between heat exchanger maintenance inspections and cleanings.

The inspectors determined the finding could be evaluated using the Significance Determination Process in accordance with Inspection Manual Chapter (IMC) 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings. Because the finding impacted the Mitigating Systems cornerstone, the inspectors screened the finding through Inspection Manual Chapter 0609 Appendix A, The Significance Determination Process for Findings At-Power, using Exhibit 2, Mitigating Systems Screening Questions. The finding screened as of very low safety significance (Green) because although it affected the design or qualification of the Unit 2 East CCW heat exchanger, it did not result in the loss of operability or functionality of the heat exchanger. Specifically, the licensee determined the Unit 2 East CCW heat exchanger remained operable because the UHS temperature had remained below the point (below 82 degrees) where operability of the heat exchanger could be challenged.

The inspectors determined this finding had an associated cross-cutting aspect, Design Margins, in the Human Performance cross-cutting area because the licensee did not ensure the Unit 2 East CCW heat exchangers heat transfer margin was carefully guarded after discovering excessive tube plugging above the acceptance criteria in 2016. Specifically, special attention was not placed on maintaining the safety-related heat exchanger to ensure it would remain capable of performing its specified safety function within the required range of physical conditions during the entire interval between heat exchanger maintenance inspections and cleanings. [H.6]

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion XI, Test Control, requires, in part, that a test program shall be established to assure all testing required to demonstrate structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents.

Contrary to the above, after October 31, 2016, the licensee failed to establish a heat exchanger monitoring program for the Unit 2 East CCW heat exchanger that demonstrated it would perform satisfactorily in service. Specifically, the heat exchanger monitoring program could not demonstrate the Unit 2 East CCW heat exchanger would perform satisfactorily in service and remain operable within its required range of physical conditions for the entire interval between heat exchanger maintenance inspections and cleanings.

The licensees immediate corrective action was to review the UHS temperature to ensure that it was below the temperature that could challenge operability of the Unit 2 east CCW heat exchanger. The licensees planned corrective action is to regain margin in the heat exchanger analyses in order to increase the amount of tube plugging allowed between heat exchanger maintenance inspections and cleanings. During the exit, the licensee discussed with the inspectors the installation of an additional CCW heat exchanger as another potential, long-term corrective action they were pursuing.

Because this violation was of very-low safety significance, and was entered into the licensees Corrective Action Program as AR 2017-6226, this violation is being treated as an NCV, consistent with Section 2.3.2.a of the NRC Enforcement Policy.

(NCV 05000315/2017002-01; 05000316/2017002-01 Failure to Ensure the Unit 2 Component Cooling Water Heat Exchanger Monitoring Program Could Demonstrate Its Continued Operability Between Maintenance Intervals)

1R11 Licensed Operator Requalification Program

.1 Resident Inspector Quarterly Review of Licensed Operator Requalification

a. Inspection Scope

On April 25, 2017, the inspectors observed a crew of licensed operators in the plants simulator during licensed operator requalification training. The inspectors verified that operator performance was adequate, evaluators were identifying and documenting crew performance problems, and that training was being conducted in accordance with licensee procedures. The inspectors evaluated the following areas:

• licensed operator performance;

• crews clarity and formality of communications;

• ability to take timely actions in the conservative direction;

• prioritization, interpretation, and verification of annunciator alarms;

• correct use and implementation of abnormal and emergency procedures;

• control board manipulations;

• oversight and direction from supervisors; and

• ability to identify and implement appropriate Technical Specification (TS) actions and Emergency Plan actions and notifications.

The crews performance in these areas was compared to pre-established operator action expectations and successful critical task completion requirements. Documents reviewed are listed in the Attachment to this report.

This inspection constituted one quarterly licensed operator requalification program simulator sample as defined in Inspection Procedure (IP) 71111.11

b. Findings

No findings were identified.

.2 Resident Inspector Quarterly Observation During Periods of Heightened Activity or Risk

a. Inspection Scope

On June 2, 2017, the inspectors observed Unit 2 main turbine stop and control valve testing. This was an activity that required heightened awareness or was related to increased risk, and involved a reduction in power. The inspectors evaluated the following areas:

• licensed operator performance;

• crews clarity and formality of communications;

• ability to take timely actions in the conservative direction;

• prioritization, interpretation, and verification of annunciator alarms (if applicable);

• correct use and implementation of procedures;

• control board (or equipment) manipulations;

• oversight and direction from supervisors; and

• ability to identify and implement appropriate TS actions and Emergency Plan actions and notifications (if applicable).

The performance in these areas was compared to pre-established operator action expectations, procedural compliance and task completion requirements. Documents reviewed are listed in the Attachment to this report.

This inspection constituted one quarterly licensed operator heightened activity/risk sample as defined in IP 71111.11-05.

b. Findings

No findings were identified.

1R12 Maintenance Effectiveness

.1 Routine Quarterly Evaluations

a. Inspection Scope

The inspectors evaluated degraded performance issues involving the following risk-significant systems:

• Unit 1 emergency core cooling system in yellow health; and

• delivery valve holder procurement and replacement on EDGs.

The inspectors reviewed events such as where ineffective equipment maintenance had resulted in valid or invalid automatic actuations of engineered safeguards systems and independently verified the licensee's actions to address system performance or condition problems in terms of the following:

• implementing appropriate work practices;

• identifying and addressing common cause failures;

• scoping of systems in accordance with 10 CFR 50.65(b) of the maintenance rule;

• characterizing system reliability issues for performance;

• charging unavailability for performance;

• trending key parameters for condition monitoring;

• ensuring 10 CFR 50.65(a)(1) or (a)(2) classification or re-classification; and

• verifying appropriate performance criteria for structures, systems, and components (SSCs)/functions classified as (a)(2), or appropriate and adequate goals and corrective actions for systems classified as (a)(1).

The inspectors performed a quality review for the delivery valve holders, as discussed in IP 71111.12, Section 02.02.

The inspectors assessed performance issues with respect to the reliability, availability, and condition monitoring of the system. In addition, the inspectors verified maintenance effectiveness issues were entered into the Corrective Action Plan (CAP) with the appropriate significance characterization. Documents reviewed are listed in the to this report.

This inspection constituted two quarterly maintenance effectiveness samples, one of which also satisfied the quality control sample element as defined in IP 71111.12-05.

b. Findings

No findings were identified.

1R13 Maintenance Risk Assessments and Emergent Work Control

.1 Maintenance Risk Assessments and Emergent Work Control

a. Inspection Scope

The inspectors reviewed the licensee's evaluation and management of plant risk for the maintenance and emergent work activities affecting risk-significant and safety-related equipment listed below to verify that the appropriate risk assessments were performed prior to removing equipment for work:

• Fire main and diesel outage, week of April 10;

• Unit 2 ESW outage week of May 15;

• reserve feed outage, primary power operated relief valve, and battery charger work week of May 1;

• standby diesel generator emergent work/solid state protection system testing May 26, 2017; and

• 1-MRV-210 steam generator stop valve off open seat.

These activities were selected based on their potential risk significance relative to the Reactor Safety cornerstones. As applicable for each activity, the inspectors verified that risk assessments were performed as required by 10 CFR 50.65(a)(4) and were accurate and complete. When emergent work was performed, the inspectors verified that the plant risk was promptly reassessed and managed. The inspectors reviewed the scope of maintenance work, discussed the results of the assessment with the licensee's probabilistic risk analyst or shift technical advisor, and verified plant conditions were consistent with the risk assessment. The inspectors also reviewed TS requirements and walked down portions of redundant safety systems, when applicable, to verify risk analysis assumptions were valid and applicable requirements were met.

Documents reviewed during this inspection are listed in the Attachment to this report.

