IR 05000315/2024001

Integrated Inspection Report 05000315/2024001 and 05000316/2024001

ML24131A012
Person / Time
Site:	Cook
Issue date:	05/14/2024
From:	Dariusz Szwarc NRC/RGN-III/DORS/ERPB
To:	Lies Q Indiana Michigan Power Co
References
IR 2024001
Download: ML24131A012 (1)

Text

SUBJECT:

DONALD C. COOK NUCLEAR PLANT - INTEGRATED INSPECTION REPORT 05000315/2024001 AND 05000316/2024001

Dear Q. Shane Lies:

On March 31, 2024, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at Donald C. Cook Nuclear Plant. On April 10, 2024, the NRC inspectors discussed the results of this inspection with you and other members of your staff. The results of this inspection are documented in the enclosed report.

Two findings of very low safety significance (Green) are documented in this report. Two of these findings involved violations of NRC requirements. We are treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2 of the Enforcement Policy.

If you contest the violations or the significance or severity of the violations documented in this inspection report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region III; the Director, Office of Enforcement; and the NRC Resident Inspector at Donald C. Cook Nuclear Plant.May 14, 2024 This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely, Dariusz Szwarc, Acting Branch Chief Engineering and Reactor Projects Branch Division of Operating Reactor Safety Docket Nos. 05000315 and 05000316 License Nos. DPR-58 and DPR-74

Enclosure:

As stated

Inspection Report

Docket Numbers: 05000315 and 05000316

License Numbers: DPR-58 and DPR-74

Report Numbers: 05000315/2024001 and 05000316/2024001

Licensee: Indiana Michigan Power Company

Facility: Donald C. Cook Nuclear Plant

Location: Bridgman, MI

Inspection Dates: January 01, 2024 to March 31, 2024

Inspectors: N. Audia, Reactor Inspector J. Corujo-Sandin, Senior Reactor Inspector J. Mancuso, Senior Resident Inspector P. Zurawski, Branch Chief

Approved By: Dariusz Szwarc, Acting Branch Chief Engineering and Reactor Projects Branch Division of Operating Reactor Safety

Enclosure

SUMMARY

The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees performance by conducting an integrated inspection at Donald C. Cook Nuclear Plant, in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors. Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information.

List of Findings and Violations

Failure to Develop, Implement and Maintain Strategies and to Document Changes Related to Mitigating an Extended Loss of Alternating Current Power Event Cornerstone Significance Cross-Cutting Report Aspect Section Mitigating Green None (NPP) 71111.21M Systems NCV 05000315,05000316/2024001-01 Open/Closed The inspectors identified a Green finding and associated Non-cited Violation of Title 10 of the Code of Federal Regulations (10 CFR) Part 50.155, Mitigation of Beyond-Design-Basis Events, for the licensees failure to develop, implement, and maintain mitigation strategies that maintain core cooling and the failure to ensure changes to training made in 2017, which caused changes in the licensees implementation of the mitigating strategies, continued to demonstrate the provisions of 10 CFR 50.155 were met. Specifically, inconsistently defined start times in the mitigating strategies documentation, and a change to training that omitted mitigating strategy time constraint information from training lesson plans, led to a condition where actions may not be implemented in a timely and effective manner to ensure the capability to maintain core cooling during an extended loss of alternating current event.

Inadequate Procedure Causes Incorrect Cable to be Cut Leading to Inoperable Auxiliary Feedwater Pump Cornerstone Significance Cross-Cutting Report Aspect Section Mitigating Green None (NPP) 71153 Systems NCV 05000315/2024001-02 Open/Closed A self-revealed finding of very low safety significance (Green) and an associated Non-Cited Violation (NCV) of Title 10 of the Code of Federal Regulations (CFR) Part 50, Appendix B,

Criterion V, Instructions, Procedures, and Drawings, was identified due to the failure of the licensee to provide adequate procedures for work modifying plant equipment. Specifically, on March 31, 2022, the licensee carried out a modification to remove a cable and due to inadequate procedures incorrectly cut the cable which would have provided an auto-start signal to the 1W motor driven auxiliary feedwater pump (MDAFP) and to sequence it on to the 1AB emergency diesel generator (EDG).

Additional Tracking Items

Type Issue Number Title Report Section Status URI 05000315,05000316/20 Adequacy of Mitigating 71111.21M Closed 22011-05 Strategies Procedures and Training

LER 05000315/2023-002-00 LER 2023-002-00 for 71153 Closed Donald C. Cook Nuclear Plant, Unit 1, Failure of Unit 1 West Auxiliary Feedwater Pump to Restart during Load Sequencer Testing

PLANT STATUS

Unit 1 began the inspection period at rated thermal power and remained at or near full rated thermal power for the inspection period.

Unit 2 began the inspection period at rated thermal power. On March 20, 2024, power was reduced to approximately 60 percent in preparation for a refueling outage. The unit tripped due to a failure of a thrust probe sensor on March 22, 2024, and began their refueling outage coincident with troubleshooting.

INSPECTION SCOPES

Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with their attached revision histories are located on the public website at http://www.nrc.gov/reading-rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared complete when the IP requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter (IMC) 2515, Light-Water Reactor Inspection Program - Operations Phase. The inspectors performed activities described in IMC 2515, Appendix D, Plant Status, observed risk-significant activities, and completed on-site portions of IPs. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.

71111.01 - Adverse Weather Protection

Impending Severe Weather Sample (IP Section 03.02) (1 Sample)

(1) The inspectors evaluated the adequacy of the overall preparations to protect risk-significant systems from impending winter storm on January 8, 2024.

