IR 05000333/2016007

Component Design Bases Inspection Report 05000333/2016007, Design Bases Inspection (Team) - Pilot

ML16162A077
Person / Time
Site:	FitzPatrick
Issue date:	06/10/2016
From:	Paul Krohn Engineering Region 1 Branch 2
To:	Brian Sullivan Entergy Nuclear Northeast
Krohn P
References
IR 2016007
Download: ML16162A077 (31)

Text

June 10, 2016

SUBJECT:

JAMES A. FITZPATRICK NUCLEAR POWER PLANT - COMPONENT DESIGN BASES INSPECTION REPORT 05000333/2016007, DESIGN BASES INSPECTION (TEAM) - PILOT

Dear Mr. Sullivan:

On April 29, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the James A. FitzPatrick Nuclear Power Plant (FitzPatrick). The enclosed inspection report documents the inspection results, which were discussed on April 29, 2016, with Mr. David Poulin, Engineering Director, and other members of your staff.

NRC inspectors examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license. In conducting the inspection, the team examined the adequacy of selected components to mitigate postulated transients, initiating events, and design basis accidents.

The inspection involved field walkdowns, examination of selected procedures, calculations and records, and interviews with station personnel.

The inspectors documented two NRC-identified findings of very low safety significance (Green). One of these findings was determined to involve a violation of NRC requirements.

However, because of the very low safety significance of the violation and because it was entered into your corrective action program, the NRC is treating this finding as a non-cited violation (NCV) consistent with Section 2.3.2.a of the NRC Enforcement Policy.

If you contest the NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001, with copies to the Regional Administrator, Region I; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Senior Resident Inspector at FitzPatrick. In addition, if you disagree with the cross-cutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region I, and the NRC Senior Resident Inspector at FitzPatrick. In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Docket Room or from the Publicly Available Records component of NRCs Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Paul G. Krohn, Chief Engineering Branch 2 Division of Reactor Safety

Docket No.

50-333 License No.

DPR-59

Enclosure:

Inspection Report 05000333/2016007 w/Attachment: Supplemental Information

REGION I==

Docket No.

50-333

License No.

DPR-59

Report No.

05000333/2016007

Licensee:

Entergy Nuclear Northeast (Entergy)

Facility:

James A. FitzPatrick Nuclear Power Plant

Location:

Scriba, NY

Inspection Period:

April 11 - 29, 2016

Inspectors:

D. Kern, Senior Reactor Inspector, Division of Reactor Safety (DRS),

Team Leader H. Gray, Senior Reactor Inspector, DRS J. Schoppy, Senior Reactor Inspector, DRS J. Ayala, Reactor Inspector, DRS S. Kobylarz, Electrical Contractor J. Zudans, Mechanical Contractor

Approved By:

Paul G. Krohn, Chief Engineering Branch 2 Division of Reactor Safety

SUMMARY

Inspection Report 05000333/2016007; 04/11/2016 - 04/29/2016; James A. FitzPatrick Nuclear

Power Plant (FitzPatrick); Component Design Bases Inspection (Programs).

The report covers the Component Design Bases Inspection conducted by a team of four U.S. Nuclear Regulatory Commission (NRC) inspectors and two NRC contractors. Two findings of very low safety significance (Green) were identified, one of which was considered a non-cited violation (NCV). The significance of most findings is indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) and determined using Inspection Manual Chapter (IMC)0609, Significance Determination Process, dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310, Aspects Within the Cross-Cutting Areas, dated December 4, 2014. All violations NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated February 4, 2015. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision

Cornerstone: Mitigating Systems

Green.

The team identified a Green NCV of Title 10 of the Code of Federal Regulations (10 CFR), Part 50, Appendix B, Criterion III, Design Control, because Entergy did not ensure that FitzPatricks emergency diesel generator (EDG) lubrication oil (LO) supply storage facility was designed to withstand the effects of natural phenomena. Specifically, additional LO, maintained and inventoried monthly to ensure an adequate LO supply to meet the EDGs seven day mission time, was stored in a non-Class I structure that was not designed to withstand the effects of natural phenomena induced plant events that the EDGs were designed to mitigate. Entergy entered the issue into the corrective action program (CAP) as condition report (CR) 2016-1471 and promptly relocated the LO reserve inventory from warehouse No. 2 to the EDG building, which is constructed to Class I seismic and tornado protection design criteria.