These maintenance risk assessments and emergent work control activities constituted five samples as defined in IP 71111.13-05.

b. Findings

No findings were identified.

1R15 Operability Determinations and Functional Assessments

.1 Operability Evaluations

a. Inspection Scope

The inspectors reviewed the following issues:

• Part 21 on relays used in control room indicating and display (CRIDs);

• past operability evaluation for EDG delivery valve holder failures;

• past operability regarding failure of a containment equalization fan;

• Unit 2 turbine driven auxiliary feedwater pump slow start and flow questions;

• potential leakage in Unit 2 reactor coolant pump thermal barrier heat exchanger;

• Unit 1 CCW system leakage;

• Unit 1 steam generator stop valve found off open seat; and

• 2CD EDG fuel racks went to open position upon EDG shutdown.

The inspectors selected these potential operability issues based on the risk significance of the associated components and systems. The inspectors evaluated the technical adequacy of the evaluations to ensure that TS operability was properly justified and the subject component or system remained available such that no unrecognized increase in risk occurred. The inspectors compared the operability and design criteria in the appropriate sections of the TS and Updated Final Safety Analysis Report (UFSAR) to the licensees evaluations to determine whether the components or systems were operable. Where compensatory measures were required to maintain operability, the inspectors determined whether the measures in place would function as intended and were properly controlled. The inspectors determined, where appropriate, compliance with bounding limitations associated with the evaluations. Additionally, the inspectors reviewed a sampling of corrective action documents to verify that the licensee was identifying and correcting any deficiencies associated with operability evaluations.

Documents reviewed are listed in the Attachment to this report.

This operability inspection constituted eight samples as defined in IP 71111.15-05.

b. Findings

(1) Unit 2 Containment Equalization Fan Failed Surveillance

Introduction:

A finding of very low safety significance (Green) with an associated Non-Cited Violation (NCV) of TS 5.4.1, Procedures, was self-revealed when a Unit 2 containment equalization (CEQ) fan failed a surveillance. Specifically, due to inadequate work instructions, previous maintenance was not properly performed on the fan.

Description:

On March 23, 2017, plant personnel performed a TS surveillance test on 2-HV-CEQ-1, one of the two CEQ fans in the Unit 2 containment. During accidents, the safety-related CEQ fans act to circulate the atmosphere from the upper containment compartment to the lower compartment. This helps to eliminate hydrogen pocketing, assists in the containment ice melting process, and facilitates iodine removal. To meet TS surveillance test requirements (SR 3.6.10.3), part of the surveillance test verifies that the associated backdraft damper opens at an applied force less than or equal to 11.0 pounds. For the March 23, 2017, surveillance test, the backdraft damper on 2-HV-CEQ-1 did not meet the surveillance test acceptance criteria, opening with 11.5 pounds of force versus a maximum allowed of 10.75 pounds. In reviewing the issue, the licensee discovered that the previous maintenance activity that lubricated/greased the bearings for the backdraft damper was performed on February 25, 2017. The work was performed by the Fix-it-Now team instead of the group usually assigned to work on ventilation systems. The licensees apparent cause evaluation determined that although the Fix-it-Now team workers were qualified to perform the bearing work, they were unaware of certain nuances associated with the CEQ fan bearings. Specifically, the bearings usually required numerous cycles by hand after greasing to ensure the grease was evenly distributed. Uneven distribution could affect the force required to open the damper. Due to vague language in the work instructions, the workers were hesitant to excessively cycle the damper after greasing it, and the work instructions did not specify how many times to cycle the damper. Further, the maintenance activity did not have a post-maintenance test associated with it to verify that the damper would open at the correct force after the work had been done on the bearings. After identification of the issue on March 23, 2017, the licensee properly greased the bearings and tested the damper satisfactorily. The licensee also reviewed past maintenance activities and surveillances for the other dampers to ensure there were no operability concerns with those CEQ fans.

Analysis:

Performance of maintenance on a safety-related CEQ fan which left it inoperable until discovered by a subsequent surveillance test was a performance deficiency warranting review. The issue was greater than minor because it adversely affected the Procedure Quality attribute of the Mitigating Systems cornerstone.

Specifically, the inadequate maintenance procedures adversely affected the availability, reliability, and capability of a system that responds to initiating events to prevent undesirable consequences (i.e., core damage). The finding screened to Green, or very low safety significance, based on IMC 0609 Appendix H, Containment Integrity Significance Determination Process, dated May 6, 2004. Specifically, the inspectors determined the finding was Type B, meaning there was no impact on core damage frequency but a possible impact on Large Early Release Frequency (LERF). Utilizing Table 4.1, the CEQ fan was classified as a component that was not an important contributor to LERF, therefore, the finding screened to Green. The result was also reviewed with a regional Senior Risk Analyst (SRA).

The inspectors determined there was a cross-cutting aspect associated with the finding, namely, H.5., Work Management. Specifically, the licensee did not identify and manage risk nor coordinate between different work groups when it was recognized the normal maintenance group would not be working on the CEQ Fan. Further, the apparent cause evaluation identified a need to better coordinate the preventative maintenance activities with the surveillance tests.

Enforcement:

TS 5.4.1, Procedures, states, in part, that procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978.

Regulatory Guide 1.33 states, in part, that maintenance that can affect the performance of safety-related equipment should be properly preplanned and performed in accordance with documented instructions appropriate to the circumstances. Contrary to the above, on February 25, 2017, work instructions were utilized for preventative maintenance on a safety-related CEQ fan which left the fan inoperable until discovered and corrected on March 23, 2017. Technicians re-greased the bearings, tested the opening force, and returned the fan to service after the failed surveillance. The licensee also entered the issue into their CAP as AR-2017-3181. This violation is being treated as an NCV, consistent with Section 2.3.2.a of the Enforcement Policy.

(NCV 05000316/2017002-02; Unit 2 CEQ Fan Failed Surveillance).

(2) Failure to Identify Parts Subject to A Part 21

Introduction:

A self-revealed green finding and associated NCV occurred on April 2, 2012, when the licensee failed to prevent installation of relays identified in a Part 21. Although the performance deficiency occurred in 2012, the consequence of the error did not manifest until March 2017, when a defective relay caused the Unit 2 CRID 3 inverter to transfer and remain on the alternate power supply.

Discussion: On March 27, 2017, the Unit 2 CRID 3 inverter transferred from the normal 250 VDC source to the alternate 120VAC source (non-vital power supply). Although similar transfers had previously occurred, in this instance the CRID did not transfer back to the normal power supply. The licensee entered Limiting Condition for Operations 3.8.7 Condition A and began troubleshooting the CRID. During the troubleshooting, the licensee identified that a Part 21 issued on January 26, 2009, listed a relay installed in the inverter as susceptible to an aging mechanism that can cause erratic operation. The licensee replaced the card with the discrepant relay and restored the CRID to operable.

A subsequent engineering apparent cause evaluation (EACE) confirmed the cause. In the EACE, the licensee included the following timeline:

• 11/6/2002- seven new PC-201 static switch boards received;

• 1/26/2009- AMETEK issues part 21, event number 44805; the PC-201 boards contain relays that are the subject of the part 21;

• 10/13/2009- licensee initiates action request to evaluate the Part 21;

• 4/2/2012- 2-CRID-3-INV PC-201 static switch board replaced as routine maintenance; the replacement board was one received in 2002;

• 8/31/2015- EACE 2015-6542 written to address a failed capacitor; this was a missed opportunity to prevent the 2017 failure because the EACE identified that use of newly procured parts can improve reliability;

• 3/26/2017- Unit 2 CRID 3 inverter transferred to alternate power supply; the inverter transferred back to the normal supply a few minutes later; and

• 3/27/2017- Unit 2 CRID 3 inverter transfers to the alternate supply; licensee declares the inverter inoperable.