71111.04 - Equipment Alignment

Partial Walkdown Sample (IP Section 03.01) (3 Samples)

The inspectors evaluated system configurations during partial walkdowns of the following systems/trains:

(1) 1 west motor driven auxiliary feedwater pump (MDAFP) partial lineup during 1 east MDAFP work window on January 3, 2024

(2) 2CD emergency diesel generator (EDG) protected during opposite work week on January 23, 2024

(3) 345kV, main transformers, 1CD EDG, 4kV and 2AB/CD batteries during emergent 1TDAFP work window on February 26, 2024

71111.05 - Fire Protection

Fire Area Walkdown and Inspection Sample (IP Section 03.01) (5 Samples)

The inspectors evaluated the implementation of the fire protection program by conducting a walkdown and performing a review to verify program compliance, equipment functionality, material condition, and operational readiness of the following fire areas:

(1) Fire Zone 60: Switchgear Room Cable Vault, Unit 2, elevation 625' -10" on January 23, 2024

(2) Fire Zones 17B/C/F/G: Auxiliary Feed Pump Rooms, Unit 2, and Corridor to Auxiliary Feed Pump Rooms, Unit 1 and 2, elevation 591' on February 21, 2024

(3) Fire Zones 1C/D/G/H: East and West Residual Heat Removal Pumps, Unit 1 and 2, elevation 573' on February 23, 2024

(4) Fire Zone 46D: E.P.S. AB Battery Room, Unit 2 elevation 609'-6" on February 27, 2024

(5) Fire Zone 44S: Auxiliary Building South, Units 1 and 2, elevation 609' on February 28, 2024

71111.11Q - Licensed Operator Requalification Program and Licensed Operator Performance

Licensed Operator Performance in the Actual Plant/Main Control Room (IP Section 03.01) (1 Sample)

(1) The inspectors observed and evaluated licensed operator performance in the control room during Unit 2 reactor coolant system drain high-risk operational evolution on March 25, 2024.

71111.12 - Maintenance Effectiveness

Maintenance Effectiveness (IP Section 03.01) (2 Samples)

The inspectors evaluated the effectiveness of maintenance to ensure the following structures, systems, and components (SSCs) remain capable of performing their intended function:

(1) 2CD EDG critical maintenance project (CMP) work on January 29, 2024

(2) Unit 2 main steam 50.65 a(1) action plan reviewed on March 12, 2024

71111.13 - Maintenance Risk Assessments and Emergent Work Control

Risk Assessment and Management Sample (IP Section 03.01) (4 Samples)

The inspectors evaluated the accuracy and completeness of risk assessments for the following planned and emergent work activities to ensure configuration changes and appropriate work controls were addressed:

(1) Risk management during winter weather warning, on January 16, 2024

(2) Unit 1 600V transformer area failed CO2 testing surveillance/fire damper on January 25, 2024

(3) Emergent work for failed safety valve on Units 1 and 2 main generator cooling on February 17, 2024

(4) Emergent work for high differential pressure on Unit 2 turbine driven auxiliary feedwater pump strainer during testing on February 26, 2024

71111.15 - Operability Determinations and Functionality Assessments

Operability Determination or Functionality Assessment (IP Section 03.01) (4 Samples)

The inspectors evaluated the licensees justifications and actions associated with the following operability determinations and functionality assessments:

(1) AR 2024-1615, U2 TDAFP Suct Strainer DP switch/alarm not Operating Correctly on February 27, 2024

(2) AR 2024-1871, 2-NRI-43 as Founds Out of Spec on March 7, 2024

(3) AR 2024-2402, 1-BATT-CD Cell 43 has Foreign Debris on March 26, 2024

(4) AR 2024-2479, U2 #3 Accumulator Below Required FLEX Volume (TRO 8.11.4)on March 27, 2024

71111.20 - Refueling and Other Outage Activities

Refueling/Other Outage Sample (IP Section 03.01) (1 Partial)

(1) (Partial)

The inspectors evaluated Refueling Outage U2C28 activities from March 22 through March 31, 2024.

71111.24 - Testing and Maintenance of Equipment Important to Risk

The inspectors evaluated the following testing and maintenance activities to verify system operability and/or functionality:

Post-Maintenance Testing (PMT) (IP Section 03.01) (2 Samples)

(1) 1-HV-CEQ-1 containment equalization fan PMT following planned work, on March 13, 2024

(2) Unit 2 west component cooling water pump PMT following planned work, on March 18, 2024

Surveillance Testing (IP Section 03.01) (3 Samples)

(1) 2CD EDG 24-hour endurance run on January 29, 2024

(2) Unit 1 TDAFP planned surveillance on March 18, 2024

(3) Unit 2 AB EDG monthly surveillance on March 19, 2024

Inservice Testing (IST) (IP Section 03.01) (1 Sample)

(1) Unit 2 TREVI testing on March 21,

OTHER ACTIVITIES - BASELINE

===71151 - Performance Indicator Verification

The inspectors verified licensee performance indicators submittals listed below:

IE01: Unplanned Scrams per 7000 Critical Hours Sample (IP Section 02.01)===

(1) Unit 1 (January 1, 2023-December 31, 2023)

(2) Unit 2 (January 1, 2023-December 31, 2023)

IE03: Unplanned Power Changes per 7000 Critical Hours Sample (IP Section 02.02) (2 Samples)

(1) Unit 1 (January 1, 2023-December 31, 2023)