The finding was more than minor because it was associated with the protection against external factors attribute of the Mitigating Systems cornerstone and adversely affected the cornerstones objective of ensuring reliability and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). The team evaluated the significance of this finding using IMC 0609, Appendix A, The Significance Determination Process for Findings at Power, Exhibit 2 - Mitigating Systems Screening Questions. The team determined the finding screened as very low safety significance (Green) because the finding was a design deficiency which did not result in an actual loss of functionality of the EDGs. This finding did not have a cross-cutting aspect because the underlying cause occurred in 1988 during warehouse No. 2 construction and was not indicative of current Entergy performance. (Section 1R21.2.1.1)

Green.

The team identified a Green finding involving Entergys inability to complete a time-critical operator action within the assumed probabilistic risk assessment (PRA) credited accident mitigation time limit to prevent undesirable consequences (i.e., core damage)under a postulated scenario (i.e., using the residual heat removal service water (RHRSW)system as an alternate injection source into the reactor pressure vessel (RPV) via the residual heat removal (RHR) system during a loss of coolant accident (LOCA)). Specifically, in response to a known degraded condition impacting an RHRSW valve, Entergy did not adequately evaluate an associated temporary procedure change to EP-8, Alternate Injection Systems, to ensure operator actions could be accomplished to initiate RHRSW injection to the RPV within the PRA-credited time. Entergy entered the issue into their CAP as CR 2016-1396 and CR 2016-1429 and completed corrective actions to pre-stage a ladder for operator use and provide additional guidance to plant operators.

The finding was more than minor because it was associated with the design control (plant modifications) attribute of the Mitigating Systems cornerstone and adversely affected the cornerstones objective of ensuring reliability, availability, and capability of systems and operators that respond to initiating events to prevent undesirable consequences (i.e., core damage). The team evaluated the finding in accordance with IMC 0609, Appendix A, The Significance Determination Process for Findings at Power, Exhibit 2 - Mitigating Systems Screening Questions, and concluded it required a detailed risk evaluation (DRE). A Region I Senior Reactor Analyst performed the DRE and concluded that the failure of an operator action to align RHRSW for RPV alternate injection within the assumed PRA accident mitigation time limit results in an estimated increase in core damage frequency in the mid E-8/year range, or very low safety significance (Green).

The finding had a cross-cutting aspect in the area of Problem Identification and Resolution,

Evaluation, because Entergy did not thoroughly evaluate issues to ensure that resolutions address causes and extent-of-conditions commensurate with their safety significance.

Specifically, Entergy did not thoroughly evaluate the effect of an alternate injection procedure change on PRA-credited time critical operator actions. [PI.2] (Section 1R21.2.1.2)

Other Findings

None

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R21 Component Design Bases Inspection

.1 Inspection Sample Selection Process

The team selected risk significant components for review using information contained in the FitzPatrick PRA model and the NRC Standardized Plant Analysis Risk model.

Additionally, the team referenced the FitzPatrick Plant Risk Information e-Book in the selection of potential components for review. In general, the selection process focused on components that had a Risk Achievement Worth factor greater than 1.3 or a Risk Reduction Worth factor greater than 1.005. The team also selected components based on previously identified industry operating experience (OE) issues and the component contribution to the large early release frequency. The components selected were associated with both safety-related and non-safety-related systems, and included a variety of components such as pumps, diesel engines, heat exchangers, electrical buses, transformers, circuit breakers, and valves.

The team initially compiled a list of components based on the risk factors previously mentioned. Additionally, the team reviewed the previous component design bases inspection reports (05000333/2007006, 05000333/201006, and 05000333/2013007) and excluded those components previously inspected. The team then performed a margin assessment to narrow the focus of the inspection to 13 components, one time-critical operator action, and one OE sample. The team selected a torus to drywell vacuum break valve to review for large early release frequency implications. The teams evaluation of possible low design margin included consideration of original design issues, margin reductions due to modifications, and margin reductions identified as a result of material condition/equipment reliability issues. The assessment also included items such as failed performance test results, corrective action history, repeated maintenance, Maintenance Rule (a)(1) status, operability reviews for degraded conditions, NRC resident inspector insights, system health reports, and industry OE.

Finally, consideration was also given to the uniqueness and complexity of the design and the available defense-in-depth margins.

The team performed the inspection as outlined in NRC Inspection Procedure

===71111.21M. This inspection effort included walkdowns of selected components; interviews with operators, system engineers, and design engineers; and reviews of associated design documents and calculations to assess the adequacy of the components to meet design basis, and licensing basis requirements. Summaries of the reviews performed for each component and OE sample are discussed in the subsequent sections of this report. Documents reviewed for this inspection are listed in the

.