As part of corrective actions, the licensee continued replacement of relays addressed in by the Part 21.

The licensee determined that the actions taken to address the Part 21 were not sufficiently comprehensive to identify relays installed on components. Although the licensee evaluated the Part 21, the licensee failed to identify that the subject relays were installed on circuit boards and not as separately stock parts. The Part 21 states that the relays can be installed in equipment and that faulty relays are a subcomponent of AMETEK battery chargers, inverters and uninterruptible power supplies.

Analysis:

The inspectors determined that the failure to prevent installation of defective parts into the safety related CRID system was a performance deficiency that warranted a significance determination. Using Inspection Manual Chapter (IMC) 0612, Appendix B dated September 7, 2012, the inspectors determined the finding was more than minor because it adversely impacted the Mitigating System cornerstone objective to ensure the availability of systems that respond to initiating event. The failure is associated with equipment performance attribute in the availability area. Specifically, the issue resulted in loss of CRID-3. The inspectors determined that the finding could be evaluated using the Significance Determination Process (SDP) in accordance with IMC 0609, Significance Determination Process. Using Attachment 0609.04, Initial Characterization of Findings, dated October 7, 2016, Table 2, the inspectors determined that the finding affected the Mitigating Systems cornerstone. As a result, the inspectors evaluated the finding using IMC 0609, Attachment 1 Exhibit 2 dated June 19, 2012. The inspectors answered no to all the questions, therefore the finding screens as Green.

The inspectors determined that the finding did not have an associated cross cutting aspect since the performance was not reflective of current licensee performance. The inspectors also reviewed subsequent Action Requests (AR) and determined that none of the issues evaluated under the ARs had sufficient nexus to the performance deficiency to warrant a cross cutting aspect.

Enforcement:

Title 10 CFR 50 Appendix B, Criterion XV requires, in part, that Measures shall be established to control materials to control materials, parts, or components which do not conform to requirements in order to prevent their installation.

Contrary to this requirement, on April 2, 2012, the licensee failed to prevent installation of an AMETEK board, PC012 with a defective relay. The licensee installed the board into CRID IV and the CRID became inoperable on March 27, 2017 because of the defective part.

Because this violation was of very low safety significance and was entered into the licensees CAP as AR 2017-3314, this violation is being treated as an NCV, consistent with Section 2.3.2 of the Enforcement Policy. (NCV 05000315/2017002-03; 05000316/2017002-03, Failure to Identify Parts Subject to a Part 21).

1R18 Plant Modifications

a. Inspection Scope

The inspectors reviewed the following modifications:

• Design Changes EC-0000051509, Unit 1 LBLOCA [Large Break Loss of Coolant Accident] Analysis LOTIC2 Error Fix, Revision 0 and EC-0000050387, Implementation of Unit 2 Best-Estimate Large Break LOCA Analysis, Revision 0.

The inspectors reviewed the configuration changes against the design basis, the UFSAR, and the Technical Specification (TS), as applicable to verify that the modification did not affect the operability or availability of the affected system. The inspectors, as applicable observed completed work activities to ensure that the modifications were installed as directed and consistent with the design control documents; the modifications operated as expected; post-modification testing adequately demonstrated continued system operability, availability, and reliability; and that operation of the modifications did not impact the operability of any interfacing systems. As applicable, the inspectors verified that relevant procedure, design, and licensing documents were properly updated. Lastly, the inspectors discussed the plant modification with operations, engineering, and training personnel to ensure that the individuals were aware of how the operation with the plant modification in place could impact overall plant performance. Documents reviewed are listed in the Attachment to this report.

This inspection did not constitute a permanent plant modification sample as defined in Inspection Procedure (IP) 71111.18-05. The sample was documented in inspection report 05000315/2013005; 05000316/2013005.

b. Findings

(1) Failure to Report Deficiencies as Required by 10 CFR 50.46

Introduction:

The inspectors identified a Severity Level IV NCV of 10 CFR Part 50.46, Acceptance Criteria for Emergency Core Cooling Systems for Light-Water Nuclear Power Reactors. Specifically, the licensee failed to report the effects of the errors in the LBLOCA evaluation model for the Unit 1 emergency core cooling system as required by 10 CFR 50.46.

Description:

When performing the LBLOCA analyses to support power uprate, the licensees vendor (Westinghouse) identified two errors which impacted the results of these analyses. Specifically, the evaluation model used was the Automated Statistical Treatment of Uncertainty Method (ASTRUM) which is based on non-parametric order statistics, using a realistic best estimate computer code called WCOBRA/TRAC. The ASTRUM evaluation method used a legacy code called LOTIC2 to determine a containment back-pressure boundary condition for input into the WCOBRA/TRAC code.

LOTIC2 was designed to maximize heat transfer for the containment environment to both active and passive heat sinks. Westinghouse identified the LOTIC2 calculations did not include the safety injection spill mass and energy releases. Including this spill mass in the LOTIC2 calculation would cause a non-conservative decrease in containment back-pressure. In addition, Westinghouse identified an incorrect energy conversion factor. On August 25, 2010, Westinghouse informed the licensee by letter NF-AE-10-90 of the errors in the Unit 1 and 2 LBLOCA analyses which affected the Unit 1 analyses which had been approved by the Nuclear Regulatory Commission (NRC) on October 17, 2008 (ML082670351). Attached to the letter NF-AE-10-90 was a Reasonable Assurance of Safe Operation which stated in the Background section that:

Since the possibility exists for the predicted Peak Cladding Temperature (PCT) to exceed 2200°F using an NRC-approved evaluation model based on a realistic computer code, at this point in the investigation, it is considered appropriate to communicate this issue. Westinghouse presented the licensee with a reasonable assurance of safe operation based on conservatisms within the analyses.

Once the licensee selected a resolution path (identified the single failure to assume),

Westinghouse also identified an approach to address the errors. On August 23, 2011, the licensee received the Westinghouse analysis in letter NF-AE-11-102. The letter stated that in order to maintain the PCT of 2128°F, the containment spray (CTS)delivered temperature would need to be revised from 45°F to 65°F at a flow rate of 3300 gpm. In order to implement this approach, the licensee concluded the best method was to close the Essential Service Water (ESW) outlet valves from the CTS heat exchanger during Modes 1 through 4, which would result in ESW being isolated during the injection phase after a loss of cooling accident. As a result, the lowest CTS temperature would be the minimum TS temperature of 70°F for the reactor water storage tank thus satisfying the need to maintain temperature above 65°F. These actions bounded the Westinghouse recommendation such that the ASTRUM analysis, which had been submitted to the NRC, remained valid. The licensee modified the plant (revised the normal position of the outlet valves, revised operating procedures, and placed CTS pumps in pull-to-lock when ESW flow was directed through the CTS heat exchangers) to keep the analyzed PCT at 2128°F.

The inspectors identified the licensee failed to estimate the effect of any error in an acceptable evaluation model to determine if the change or error is significant.

Specifically, on August 30, 2011, (ML11252B081), the licensee submitted on the docket to the NRC the Unit 1 Annual Report of Loss of Cooling Accident Evaluation Model Changes for calendar year 2010. In that letter, the licensee stated the initial method for resolving the errors consisted of changing the limiting single failure assumed in the analyses. This method resulted in no impact on the calculated PCT. Therefore the errors are not included in the enclosed Unit 1 LBLOCA PCT summary for 2010. The inspectors noted the licensee had not evaluated the impact of the errors assuming the as-found conditions, that is, the licensee evaluated the impact on the PCT after changes were made to the plant but did not evaluate the impact on the PCT considering the conditions in place at the time of discovery. The inspectors noted the PCT documented in the evaluation model of October 17, 2008, was 2128°F. Based on the letter NF-AE-10-90, the inspectors concluded the errors could result in the PCT to increase toward 2200°F. In addition, the inspectors reviewed the maintenance records for the ESW outlet valves from the CTS heat exchanger and noted instances (prior to August 2011) where leakage past these valves exceeded 1000 gpm. This leakage challenges the assumed CTS delivered temperature of 65°F. The licensee did not consider this leakage or the operating practice to open/throttle these valves during normal operation.