(2) Unit 2 (January 1, 2023-December 31, 2023)

IE04: Unplanned Scrams with Complications (USwC) Sample (IP Section 02.03) (2 Samples)

(1) Unit 1 (January 1, 2023-December 31, 2023)

(2) Unit 2 (January 1, 2023-December 31, 2023)

MS05: Safety System Functional Failures (SSFFs) Sample (IP Section 02.04) (2 Samples)

(1) Unit 1 (January 1, 2023-December 31, 2023)

(2) Unit 2 (January 1, 2023-December 31, 2023)

===71153 - Follow Up of Events and Notices of Enforcement Discretion

Event Report (IP Section 03.02)===

The inspectors evaluated the following licensee event reports (LERs):

(1) LER 05000315/2023-002-00, Failure of Unit 1 West Auxiliary Feedwater Pump to Restart During Load Sequencer Testing (ADAMS Accession No. ML23346A154). The inspection conclusions associated with this LER are documented in this report under Inspection Results Section 71153. This LER is closed.

INSPECTION RESULTS

Failure to Develop, Implement and Maintain Strategies and to Document Changes Related to Mitigating an Extended Loss of Alternating Current Power Event Cornerstone Significance Cross-Cutting Report Aspect Section Mitigating Green None (NPP) 71111.21M Systems NCV 05000315,05000316/2024001-01 Open/Closed The inspectors identified a Green finding and associated non-cited violation (NCV)of Title 10 of the Code of Federal Regulations (10 CFR) Part 50.155, Mitigation of Beyond-Design-Basis Events, for the licensees failure to develop, implement, and maintain mitigation strategies that maintain core cooling and the failure to ensure changes to training made in 2017, which caused changes in the licensees implementation of the mitigating strategies, continued to demonstrate the provisions of 10 CFR 50.155 were met. Specifically, inconsistently defined start times in the mitigating strategies documentation, and a change to training that omitted mitigating strategy time constraint information from training lesson plans, led to a condition where actions may not be implemented in a timely and effective manner to ensure the capability to maintain core cooling during an extended loss of alternating current event.

Description:

On September 21, 2022, the U.S. Nuclear Regulatory Commission (NRC) completed a Design Basis Assurance Inspection (DBAI), which was documented in Inspection Report 05000315/2022011 and 05000316/2022011 (ML22259A156). The report documented the opening of Unresolved Item (URI) 05000315,05000316/2022011-05, Adequacy of Mitigating Strategies Procedures and Training. The inspectors were concerned with the licensees ability to mitigate an extended loss of alternating current

(ac) power (ELAP) event. At the conclusion of the DBAI, further information and review was needed to determine if a violation of NRC requirements had occurred.

The Donald C. Cook Nuclear Plants Updated Final Safety Analysis Report (UFSAR)

Section 8.7 refers to a station blackout (SBO) as the complete loss of AC power to the essential (e.g., AC emergency buses) and non-essential switchgear buses in a nuclear power plant (i.e., loss of the off-site electric power system concurrent with a turbine trip and the unavailability of the on-site emergency AC power system). The SBO does not include the loss of available AC power to buses fed by station batteries through inverters or by alternate AC power sources, nor does it assume a concurrent single failure or a design-basis accident. At the Cook Nuclear Plant, which is a two-unit nuclear station, SBO is postulated to occur in only one unit since the emergency AC power sources are not completely shared by the two units.

Per the sites licensing bases, the assumed maximum duration for the SBO event is 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

Following the event at the Fukushima Daiichi Nuclear Power Plant in Japan, the NRC issued Orders (e.g., EA-12-049) which required each nuclear power plant licensee to develop strategies for mitigating a beyond-design-basis event like the one at Fukushima Daiichi.

These strategies, typically referred to as FLEX strategies, included coping with an ELAP event and maintaining cooling to the reactor core.

Title 10 CFR 50.155 codified many of the post-Fukushima orders (e.g., EA-12-049). In particular, Section 50.155(b)(1)(i) requires licensees to develop, implement, and maintain strategies and guidelines for mitigating beyond-design-basis external events from natural phenomena and assume that all AC power has been lost concurrent with a loss of access to the ultimate heat sink. These strategies and guidelines must be capable of being implemented site-wide and must include the guidelines for maintaining or restoring core cooling. Section 50.155(d), Training Requirements, requires each licensee to provide for the training of personnel that perform said activities. Additionally, Section 50.155(f),

Documentation of Changes, allows each licensee to make changes to their implementation of the requirements outlined in 10 CFR 50.155 without NRC approval. However, the licensee must document each change and demonstrate the change continues to meet the provisions of 10 CFR 50.155. Cook Nuclear Plant developed their FLEX mitigation strategy in part to comply with the orders now codified under 10 CFR 50.155.

Site procedures 1-OHP-4023-ECA-0.0 and 2-OHP-4023-ECA-0.0, Loss of All AC Power, contain steps to respond to, and mitigate, both an SBO event and an ELAP event. To start and successfully implement the FLEX mitigation strategies, a timely determination and declaration of an ELAP event by operations personnel is needed. This is because there are multiple time sensitive actions (TSAs) the operators must complete for the mitigating strategies to be successful.

At the time of the DBAI, procedures 1/2-OHP-4023-ECA-0.0, Revision 45, were in effect. Step 11 directed the operators to Check if AC Emergency Buses can be restored within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of the SBO Event (i.e., restore power to the emergency buses). If the operators determined power could not be restored within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, they would move to the Response Not Obtained column of the procedure and consult with the Shift Manager to declare an ELAP event. Step 11 is designated as a continuous action step and remains applicable throughout the execution of 1/2-OHP-4023-ECA-0.0 unless otherwise stated (i.e., operators are continuously evaluating the need to declare ELAP).

A note above Step 11 of 1/2-OHP-4023-ECA-0.0, Revision 45, stated the DC Bus deep load shedding must be completed within one hour of ELAP event. However, other procedures such as 12-EHP-4075-TCA-001, Operator Time Critical Actions, Revision 17, stated the direct current (DC) deep load shed needs to be completed 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> from the loss of AC power.

Similar inconsistent language regarding the start time of FLEX-related actions was observed for the TSA regarding control room and turbine driven auxiliary feedwater pump (TDAFP)room temporary ventilation. These discrepancies were discussed with the licensees staff during the DBAI. Based on these discussion and additional licensee review, the licensee concluded the procedures discussed above did not provide clear direction to the operators to declare an ELAP in sufficient time to ensure completion of multiple TSAs to support FLEX mitigating strategy implementation. At the time of the DBAI, licensee personnel were under the incorrect understanding the ELAP declaration could be delayed up to the end of the SBO coping period (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) and the FLEX mitigating strategies would still be successful. Licensee personnel informally polled a majority of licensed operators and determined all, except one, shared the same misunderstanding regarding how much time could elapse before declaring an ELAP event and still successfully implement the FLEX mitigating strategies.

The licensee entered the concerns discussed above into the corrective action program, documenting, in part:

Operator training and Emergency Preparedness documentation defines a satisfactory ELAP declaration to be within four

(4) hours of the loss of all AC power. Multiple time sensitive operator actions are provided in support of ELAP that do not have a clearly defined start time, since the wording used in several sources of information do not align. In particular, Operator time sensitive action F01 requires completing DC Deep Load Shed within one

(1) hour from loss of AC power. These actions are not triggered until ELAP is declared in 1/2-OHP-4023-ECA-0.0 at step 11, when it is determined that power will not likely be restored within the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> coping period. If the crew is allowed to declare ELAP any time within the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> coping period, then they would not have enough time to perform the Deep Load Shed within the required time.

Based on the above, the inspectors identified at least two TSAs which needed to be initiated earlier than previously understood or guided by procedures. The first was TSA F01, which performs the deep load shed of the 250-volt DC batteries. The licensee had previously demonstrated this action could be completed in about 34 minutes. The second was TSA F07 which directs operators to connect temporary power and fans for cooling the control room as well as actions to improve ventilation in the TDAFP room. For this TSA the licensees analysis allowed up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to complete the action. The licensee previously validated this TSA could be completed in approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 18 minutes.

The inspectors reviewed some of the licensees correspondence (ML17300B465) when the mitigating strategies and the licensees Final Integrated Plan were created to comply with Order EA-12-049. The inspectors noted these strategies were developed using the guidance from Nuclear Energy Institute (NEI) 12-06, Diverse and Flexible Coping Strategies (FLEX) Implementation Guide, Revision 0 (ML12242A378). The NRC had found NEI 12-06, Revision 0 (with comments), as an acceptable means of meeting the requirements of Order EA-12-049 (ML12229A174). The NRCs acceptance of the NEI 12-06, Revision 0, approach (with comments) is provided in Regulatory Guide (RG) 1.226, Flexible Mitigation Strategies for Beyond-Design-Basis Events, Revision 0, dated June 2019.

The inspectors noted, in part, Section 3.2.2, Minimum Baseline Capabilities, of NEI 12-06 stated the following:

The following guidelines are provided to support the development of guidance to coordinate with the existing set of plant operating procedures/guidance:

(1) Plant procedures/guidance should identify site-specific actions necessary to restore AC power to essential loads. If an alternate AC (AAC) power source is available, it should be started as soon as possible. If not, actions should be taken to secure existing equipment alignments and provide an alternate power source as soon as possible based on relative plant priorities.

While initial actions following the event may focus on restoration of ac power to essential loads, procedural guidance needs to assure a timely decision is made on whether or not the beyond design basis (BDB) external event (BDBEE) has resulted in an SBO condition that is an ELAP. This is an important decision to ensure that actions to maintain or restore key safety functions are taken consistent with the timelines required for the successful implementation of the FLEX strategies for the initial response phase. [Emphasis Added]

Section 11.6, Training, of NEI 12-06 stated:

Personnel assigned to direct the execution of mitigation strategies for beyond-design basis events will receive necessary training to ensure familiarity with the associated tasks, considering available job aids, instructions, and mitigating strategy time constraints.

[Emphasis Added]

The inspectors also noted the Statements of Consideration for 10 CFR 50.155 provided specific clarification regarding the requirement to maintain the strategies and guidelines. Specifically, the Statements of Consideration defined the term maintain as follows:

The term maintain as used in Section 50.155(b) reflects the NRCs intent that licensees ensure that the mitigating strategies for beyond design basis external events, once established, be preserved.