Analysis:

The inspectors determined that the failure to estimate and report the errors in the loss of cooling accident analyses were contrary to the requirements of 10 CFR 50.46 and were performance deficiencies.

Violations of 10 CFR 50.46 are dispositioned using the traditional enforcement process in addition to the SDP because they are considered to be violations that potentially impede or impact the regulatory process. The performance deficiency will be evaluated by the SDP and communicated with an SDP color reflective of the safety impact of the deficient licensee performance. The SDP, however, does not specifically consider the regulatory process impact. Thus, although related to a common regulatory concern, it is necessary to address the violation and finding using different processes to correctly reflect both the regulatory importance of the violation and the safety significance of the associated finding.

Section 6.9 of the Enforcement Policy stated the failure to make a required report that, had it been submitted, would have resulted in, for instance, increasing the inspection scope of the next regularly scheduled inspection or a request for additional information was an example of a Severity Level IV violation. After consultation with the then Project Manager in the Office of Nuclear Reactor Regulation, and considering a modification was needed to obtain acceptable analytical results, the inspectors determined the estimated change in peak cladding temperature would likely have resulted in additional questions or inspection. Therefore, the inspectors determined the failure to report was a Severity Level IV violation in accordance with the Enforcement Policy.

The performance deficiency was determined to be minor in that the failure to report was not willful; did not impact a performance indicator; was not a material condition issue which could lead to a more significant safety issue, and did not impact the Mitigating Systems cornerstone objectives. A cross-cutting aspect was not assigned since the performance deficiency is minor.

Enforcement:

Title 10 CFR 50.46(a)(3)(i) stated the licensee shall estimate the effect of any error in an acceptable evaluation model to determine if the change or error is significant. Title 10 CFR 50.46(a)(3)(ii) required the licensee to report all errors and estimated effects at least annually and If the change or error is significant, the applicant or licensee shall provide this report within 30 days and include with the report a proposed schedule for providing a reanalysis or taking other action as may be needed to show compliance with § 50.46 requirements.

Contrary to the above, from August 25, 2010 to August 23, 2011; the licensee failed to report Unit 1 LBLOCA Analyses errors as required by 10 CFR 50.46(a)(3)(i) and 10 CFR 50.46(a)(3)(ii). Specifically, from August 25, 2010 to August 23, 2011; the licensee failed to estimate and report within 30 days errors in the Unit 1 and 2 ASTRUM LBLOCA analyses (known as LOTIC2 errors), which non-conservatively affected the Unit 1 ASTRUM LBLOCA analyses.

This violation is being treated as an NCV consistent with Section 2.3.2 of the Enforcement Policy because it was of very low safety significance and was entered into the licensees CAP as AR 2017-5427. (NCV 05000315/2017002-04; NCV 05000316/2017002-04, Failure to Report Deficiencies as Required by 10 CFR 50.46)

(2) Inadequate Design Control Measures to Ensure Leakage Remained Within Analysis

Introduction:

The inspectors identified a finding of very low safety significance (Green)and an associated Non-Cited Violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to have adequate design control measures. Specifically, the licensee did not establish design control measures to ensure the ESW to CTS heat exchanger outlet valves were not leaking in excess of the limits determined in the LBLOCA analysis.

Description:

On August 25, 2010, Westinghouse informed the licensee of errors (known as LOTIC2 errors), which non-conservatively affected the LBLOCA analyses. In a subsequent analysis dated May 20, 2011, the licensee concluded the LOTIC2 errors would be corrected if the CTS system flow was maintained at or above 65º F during the injection phase of a LBLOCA.

The licensee changed the plant design to require the ESW to CTS heat exchanger outlet valves to remain closed during the injection phase of a LBLOCA, to ensure a CTS temperature of at least 65º F. The licensee subsequently revised the Unit 1 and Unit 2 ESW Operating procedures on April 30, 2012 and June 29, 2011, respectively, to maintain these valves in the closed position. This analysis also noted limits on valve leakage to ensure the minimum system temperature would be maintained.

The inspectors reviewed the calculation in Design Information Transmittal DIT-B-03459 dated June 14, 2011 and noted that leakage as little as 487 gpm through one valve could invalidate the LBLOCA analysis if the lake water temperature was about 32º F.

When asked about leak monitoring, the licensee stated that although the instrumentation is not adequate to accurately measure leakage, sufficient monitoring by operators and the system engineer ensured gross leakage would be identified prior to system performance degradation. The licensee stated no direct flow measurement was possible; however, temperature indication provided on the CTS process side of the heat exchangers would indicate the presence of a leak. Although the CTS side of these heat exchangers is not filled with CTS process fluid, thermal conductivity through the heat exchanger and attached piping would allow leak detection of the ESW outlet valves by trending CTS heat exchanger inlet and outlet temperatures. The licensee provided graphs which showed the relationship between the lake temperature with the inlet and outlet heat exchanger temperatures and demonstrated detection of leakage. The licensee also stated local observation of sweating on the CTS heat exchanger and ESW return line or cavitation noise through the outlet valves would also indicate a potential leak through the valves. However, the inspectors noted these methods of detecting the leakage lacked the rigor needed to ensure the assumption in the analysis was supported. Specifically, the licensee was unable to determine whether observed leakage exceeded design values; therefore could not ensure the plant remained bounded by their analysis.

Analysis:

The inspectors determined the licensees failure to have adequate design control measures to ensure the design bases for the CTS system was maintained was contrary to 10 CFR Part 50, Appendix B, Criterion III, and was a performance deficiency.

Specifically, the licensee did not establish design control measures to ensure the ESW to CTS heat exchanger outlet valves were not leaking in excess of the limits determined in the LBLOCA analysis. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Reactor Safety, Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of the CTS system to respond to initiating events to prevent undesirable consequences. Specifically, not specifying adequate leakage detection and monitoring methods failed to assure the CTS system was being maintained within the assumptions of the Unit 1 and 2 LBLOCA analyses.

The inspectors determined the finding could be evaluated using the SDP in accordance with Inspection Manual Chapter (IMC) 0609, Significance Determination Process, 0609.04, Initial Characterization of Findings. Specifically, the inspectors used IMC 0609 Appendix A SDP for Findings At-Power Exhibit 2, Mitigating Systems Screening Questions. The inspectors determined the finding was of very low safety significance (Green) because it did not result in the loss of operability or an actual loss of one of the trains of the CTS system.

The inspectors did not identify a cross-cutting aspect associated with this finding because the finding was not representative of the licensees present performance.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, requires, in part, that measures shall be established which provide for verifying or checking the adequacy of design. Design Information Transmittal DIT-B-03459 dated June 14, 2011 establish conditions to maintain the validity of the LBLOCA analysis. Specifically, the analysis remained valid if leakage passed the ESW to CTS heat exchanger Outlet Valves did not exceed 487 gpm with lake temperature of 32º F.

Contrary to the above, from August 25, 2010, through November 5, 2013, the licensee failed to establish design control measures to verify the adequacy of design.