As part of the work to close the URI, the inspectors also reviewed training material associated with the FLEX mitigating strategies and concluded that changes to the training information provided to plant personnel, including operations, contributed to the misunderstanding regarding ELAP declaration and other mitigating strategy time constraints. In October 2014, the licensee provided FLEX mitigating strategies training to operations personnel via Lesson Plans FX-C-001, FLEX Overview, Revision 0, FX-C-OP00, Loss of AC Power - FLEX Strategies, Revision 0, and RQ-C-3930, ECA-0 Series Procedures and Background, Revision 0. Page 36 of Lesson Plan FX-C-001 shows a timeline for the Phase 1 mitigating strategy activities and depicts the ELAP declaration occurring within the first 30 minutes of DC Cook experiencing a loss of all AC power event where a source of AC power is not expected to be restored within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. The timeline also shows the mitigating strategy time constraint for the DC power deep load shed as requiring completion within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of the loss of AC power event. Page 6 of Lesson Plan FX-C-OP00 includes a discussion of the mitigating strategy timeline including major actions and TSAs. Page 8, Section G of the same lesson plan provides information regarding Step 11 of 1/2-OHP-4023-ECA-0.0 and states the Shift Manager needs to make the ELAP declaration decision as soon as possible because any delay in the decision to declare an ELAP impacts the initiation of the DC deep load shed mitigating strategy actions. Lastly, page 35 of Lesson Plan FX-C-OP00 provides the same timeline provided in Lesson Plan FX-C-001.

The inspectors reviewed training lesson plans used to support periodic training on FLEX mitigating strategies since 2017. Specifically, the inspectors reviewed training lesson plans RQ-C-4212, ELAP Events, Revision 0, and RQ-C-4173, Loss of All AC Power Events and ECA-0 Series Background Information, Revision 0. The inspectors noted the training information did not include information regarding the mitigating strategy time constraint surrounding the ELAP declaration. However, the inspectors determined the 2014 and 2017 lesson plans provided limited discussions on TSA F07. The inspectors requested any documentation which supported the licensees decision to exclude training on the mitigating strategy time constraint surrounding the ELAP declaration and were informed that no change documentation was completed since the licensee had not intended or recognized that this change in training impacted their implementation of the 10 CFR 50.155 requirements. As a result, the licensee had also not demonstrated that the provisions of 10 CFR 50.155 continued to be met prior to implementing the training changes in 2017.

The inspectors concluded that at the time of the DBAI, the licensees understanding of the mitigating strategies time constraints had substantially changed from the information provided to the NRC as part of the Fukushima-related orders. Rather than having 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to declare an ELAP event as believed during the DBAI inspection, the licensee had 26 minutes. The inspectors determined the misunderstanding of the mitigating strategy time constraints was caused by inadequate guidance in procedure 1/2-OHP-4023-ECA-0.0, Revision 45, and changes in training which eliminated the mitigating strategy time constraint discussions regarding ELAP declaration. The licensee performed a detailed evaluation of this issue and drew similar conclusions.

Corrective Actions: At the conclusion of the DBAI, the licensee implemented a control room contingency action such that upon a loss of all AC power, the Shift Manager was to declare ELAP early enough to ensure the TSA for the DC deep load shed can be completed within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> from loss of AC power, unless power restoration is imminent. These actions should also support timely completion of TSA F07.

The licensees additional corrective actions included, but were not limited to:

1. Revising procedures 1/2-OHP-4023-ECA-0.0 and its background document to provide clear directions on the proper timing of ELAP declaration to ensure the 1-hour TSA for DC load shedding is met.

2. Revising the Operator qualification training material (initial and requalification) to ensure mitigating strategy time constraints are taught and reinforced.

An extent of condition performed by the licensee identified four additional site procedures with a similar defect as the one from 1/2-OHP-4023-ECA-0.0, Step 11.

Corrective Action References: AR 2022-5766, ELAP declaration timing concern on Loss of AC Power

Performance Assessment:

Performance Deficiency: The inspectors determined the licensees failure to maintain strategies and guidelines to mitigate beyond-design-basis external events and the failure to demonstrate changes in 10 CFR 50.155 implementation training requirements continued to meet the provisions of 10 CFR 50.155 was a performance deficiency.

Specifically, Revision 45 of procedures 1/2-OHP-4023-ECA-0.0, and the operators misunderstanding (at the time of the DBAI) of the mitigating strategy time constraint regarding ELAP declaration, could allow at least two TSAs to be delayed such that they would not be timely and effective in ensuring the capability to maintain or restore core cooling during an ELAP. The affected TSAs included TSA F01, which performs the DC deep load shed, and TSA F07 which establishes TDAFP room and control room temporary ventilation.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Procedure Quality attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, procedures 1/2-OHP-4023-ECA-0.0, Revision 45, did not provide sufficient guidance (given the available training) to ensure time sensitive actions would occur in the time required to mitigate an ELAP event.

Significance: The inspectors assessed the significance of the finding using IMC 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power. The inspectors reviewed Exhibit 2, Mitigating Systems Screening Questions, and answered Yes to question E.2 because the finding involved equipment, training, procedures, and/or other programmatic aspects credited in the Phase 1 or 2 FLEX strategy such that any FLEX function (such as extended HPCI/RCIC/AFW operation, providing FLEX DC power, FLEX AC power, or FLEX RCS feed) could not be completed in accordance with existing plant procedures within the time allotted for an exposure period of greater than 21 days. As a result, a detailed risk evaluation was required.

In the detailed risk evaluation, the analyst mapped the performance deficiency (PD) to an increased human error probability (HEP) for ELAP declaration in the DC Cook SPAR model, Version 8.80, in SAPHIRE, Version 8.2.6. The analyst considered the exposure time of the PD to be 1 year and referred to NUREG-1792, Good Practices for Implementing Human Reliability Analysis, dated April 2005, to establish an appropriate screening value for the impact of the PD on the HEP distribution for ELAP declaration since it did not constitute an outright failure of the decision in all situations. These assumptions yielded an estimate in the increase in core damage frequency of 1E-8 per year or of very low safety significance (Green). The dominant core damage sequence was a station blackout, failure to declare ELAP, battery depletion, and failure to recover offsite power. The analyst determined this sequence was dominant because it contributed approximately 50 percent of the change in core damage frequency above baseline risk.