Specifically, the licensee failed to have adequate methods to verify that the ESW to CTS heat exchanger outlet valves were not leaking in excess of the limits of the LBLOCA analysis. This violation is being treated as an NCV, consistent with Section 2.3.2 of the Enforcement Policy because it was of very low safety significance and was entered into the licensees Corrective Action Program as Action Request (AR) 2013-17091. In addition, the licensee planned to determine alternate flow measurement capabilities with adequate accuracy to ensure acceptable leakage. The licensee was also considering replacing the current valves with one without rubber seats to eliminate potential for rapid degradation. (NCV 05000315/2017002-05; 05000316/2017002-05, Inadequate Design Control Measures to Ensure Leakage Remained Within Analysis)

1R19 Post-Maintenance Testing

.1 Post-Maintenance Testing

a. Inspection Scope

The inspectors reviewed the following post-maintenance activities to verify that procedures and test activities were adequate to ensure system operability and functional capability:

• Unit 1 east Component Cooling Water (CCW) system valve maintenance;

• fuel injector replacements on Unit 2 CD Emergency Diesel Generator (EDG);

• Unit 2 reserve feed preventative maintenance; and

• Unit 2 control room instrumentation distribution-1 relay replacements.

These activities were selected based upon the structure, system, or component's ability to impact risk. The inspectors evaluated these activities for the following (as applicable):

the effect of testing on the plant had been adequately addressed; testing was adequate for the maintenance performed; acceptance criteria were clear and demonstrated operational readiness; test instrumentation was appropriate; tests were performed as written in accordance with properly reviewed and approved procedures; equipment was returned to its operational status following testing (temporary modifications or jumpers required for test performance were properly removed after test completion); and test documentation was properly evaluated. The inspectors evaluated the activities against TSs, the Updated Final Safety Analysis Report (UFSAR), 10 CFR Part 50 requirements, licensee procedures, and various NRC generic communications to ensure that the test results adequately ensured that the equipment met the licensing basis and design requirements. In addition, the inspectors reviewed corrective action documents associated with post-maintenance tests to determine whether the licensee was identifying problems and entering them in the CAP and that the problems were being corrected commensurate with their importance to safety. Documents reviewed are listed in the Attachment to this report.

This inspection constituted four post-maintenance testing samples as defined in IP 71111.19-05.

b. Findings

No findings were identified.

1R22 Surveillance Testing

.1 Surveillance Testing

a. Inspection Scope

The inspectors reviewed the test results for the following activities to determine whether risk-significant systems and equipment were capable of performing their intended safety function and to verify testing was conducted in accordance with applicable procedural and TS requirements:

• Unit 2 Containment Equalization (CEQ) Fan damper surveillance (routine);

• suspected leakage through Unit 1 pressurizer power operated relief valve (reactor coolant system leakage); and

• Unit 2 Control Room envelope leakage testing (routine).

The inspectors observed in-plant activities and reviewed procedures and associated records to determine the following:

• did preconditioning occur;

• the effects of the testing were adequately addressed by control room personnel or engineers prior to the commencement of the testing;

• acceptance criteria were clearly stated, demonstrated operational readiness, and were consistent with the system design basis;

• plant equipment calibration was correct, accurate, and properly documented;

• as-left setpoints were within required ranges; and the calibration frequency was in accordance with TSs, the USAR, procedures, and applicable commitments;

• measuring and test equipment calibration was current;

• test equipment was used within the required range and accuracy; applicable prerequisites described in the test procedures were satisfied;

• test frequencies met Technical Specification (TS) requirements to demonstrate operability and reliability; tests were performed in accordance with the test procedures and other applicable procedures; jumpers and lifted leads were controlled and restored where used;

• test data and results were accurate, complete, within limits, and valid;

• test equipment was removed after testing;

• where applicable for in service testing activities, testing was performed in accordance with the applicable version of Section XI, American Society of Mechanical Engineers code, and reference values were consistent with the system design basis;

• where applicable, test results not meeting acceptance criteria were addressed with an adequate operability evaluation or the system or component was declared inoperable;

• where applicable for safety-related instrument control surveillance tests, reference setting data were accurately incorporated in the test procedure;

• where applicable, actual conditions encountering high resistance electrical contacts were such that the intended safety function could still be accomplished;

• prior procedure changes had not provided an opportunity to identify problems encountered during the performance of the surveillance or calibration test;

• equipment was returned to a position or status required to support the performance of its safety functions; and

• all problems identified during the testing were appropriately documented and dispositioned in the CAP.

Documents reviewed are listed in the Attachment to this report.

This inspection constituted two routine surveillance testing samples and one reactor coolant system leak detection inspection sample as defined in Inspection Process (IP) 71111.22, Sections-02 and-05.

b. Findings

No findings were identified.

1EP6 Drill Evaluation

.1 Emergency Preparedness Drill Observation

a. Inspection Scope

The inspectors evaluated the conduct of routine licensee emergency drills on May 1 and on June 26, 2017, to identify any weaknesses and deficiencies in classification, notification, and protective action recommendation development activities. The inspectors observed emergency response operations in the control room simulator, emergency operations facility, technical support center and Operations Support Center to determine whether the event classification, notifications, and protective action recommendations were performed in accordance with procedures. The inspectors also attended the licensee drill critiques to compare any inspector-observed weaknesses with those identified by the licensee staff in order to evaluate the critique and to verify whether the licensee staff was properly identifying weaknesses and entering them into the corrective action program. As part of the inspection, the inspectors reviewed the drill package and other documents listed in the Attachment to this report.

These emergency preparedness drill inspections constituted two samples as defined in IP 71114.06-05.

b. Findings

No findings were identified.

2RS3 In-Plant Airborne Radioactivity Control and Mitigation

.1 Engineering Controls (02.02)

a. Inspection Scope

The inspectors reviewed procedural guidance for use of ventilation systems, and assessed whether the systems were used, to the extent practicable, during high-risk activities to control airborne radioactivity and minimize the use of respiratory protection.

The inspectors assessed whether installed ventilation airflow capacity, flow path, and filter/charcoal unit efficiencies for selected systems were consistent with maintaining concentrations of airborne radioactivity in work areas below the concentrations of an airborne area to the extent practicable. The inspectors also evaluated whether selected temporary ventilation systems used to support work in contaminated areas were consistent with licensee procedural guidance and as-low-as-reasonably-achievable.

The inspectors reviewed select airborne monitoring protocols to assess whether alarms and set points were sufficient to prompt worker action. The inspectors assessed whether the licensee established trigger points for evaluating levels of airborne beta-emitting and alpha-emitting radionuclides.

These inspection activities constituted one complete sample as defined in IP 71124.03-05.

b. Findings

No findings were identified.

.2 Use of Respiratory Protection Devices (02.03)

a. Inspection Scope

The inspectors assessed whether the licensee provided respiratory protection devices for those situations where it was impractical to employ engineering controls such that occupational doses were as-low-as-reasonably-achievable. For select instances where respiratory protection devices were used, the inspectors assessed whether the licensee concluded that further engineering controls were not practical. The inspectors also assessed whether the licensee had established means to verify that the level of protection provided by the respiratory protection devices was at least as good as that assumed in the work controls and dose assessment.

The inspectors assessed whether the respiratory protection devices used to limit the intake of radioactive materials were certified by the National Institute for Occupational Safety and Health/Mine Safety and Health Administration or have been approved by the Nuclear Regulatory Commission (NRC). The inspectors evaluated whether the devices were used consistent with their Occupational Safety and Health/Mine Safety and Health Administration certification or any conditions of their NRC-approval.

The inspectors reviewed records of air testing for supplied-air devices and self-contained breathing apparatus (SCBA) bottles to assess whether the air used met or exceeded Grade D quality. The inspectors evaluated whether plant breathing air supply systems satisfied the minimum pressure and airflow requirements for the devices.

The inspectors evaluated whether selected individuals qualified to use respiratory protection devices had been deemed fit to use the devices by a physician.