Cross-Cutting Aspect: Not Present Performance. No cross-cutting aspect was assigned to this finding because the inspectors determined the finding did not reflect present licensee performance. Specifically, the inspectors determined the procedure wording was developed and the training changes were made more than 3 years ago.

Enforcement:

Violation: Title 10 CFR 50.155(b)(1)(i), Mitigation of Beyond-Design-Basis Events: Strategies and guidelines, states, in part, the licensee shall develop, implement, and maintain mitigation strategies for beyond-design-basis external events. Strategies and guidelines to mitigate beyond-design-basis external events from natural phenomena that are developed assuming a loss of all AC power concurrent with either a loss of normal access to the ultimate heat sink or, for passive reactor designs, a loss of normal access to the normal heat sink. These strategies and guidelines must be capable of being implemented site-wide and must include:

Maintaining or restoring core cooling, containment, and spent fuel pool cooling capabilities.

Title 10 CFR 50.155(d), Mitigation of Beyond-Design-Basis Events: Training requirements, states, each licensee shall provide for the training of personnel that perform activities in accordance with the capabilities required by paragraphs (b)(1) and

(2) of this section.

Title 10 CFR 50.155(f), Documentation of Changes, states,

(1) a licensee may make changes in the implementation of the requirements in this section without NRC approval, provided that before implementing each such change, the licensee demonstrates that the provisions of this section continue to be met and maintains documentation of changes until the requirements of this section no longer apply; and

(2) Changes in the implementation of requirements in this section subject to change control processes in addition to paragraph (f)of this section must be processed via their respective change control processes, unless the changes being evaluated impact only the implementation requirements of this section.

Procedures 1-OHP-4023 ECA-0.0 and 2-OHP-4023 ECA-0.0, Loss of All AC Power, Revisions 45, were the procedures used by the Main Control Room operators to respond to a loss of all AC Power, including a SBO and an ELAP event.

Contrary to the above, until July 13, 2022:

1. The licensee failed to develop, implement, and maintain mitigation strategies for maintaining or restoring core cooling and the containment during a beyond-design-basis external event.

2. The licensee made changes in the implementation of the training requirements provided in 10 CFR 50.155(d) without documenting the changes and demonstrating the provisions of 10 CFR 50.155 continued to be met.

Specifically, procedures 1/2-OHP-4023 ECA-0.0, Revisions 45, failed to include instructions and/or guidance to ensure TSAs F01, DC Deep Load Shed, and F07, TDAFW and Control Room Ventilation, would be completed in time to successfully mitigate an ELAP event.

Revisions 45 of these procedures, and the licensees change to training information which eliminated training on the mitigating strategy time constraint regarding ELAP declaration, could allow the two TSAs to be delayed such that they would not be timely and effective in ensuring the capability to maintain or restore core cooling following a beyond-design-basis external event.

Enforcement Action: This violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the Enforcement Policy.

Inadequate Procedure Causes Incorrect Cable to be Cut Leading to Inoperable Auxiliary Feedwater Pump Cornerstone Significance Cross-Cutting Report Aspect Section Mitigating Green None (NPP) 71153 Systems NCV 05000315/2024001-02 Open/Closed A self-revealed finding of very low safety significance (Green) and an associated non-cited violation (NCV) of Title 10 of the Code of Federal Regulations (CFR) Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, was identified due to the failure of the licensee to provide adequate procedures for work modifying plant equipment. Specifically, on March 31, 2022, the licensee carried out a modification to remove a cable and due to inadequate procedures incorrectly cut the cable which would have provided an auto-start signal to the 1W motor driven auxiliary feedwater pump (1W MDAFP), and to sequence it on to the 1AB emergency diesel generator (1AB EDG).

Description:

On October 15, 2023, the licensee was doing Station Blackout Testing of 1AB EDG and associated safety-related equipment using procedure 1-OHP-4030-132-217B, DG1AB Load Sequencing & ESF Testing, Revision 59. After establishing the test conditions described in the procedure, the licensee manually pressed the trip test buttons for the associated degraded voltage relays per step 4.3.35 in the procedure. The equipment appeared to actuate as expected but during Step 4.3.39 when checking proper load sequencing, the licensee discovered that the 1W MDAFP did not sequence on to the 1AB EDG as expected.

The licensee successfully manually started and loaded the pump to verify the function was maintained and investigated the cause of the failure. Troubleshooting determined the power supply cable to the degraded voltage relay associated with the 1W MDAFP was cut, and therefore the relay would not automatically close the associated breaker to start the pump.

The licensee replaced this cable and subsequently tested the relay successfully on November 8, 2023.

Further investigation by the licensee found this cable had been cut during a modification made to allow installation of a new cable under a work order performed on March 31, 2022. A different cable in the same tray was intended to be removed using the portion of procedure 12-IHP-5021-EMP-033, Cable Removal and Installation. Step 4.2.2 of this procedure requires, in part, that IF a cable(s) is required to be cut to allow removal, THEN perform the following while being witnessed by the supervisor: Positively identify and physically locate the cable(s) (including all phases) to be cut using a circuit/signal tracer (preferred method),continuity check, hand-over-hand walkdown(s) or other method(s) and record below.