The inspectors observed selected individuals donning, doffing, and functionally checking respiratory protection devices as appropriate and assessed whether these individuals knew how to safely use the device and how to properly respond to any device malfunction or unusual occurrence.

The inspectors observed the physical condition of respiratory protection devices ready for issuance and reviewed records of routine inspection for selected devices. The inspectors reviewed records of maintenance on the vital components for selected devices and assessed whether onsite personnel assigned to repair vital components received vendor-provided training.

These inspection activities constituted one complete sample as defined in IP 71124.03-05.

b. Findings

No findings were identified.

.3 Self-Contained Breathing Apparatus for Emergency Use (02.04)

a. Inspection Scope

The inspectors reviewed the status and surveillance records for select SCBAs. The inspectors evaluated the licensees capability for refilling and transporting SCBA air bottles to and from the control room and operations support center during emergency conditions.

The inspectors assessed whether control room operators and other emergency response and radiation protection personnel were trained and qualified in the use of SCBAs and evaluated whether personnel assigned to refill bottles were trained and qualified for that task.

The inspectors assessed whether appropriate mask sizes and types were available for use. The inspectors evaluated whether on-shift operators had no facial hair that would interfere with the sealing of the mask and that appropriate vision correction was available.

The inspectors reviewed the past 2 years of maintenance records for selected in-service SCBA units used to support operator activities during accident conditions.

The inspectors assessed whether maintenance or repairs on an SCBA units vital components were performed by an individual certified by the manufacturer of the device to perform the work. The inspectors evaluated the onsite maintenance procedures governing vital component work to determine whether there was any inconsistencies with the SCBA manufacturers recommended practices. The inspectors evaluated whether SCBA cylinders satisfied the hydrostatic testing required by the U.S. Department of Transportation.

These inspection activities constituted one complete sample as defined in IP 71124.03-05.

b. Findings

No findings were identified.

.4 Problem Identification and Resolution (02.05)

a. Inspection Scope

The inspectors assessed whether problems associated with the control and mitigation of in-plant airborne radioactivity were being identified by the licensee at an appropriate threshold and were properly addressed for resolution. Additionally, the inspectors evaluated the appropriateness of the corrective actions for selected problems involving airborne radioactivity documented by the licensee.

These inspection activities constituted one complete sample as defined in IP 71124.03-05.

b. Findings

No findings were identified.

2RS4 Occupational Dose Assessment

.1 Source Term Characterization (02.02)

a. Inspection Scope

The inspectors evaluated whether the licensee had characterized the radiation types and energies being monitored and that the characterization included gamma, beta, hard-to-detects, and neutron radiation.

The inspectors assessed whether the licensee had developed scaling factors for including hard-to-detect nuclide activity in internal dose assessments.

These inspection activities constituted one complete sample as defined in IP 71124.04-05.

b. Findings

No findings were identified.

.2 External Dosimetry (02.03)

a. Inspection Scope

The inspectors evaluated whether the licensees dosimetry vendor was National Voluntary Laboratory Accreditation Program accredited and if the approved irradiation test categories for each type of personnel dosimeter used were consistent with the types and energies of the radiation present and the way the dosimeter was being used.

The inspectors evaluated the onsite storage of dosimeters before their issuance, during use, and before processing/reading. For personal dosimeters stored on-site during the monitoring period, the inspectors evaluated whether they were stored in low dose areas with control dosimeters. For personal dosimeters that are taken off-site during the monitoring period, the inspectors evaluated the guidance provided to individuals with respect to care and storage of the dosimeter.

The inspectors evaluated the calibration of active dosimeters. The inspectors assessed the bias of the active dosimeters compared to passive dosimeters and the correction factor used. The inspectors also assessed the licensees program for comparing active and passive dosimeter results, investigations for substantial differences, and recording of dose. The inspectors assessed whether there were adverse trends for active dosimeters.

These inspection activities constituted one complete sample as defined in IP 71124.04-05.

b. Findings

No findings were identified.

.3 Internal Dosimetry (02.04)

a. Inspection Scope

The inspectors reviewed procedures used to assess internal dose using whole body counting equipment to evaluate whether the procedures addressed methods for differentiating between internal and external contamination, the release of contaminated individuals, the route of intake and the assignment of dose. The inspectors assessed whether the frequency of measurements was consistent with the biological half-life of the nuclides available for intake. The inspectors reviewed the licensee's evaluation for use of portal radiation monitors as a passive monitoring system to determine if instrument minimum detectable activities were adequate to detect internally deposited radionuclides sufficient to prompt additional investigation. The inspectors reviewed whole body counts and evaluated the equipment sensitivity, nuclide library, review of results, and incorporation of hard-to-detect radionuclides.

The inspectors reviewed select analyses for adequacy and assessed the laboratorys Cross-Check Program to ensure quality assurance.

The inspectors reviewed the licensee's program for dose assessment based on air sampling, as applicable, and calculations of derived air concentration. The inspectors determined whether flow rates and collection times for air sampling equipment were adequate to allow lower limits of detection to be obtained. The inspectors also reviewed the adequacy of procedural guidance to assess internal dose if respiratory protection was used.

The inspectors reviewed select internal dose assessments and evaluated the monitoring protocols, equipment, and data analysis.

These inspection activities constituted one complete sample as defined in IP 71124.04-05.

b. Findings

No findings were identified.

.4 Special Dosimetric Situations (02.05)

a. Inspection Scope

The inspectors assessed whether the licensee informs workers of the risks of radiation exposure to the embryo/fetus, the regulatory aspects of declaring a pregnancy, and the specific process to be used for declaring a pregnancy. The inspectors selected individuals who had declared pregnancy during the current assessment period and evaluated whether the monitoring program for declared pregnant workers was technically adequate to assess the dose to the embryo/fetus. The inspectors assessed results and/or monitoring controls for compliance with regulatory requirements.

The inspectors reviewed the licensee's methodology for monitoring external dose in non-uniform radiation fields or where large dose gradients exist. The inspectors evaluated the licensee's criteria for determining when alternate monitoring was to be implemented. The inspectors reviewed dose assessments performed using multibadging to evaluate whether the assessment was performed consistently with licensee procedures and dosimetric standards.

The inspectors reviewed select shallow dose equivalent dose assessments for adequacy.

The inspectors evaluated the licensees program for neutron dosimetry, including dosimeter types and/or survey instrumentation. The inspectors reviewed select neutron exposure situations and assessed whether dosimetry and/or instrumentation was appropriate for the expected neutron spectra, there was sufficient sensitivity, and neutron dosimetry was properly calibrated. The inspectors also assessed whether interference by gamma radiation had been accounted for in the calibration and whether time and motion evaluations were representative of actual neutron exposure events.

For the special dosimetric situations reviewed in this section, the inspectors assessed how the licensee assigned dose of record. This included an assessment of external and internal monitoring results, supplementary information on individual exposures, and radiation surveys and/or air monitoring results when dosimetry was based on these techniques.

These inspection activities constituted one complete sample as defined in IP 71124.04-05.

b. Findings

No findings were identified.

.5 Problem Identification and Resolution (02.06)

a. Inspection Scope

The inspectors assessed whether problems associated with occupational dose assessment were being identified by the licensee at an appropriate threshold and were properly addressed for resolution. The inspectors assessed the appropriateness of the corrective actions for a selected sample of problems documented by the licensee involving occupational dose assessment.

These inspection activities constituted one complete sample as defined in Inspection Procedure (IP) 71124.04-05.

b. Findings

No findings were identified.

OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Security

4OA1 Performance Indicator Verification

.1 Reactor Coolant System Specific Activity

a. Inspection Scope

The inspectors sampled licensee submittals for the reactor coolant system specific activity Performance Indicator for Donald C. Cook Nuclear Power Plant Units 1 and 2 for the period from the first quarter 2016 through the first quarter 2017. The inspectors used Performance Indicator definitions and guidance contained in the Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, dated August 2013, to determine the accuracy of the Performance Indicator data reported during those periods. The inspectors reviewed the licensees reactor coolant system chemistry samples, technical specification requirements, issue reports, event reports and NRC Integrated Inspection Reports to validate the accuracy of the submittals. The inspectors also reviewed the licensees issue report database to determine if any problems had been identified with the Performance Indicator data collected or transmitted for this indicator. In addition to record reviews, the inspectors observed a chemistry technician obtain and analyze a reactor coolant system sample.

Documents reviewed are listed in the Attachment to this report.

This inspection constituted two reactor coolant system specific activity samples as defined in IP 71151-05.

b. Findings

No findings were identified.

4OA2 Identification and Resolution of Problems

.1 Routine Review of Items Entered into the Corrective Action Program

a. Inspection Scope

As discussed in previous sections of this report, the inspectors routinely reviewed issues during baseline inspection activities and plant status reviews to verify they were being entered into the licensees corrective action program at an appropriate threshold, adequate attention was being given to timely corrective actions, and adverse trends were identified and addressed. Some minor issues were entered into the licensees corrective action program as a result of the inspectors observations; however, they are not discussed in this report.

These routine reviews for the identification and resolution of problems did not constitute any additional inspection samples. Instead, by procedure they were considered an integral part of the inspections performed during the quarter.

b. Findings

No findings were identified.

.2 Semi-Annual Trend Review

a. Inspection Scope

The inspectors performed a review of the licensees corrective action program and associated documents to identify trends that could indicate the existence of a more significant safety issue. The inspectors review was focused on repetitive equipment issues, but also considered the results of daily inspector corrective action program item screening discussed in Section 4OA2.1 above, licensee trending efforts, and licensee human performance results. The inspectors review nominally considered the 6-month period of January 2017 through June 2017, although some examples expanded beyond those dates where the scope of the trend warranted.

The review also included issues documented outside the corrective action program in major equipment problem lists, repetitive and/or rework maintenance lists, departmental problem/challenges lists, system health reports, quality assurance audit/surveillance reports, self-assessment reports, and Maintenance Rule assessments. The inspectors compared and contrasted their results with the results contained in the licensees corrective action program trending reports. Corrective actions associated with a sample of the issues identified in the licensees trending reports were reviewed for adequacy.

During review of the site Nuclear Oversite departments quarterly reports, the inspectors noted some observations that were made regarding adherence to various site processes. The comments appeared to line up with inspector observations regarding weaknesses in following station processes that were noted throughout the first and second quarter of 2017. Further, the inspectors noted several Action Requests (ARs)through the daily reviews that pointed at instances of failure to follow certain station processes. All of the examples centered on administrative-type procedures rather than station operational or maintenance procedures. For example, NRC Inspection Report 05000315/2017001; 05000316/2017001 described a finding in Section 4OA2 regarding EDG parts that were not properly assessed/controlled. The finding involved multiple issues regarding adherence to station processes for the corrective action and commercial grade dedication programs. Other instances included a licensee-identified finding in the same report for a failure to follow work management processes and an inspector observation regarding conduct of the Failure Investigation Process.

The Nuclear Oversite Department quarterly reports had similar examples spanning multiple departments. There were a couple examples of the Field Change Notice process not being followed when certain engineering changes needed to be modified.

Additionally, there were comments about traceability of parts and lubricants not being documented per station procedures in some cases. Other examples included not always following the processes for evaluating discrepant conditions for Operable-But Degraded components, not following labeling procedures, and not understanding all the requirements for work order package closeout. Outside of the aforementioned findings which have been previously documented, the inspectors did not identify instances where there was a major impact to the plant, nor where equipment was rendered inoperable because of a failure to follow a certain process. However, the examples do represent a potential trend that could lead to more significant issues if not corrected.

This review constituted one semi-annual trend review inspection sample as defined in IP 71152.

b. Findings

No findings were identified.

.3 Annual Follow-up of Selected Issues: Failure Investigation Process Documentation

a. Inspection Scope

The inspectors selected the following condition reports for in-depth review:

• Failure to Retain Failure Investigation Process (FIP) documents During the first quarter of 2017, the inspectors identified that the licensee was not following their internal procedure for use of the failure investigation process. In particular, the inspectors identified that the licensee was not entering documents into the corrective action program as required by procedure. The inspectors reviewed the requirements of 10 Code of Federal Regulations (CFR) 50 Appendix B criterion XVII, quality assurance records and determined that some of the activities conducted under the FIP affected quality and criterion XVII requires that records of those activities be maintained. After informed by the inspectors of the deviations from the procedural requirements, the licensee entered the issues into the corrective action program.

As part of their review, the licensee identified 96 FIP teams over the past 3 years. The licensee staff reviewed the associated ARs to determine if any of the FIPs generated calculations or evaluations that had not been captured as a quality record. The inspectors reviewed a sample of the population to determine if the licensee retained records that supported the conclusions of the FIP. The inspectors determined that although the licensee did not follow the FIP procedure, information entered into the corrective action program encompassed information addressing the conclusions of the FIP. In addition, work on the systems of interest occurred under the work control process which is an Appendix B program. For the samples reviewed, the inspectors did not identify any evidence that records required under Appendix B had been omitted from an Appendix B program.

The inspectors also verified the following attributes during their review of the licensee's corrective actions:

• consideration of the extent of condition, generic implications, common cause, and previous occurrences;

• classification and prioritization of the resolution of the problem commensurate with safety significance;

• identification of the causes of the problem;

• identification of corrective actions, which were appropriately focused to correct the problem;

• completion of corrective actions in a timely manner commensurate with the safety significance of the issue;

• effectiveness of corrective actions taken to preclude repetition; and

• evaluate applicability for operating experience and communicate applicable lessons learned to appropriate organizations.

The inspectors discussed the corrective actions and associated evaluations with licensee personnel.

This review constituted one in-depth problem identification and resolution inspection sample as defined in IP 71152.

b. Findings

No findings were identified.

4OA3 Follow-Up of Events and Notices of Enforcement Discretion

.1 Unusual Event Declaration on Loss of Annunciators

a. Inspection Scope

On March 30, 2017, the inspectors responded to the site following declaration of an unusual event following loss of annunciators for Unit 1. The inspectors documented the immediate event follow up in Inspection Report 05000315/316-2017001. At the time, the inspectors could not evaluate the enforcement ramifications because the licensee had not completed a causal analysis of the event. The inspectors have reviewed the licensee causal analysis and concluded the event did not include a violation of regulatory requirements; however, a finding does exist, as described below. The inspectors also reviewed the licensees determination that a licensee event report was not required. The inspectors determined that 10 CFR 50.73 does not require a report.

This event follow-up review constituted one sample as defined in IP 71153-05.

b. Findings

(1) Single Point Failure Vulnerability In Annunciator System

Introduction:

A self-revealed finding occurred on March 30, 2017, when operation of a work station for the control room annunciators caused a loss of all annunciators in the Unit 1 control room. Specifically, a software error coupled with an overflowing cache caused a single point failure of the Unit 1 annunciator.

Discussion: On March 30, a control room operator used the annunciator work station for the balance of plant operator. During this use, Server 1 for the annunciator system failed and transferred functions to Server 2. Server 2 also failed causing a loss of all annunciators for the Unit 1 control room. The licensee entered multiple alarm response procedures and took the actions described within them. The licensee also declared an unusual event per the site approved emergency plan. The licensee reset the servers and at 0817 exited the unusual event. The licensee determined that data points in the system were flagged as analog when they were digital points.