Licensee personnel in the field did not positively identify the cable using these methods but instead relied upon in-plant labeling, which was incorrect, resulting in the wrong cable being cut.

Corrective Actions: The licensee successfully replaced the cable and tested the relay on November 8, 2023. The licensee also plans to revise procedure 12-IHP-5021-EMP-033, specifically step 4.2.2, to remove the ambiguity and prescribe the technologies available to verify the correct wires prior to removal. In the interim all potential cable cutting and removal requires direct approval from the Maintenance Manager to ensure the appropriate methods are selected.

Corrective Action References: AR 2023-7398 West Motor Driven Aux Feed Pump did not restart and AR 2023-7605 Control circuit cable for 1-PP-3W West MDAFP found cut

Performance Assessment:

Performance Deficiency: The licensees failure to provide adequate procedures for altering or removing safety-related cabling is contrary to 10 CFR Part 50, Appendix B, Criterion V and is a performance deficiency.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, procedure 12-IHP-5021-EMP-033 did not prevent an incorrect wire being from cut during a modification, which lead to the inability of the 1W MDAFP to automatically start from certain safety-related signals.

Significance: The inspectors assessed the significance of the finding using Detailed Risk Evaluation (blank significance section) The inspectors assessed the significance of this finding using IMC 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions. The inspectors determined that this issue required a detailed risk evaluation because the degraded condition represented a loss of PRA function of one train of a multi-train system for greater than its technical specification allowed outage time. Specifically, the nature of the failure would have prevented automatic start of the 1W MDAFW pump following a loss of offsite power.

The senior reactor analysts (SRAs) performed a detailed risk evaluation to assess the significance of the finding. The finding resulted in failure of the 1W MDAFW pump to automatically start following a loss of offsite power. Though the licensee cut the cable for the 1W MDAFW pump on March 31, 2022, the SRAs limited the exposure time to 1 year, as described in the Risk Assessment of Operational Events (RASP) Handbook, Volume 1, Revision 2.02, Section 2.7.

The SRAs developed the internal events risk estimate using System Analysis Program for Hands-On Integrated Reliability Evaluations (SAPHIRE) version 8.2.9 and a test and limited use (TLU) version of the D.C. Cook Standardized Plant Analysis Risk (SPAR) model created by Idaho National Laboratories in November 2023. This TLU model revised the D.C. Cook SPAR model of record (version 8.82) to include a basic event for the automatic actuation signal for the 1W MDAFW pump, which the SRA set to TRUE to model this failure. The SRAs reviewed station procedures and verified they contained steps to manually start the 1W MDAFW pump if the pump did not start automatically. Additionally, the SRAs noted that operators are trained on this action, and it can be performed from the main control room. Therefore, though the 1W MDAFW pump would be easily recoverable via manual start, the SRAs conservatively set the probability for an operator failing to manually start the 1W MDAFW pump to 0.1.

The SRAs determined the change in core damage frequency (CDF) from internal events to be less than 1E-7 per year, or of very low safety significance (Green). The dominant core damage sequence for internal events included a switchyard-centered loss of offsite power with failure of auxiliary feedwater and high-pressure recirculation.

Cross-Cutting Aspect: Not Present Performance. No cross-cutting aspect was assigned to this finding because the inspectors determined the finding did not reflect present licensee performance.

Enforcement:

Violation: 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality shall be prescribed by procedures of a type appropriate to the circumstances and be accomplished in accordance with these procedures.

The licensee established 12-IHP-5021-EMP-033, Cable Removal and Installation, Revision 47, as the implementing procedure for removing safety-related cables, an activity affecting quality.

Contrary to the above, prior to November 2023, the licensee failed to have a procedure to adequately manage alteration and removal of safety-related cables. Specifically, procedure 12-IHP-5021-EMP-033, Rev 47, failed to provide adequate guidance to prevent the wrong cable from being selected when making modifications to safety-related wiring. The failure of the procedure to provide adequate guidance led to the incorrect wire being selected for removal which caused the 1W MDAFP to be incapable of auto-starting and loading on to the 1AB EDG when it received the signal associated with a Loss of Off-site Power and was therefore inoperable.

Enforcement Action: This violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the Enforcement Policy.

EXIT MEETINGS AND DEBRIEFS

The inspectors verified no proprietary information was retained or documented in this report.

• On April 10, 2024, the inspectors presented the integrated inspection results to Q. Shane Lies, and other members of the licensee staff.

• On March 26, 2024, the inspectors presented the Closure of Mitigating Strategies Unresolved Item inspection results to Tod Kaspar, and other members of the licensee staff.

DOCUMENTS REVIEWED

Inspection Type Designation Description or Title Revision or

Procedure Date

71111.04 Procedures 2-OHP-4021-032-Operating DG2CD Subsystems 37

008CD

71111.05 Corrective Action AR 2023-6950 U2 Turbine Driven Aux Feed Pump Door Seal Damage 10/02/2023

Documents

Fire Plans Fire Pre-Plans - Fire Zone 44S Auxiliary Building South Both Units, elev. 609'47

Volume 1

Fire Pre-Plans - Fire Zone 46D: E.P.S. AB Battery Room Unit 2 elev. 609'-6" 47

Volume 1

Fire Pre-Plans - Fire Zone 60: Switchgear Room Cable Vault Unit 2 - 625'-10" 44

Volume 1

Fire Pre-Plans - Fire Zone 17C: Corridor to Auxiliary Feed Pump Rooms - Both 47

Volume 1 Units - 591'

Fire Pre-Plans - Fire Zone 17G: East Auxiliary Feed Pump Room - Unit 2 - 591' 47

Volume 1

Fire Pre-Plans - Fire Zone 17F: Turbine Auxiliary Feed Pump Room - Unit 2 - 47

Volume 1 591'

Fire Pre-Plans - Fire Zone 17B: West Auxiliary Feed Pump Room - Unit 2 - 47

Volume 1 591'

Fire Pre-Plans - Fire Area AA1 47

Volume 1

Miscellaneous FSA Rev. 5 DC Cook Nuclear Plant Fire Safety Analysis (FSA), Fire Area: 5

AA17 Unit 2 West Motor Driven Auxiliary Feedwater Pump

Room (El. 591 ft.)

Procedures 12-FPP-2270- Fire Detection Instrumentation Channel Functional Test, 20

066-059 U-1 Zones 27 (Subzones 1 and 3), 28, and U-2 Zones 29, 30,

(Subzone1)

2-FPP-4030- Inspection of Fire Barrier Penetration Seals 38

066-017 Attachment 2 - Penetration Seal Inspection Criteria

2-FPP-4030- Inspection of Fire Dampers Protecting Safety-Related Areas, 20

066-021 Data Sheet 1, Safety-Related Fire Damper Inspection Sheet

2-FPP-4030- Technical Requirements Manual Fire Door Inspect 31

066-026

Inspection Type Designation Description or Title Revision or

Procedure Date

71111.11Q Procedures 2-OHP-4021-002-RCS Draining 56

005

71111.12 Corrective Action 2021-8107 MRule Reliability Criteria for Function MS-08 Exceeded 09/28/2021

Documents AR 2018-3403 DG2CD Fuel Oil Supply Line Excessive Vibration 03/25/2018

Procedures 12-MHP-5021-Emergency Diesel Engine Fuel Rack Maintenance 8

2-053

2-OHP-4030-232-CD Diesel Generator Operability Test (Train A) 70

27D

Work Orders 55505563-30 2-0ME-150-CD, Fuel Oil Line Excessive Vib (2018-3403) 04/01/2018

71111.13 Corrective Action AR 2024-0533 1-HV-SGR-FD-1 Fire Damper Did Not Close 01/18/2024

Documents

Procedures 1-IHP-4030-166-Unit 1 Engineered Safety Switchgear East 600V Switchgear 8

2 Room & Mezzanine Area CO2 Fire Suppression Test

71111.15 Corrective Action AR 2024-1615 Unit 2 TDAFP Suction Strainer DP Switch/Alarm Not 02/27/2024

Documents Operating Correct

AR 2024-1871 2-NRI-43 As Founds Out of Spec 03/07/2024

AR 2024-2402 1-Batt-CD Cell 43 Has Foreign Debris 03/25/2024

AR 2024-2479 U2 #3 Accumulator Below Required FLEX Volume 03/26/2024

(TRO 8.11.4)

Miscellaneous 1-2-UNC-319A Accumulator Level Instrument Loop Uncertainty Analysis 1

CALC2

Operability ODS 2024-1615-1 Operability Determination Supplement (ODS) to Support 02/27/2024

Evaluations U2 TDAFP Strainer Operability

Procedures 2-IHP-4030-213-Nuclear Instrumentation Power Range Channel Operation 19

231Q Test and Calibration with New Flux Data Equivalent Voltages

2-OHL-4030- Unit 2 Tours - U2 CR M5,6&D Shift Chks 44

SOM-043

2-OHP-4030-256-Turbine Driven Auxiliary Feedwater System Test 38

017T

Work Orders C10066573001 2-CDA-253; Calibrate Alarm Pressure Switch 02/27/2024

71111.20 Corrective Action AR 2024-2331 Chicago Fitting Not Connected 03/22/2024

Documents AR 2024-2333 Cover on SG 3-4 Loose 03/22/2024

AR 2024-2335 Oil Leak on PRT 03/22/2024

AR 2024-2338 S-SI-169-L4 Active Pipe Cap Leak 03/22/2024

Inspection Type Designation Description or Title Revision or

Procedure Date

Miscellaneous DIT-10046-00 Unit 2 Cycle 27 End-of-Cycle (EOC) Time-to-Boil Information 02/12/2024

DIT-10047-00 Unit 2 Cycle 28 Beginning-of-Cycle (BOC) Time-to-Boil 02/12/2024

Information

71111.24 Corrective Action AR 2024-2296 2-SV-1B-4 Failed as Found and As Left Seat Leakage 03/21/2024

Documents

Procedures 12-EHP-4030- Main Steam Safety Valve Setpoint Verification with Lift Assist 27

051-256 Device

2-OHP-4030-232-AB Diesel Generator Operability Test 73

27AB

2-OHP-4030-232-CD Diesel Generator Operability Test (Train A) 70

27CD

Work Orders C10036641001 2-SV-1B-4 Perform Setpoint Test, (On-Line) 03/21/2024

C10036653001 2-SV-3-4 Perform On Line Testing/Adjustment 03/21/2024

C10049545001 2-CFI-420; Perform 2-IHP-6030-IMP-608 to Calibrate Loop 03/18/2024

71151 Miscellaneous Operational Narrative Logs 01/01/2023-

2/31/2023

Procedures PMP-7110-PIP-Reactor Oversight Program Performance Indicator 22

001 and Monthly Operating Report Datasheets

(January 2023 thru December 2023)

19