The licensee designed the annunciator system with redundant servers with the intent that the system would continue to operate with a loss of a server. Section 1.1.5 of the design description states: Loss of a single active component does not cause loss of the overall annunciator system. However, the software used for the system contained a flaw that allowed normal use of a workstation to cause a complete loss of annunciators.

The licensee also identified in their cause analysis a contributing cause of overflowing system caches. The later issue can be resolved by periodic restarts of the computer system. Because the licensee established a standard of redundancy on the annunciator, the inspectors concluded the licensee violated a self-imposed standard.

The licensee has since corrected the programming error.

Analysis:

The inspectors determined that the failure to design the system to preclude loss of a single active component from causing a loss of the annunciator system was a performance deficiency that warranted a significance determination. Using Inspection Manual Chapter (IMC) 0612, Appendix B, dated September 7, 2012, the inspectors determined the finding was more than minor because it adversely impacted the Mitigating System cornerstone objective to ensure the availability of systems that respond to initiating event. The failure is associated with equipment performance attribute in the availability area. Specifically, the issue resulted in loss of annunciators which alert operators to degrading plant equipment. The issue also resulted in declaration of an unusual event. The inspectors determined that the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process. Using Attachment 0609.04, Initial Characterization of Findings, dated October 7, 2016, Table 2, the inspectors determined that the finding affected the Mitigating Systems cornerstone. As a result, the inspectors evaluated the finding using Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012 Exhibit 2 for the Mitigating Systems cornerstone. The inspectors determined that the condition resulted in loss of the annunciator function. Therefore the inspectors determined a detailed risk analysis was needed and forwarded the issue to the Region III Senior Risk Analyst (SRA).

The Region III SRA performed a simple detailed risk evaluation for the finding using the D.C. Cook Standardized Plant Analysis Risk (SPAR) model, revision 8.50. The period of time that the annunciator system was non-functional was very short, less than two hours.

To bound the risk of the condition, the SRA assumed that human actions in the SPAR internal events SPAR model could be less reliable given the failure of the annunciator system to provide cues necessary for action to occur. The SRA increased the operator action human error probabilities in the model by a factor of 10. The change in core damage frequency for a two hour period was less than 1E-7/yr., which represents a finding of very low safety significance (Green). The dominant core damage sequence involved a main steam line break followed by operator failure to isolate/terminate the break.

The inspectors determined that the cause of the finding was related to a design error that occurred in 2012; therefore, the error does not reflect current licensee performance.

There is no cross cutting aspect associated with this issue.

Enforcement:

There are no regulatory requirements associated with the annunciator system; therefore the inspectors did not identify a violation of regulatory requirements associated with this finding. This finding being treated as a FIN.

(FIN 05000315/2017001-06, Single Point Failure Vulnerability in Annunciator System)

4OA6 Management Meetings

.1 Exit Meeting Summary

On July 26, 2017, the inspectors presented the inspection results to Mr. J. Gebbie and other members of the licensee staff. The licensee acknowledged the issues presented.

The inspectors confirmed that none of the potential report input discussed was considered proprietary.

.2 Interim Exit Meetings

Interim exits were conducted for:

• The inspection results for the Radiation Safety Program review with Mr. J. Gebbie, Chief Nuclear Officer, on June 16, 2017;

• The inspection results for the Triennial Review of Heat Sink Performance were discussed with Mr. J. Gebbie, and other members of the licensee staff, on June 23, 2017; and

• On May 17, 2017, the inspectors presented the preliminary inspection results of the issues discussed in sections 1R18 and 4OA7 by a conference phone call to Mr. M. Scarpello and other members of the licensee staff. The licensee acknowledged the issues presented.

The inspectors confirmed that none of the potential report input discussed was considered proprietary. Proprietary material received during the inspection was returned to the licensee.

4OA7 Licensee-Identified Violations

The following Severity Level IV violation was identified by the licensee and is a violation of Nuclear Regulatory Commission (NRC) requirements which meets the criteria of the NRC Enforcement Policy for being disposed as a Non-Cited Violation (NCV).

• Title 10 CFR 50.71(e) required that the UFSAR be updated to assure that the latest information developed was in the UFSAR. In AR 2010-4194, Unit 1 and Unit 2 Small Break Loss of Cooling Accident (SBLOCA) Analyses, the licensee identified the March 2007 Unit 1 SBLOCA analysis had not incorporated into the UFSAR and was not included in the October 2008 UFSAR update provided to the NRC. The inspectors determined the failure to update the UFSAR by incorporating the newest SBLOCA analyses was contrary to 10 CFR 50.71e.

The inspectors reviewed this issue in accordance with NRC IMC 0612 and the NRC Enforcement Policy. Violations of 10 CFR 50.71(e) are disposed using the traditional enforcement process because they are considered to be violations that potentially impede or impact the regulatory process. The inspectors reviewed Section 6.1.d.3 of the NRC Enforcement Policy and determined this violation was Severity Level IV because the licensees failure to update the UFSAR as required by 10 CFR 50.71(e) had not yet resulted in any unacceptable change to the facility or procedures. The inspectors determined the performance deficiency was minor in that failure to update the UFSAR was not willful; did not impact a performance indicator; was not a material condition issue which could lead to a more significant safety issue, and did not impact the Mitigating Systems cornerstone objectives.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

J. Gebbie, Chief Nuclear Officer

T. Curtiss, Regulatory Affairs

M. Ellet, Regulatory Affairs

T. Groth, Design Engineering

M. Hoholek, Radiation Protection Physicist

D. Hultquist, Radiation Protection Physicist

S. Lies, Site Vice President

W. McCrory, System Engineering

K. Patterson, Engineering Programs

M. Scarpello, Regulatory Affairs Manager

J. Slaggert, Design Engineering

D. Wood, Radiation Protection Manager

U.S. Nuclear Regulatory Commission

B. Dickson, Chief, Reactor Projects Branch 2

M. Jeffers, Chief, Engineering Branch 2

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000315/2017002-01; NCV Failure to Ensure the Unit 2 CCW Heat Exchanger

05000316/2017002-01 Monitoring Program Could Demonstrate Its Continued Operability Between Maintenance Intervals (1R07)

05000316/2017002-02 NCV Unit 2 CEQ Fan Failed Surveillance (1R15.b.1)

05000315/2017002-03; NCV Failure to Identify Parts Subject to a Part 21 (1R15.b.2)

05000316/2017002-03

05000315/2017002-04; TE Failure to Report Deficiencies as Required by

05000316/2017002-04 10 CFR 50.46 (1R18.b.1)

05000315/2017002-05; NCV Inadequate Design Control Measures to Ensure Leakage

05000316/2017002-05 Remained Within Analysis (1R18.b.2)

05000315/2017002-06 FIN Single Point Failure Vulnerability in Annunciator System (4OA3)

Closed

05000315/2017002-01; NCV Failure to Ensure the Unit 2 CCW Heat Exchanger

05000316/2017002-01 Monitoring Program Could Demonstrate Its Continued Operability Between Maintenance Intervals (1R07)

05000316/2017002-02 NCV Unit 2 CEQ Fan Failed Surveillance (1R15.b.1)

05000315/2017002-03; NCV Failure to Identify Parts Subject to a Part 21 (1R15.b.2)

05000316/2017002-03

05000315/2017002-04; TE Failure to Report Deficiencies as Required by

05000316/2017002-04 10 CFR 50.46 (1R18.b.1)

05000315/2017002-05; NCV Inadequate Design Control Measures to Ensure Leakage

05000316/2017002-05 Remained Within Analysis (1R18.b.2)

05000315/2017002-06 FIN Single Point Failure Vulnerability in Annunciator System (4OA3)

Discussed

None