.2.1.1 D Emergency Diesel Generator (Mechanical)

a. Inspection Scope

The team inspected the D EDG mechanical systems to verify that they were capable of supporting the design basis function of the EDG. The design function of the D EDG is to provide power to 4.16 kV electrical bus 10600 to operate safety equipment in the event offsite electrical power is lost during normal operation, operational transients, or design basis accidents. The team selected the EDG engine, fuel oil system, air start system, LO system, and jacket water cooling system for an in-depth review. The team reviewed calculations, operating logs, the EDG system operating procedure, surveillance tests, and the technical specifications (TS) to verify that Entergy maintained sufficient fuel oil and LO inventory for design bases accidents. The team also reviewed recent fuel oil and LO sample results to ensure that the respective sample was within the required specifications and to identify adverse trends.

The team reviewed various EDG performance tests to evaluate whether engine performance parameters, such as operating temperatures and LO and fuel oil filter differential pressures, were maintained within the acceptance criteria. The team reviewed the EDG vendor manual, surveillance tests, and preventive maintenance (PM)activities to ensure that Entergy adequately maintained the engine and support systems.

The team also reviewed cooling water design documents to determine system requirements and tube plugging limits, and reviewed recent heat exchanger (HX)inspection reports to ensure that heat transfer design assumptions were maintained.

The team reviewed corrective action documents and system health reports, and interviewed the system engineer to evaluate whether there were any adverse operating trends or existing issues affecting engine reliability. The team also conducted several detailed walkdowns of the EDG and its support systems (including control room instrumentation) to visually inspect the physical/material condition, to assess the operating environment and potential hazards, and to ensure adequate configuration control.

b. Findings

Introduction.

The team identified an NCV of very low safety significance (Green) of 10 CFR 50, Appendix B, Criterion III, Design Control, because Entergy did not ensure that FitzPatricks EDG LO supply storage facility was designed to withstand the effects of natural phenomena. Specifically, additional LO, maintained and inventoried monthly to ensure an adequate LO supply to meet the EDGs seven day mission time, was stored in a non-Class I structure that would not be able to withstand the effects of natural phenomena induced plant events that the EDGs were designed to mitigate.

Description.

FitzPatrick TS surveillance requirement (SR) 3.8.3.2 requires operators to verify that the LO inventory for each EDG is sufficient to support at least seven days of full load operation for each EDG. The TS SR 3.8.3.2 Bases also states that implicit in this SR is the requirement to verify the capability to transfer the lube oil from its storage location to the EDG, when the EDG lube oil sump does not hold adequate inventory for seven days of full load operation. Furthermore, the team verified that the existing EDG LO sumps did not contain sufficient inventory to support the full-load, seven day mission time. Operators inventory the reserve LO inventory monthly using procedure ST-9AA, EDG System A Fuel/Lube Oil Monthly Test Surveillance, Revision 5. The team reviewed the most recent ST-9AA documentation and independently walked down the LO reserve inventory stored onsite in warehouse No. 2 to verify Entergys TS compliance and the material condition of the storage facility. The team noted that Entergy maintained and accurately tracked the reserve LO inventory; however, the team questioned the adequacy of the storage facility. Specifically, the team questioned whether the LO stored in the warehouse was adequately protected to ensure its availability, including transfer capability, for EDG replenishment during and following natural phenomena such as severe weather events included in the plants design basis.

The EDG building houses the four EDGs in a one-story reinforced concrete structure with a structural steel supported roof. The building was constructed to Class I seismic and tornado protection design criteria. In accordance with the FitzPatrick Updated Final Safety Analysis Report (UFSAR), the EDG building was designed to withstand a tangential tornado wind velocity of 360 MPH, a translational wind velocity of 150 MPH, and an external pressure drop of 1.5 psig in 3 seconds, all occurring simultaneously.

The EDG building walls are also designed to withstand the impact of a tornado generated missile equivalent to a telephone pole traveling at 150 MPH. The EDG building, EDGs, auxiliaries, and EDG piping systems are designed to seismic criteria based on an Operating Basis Earthquake ground acceleration seismic factor of 0.08 g and a Design Basis Earthquake ground acceleration seismic factor of 0.15 g.

As described in the FitzPatrick UFSAR, the warehousing facilities consist of three buildings which serve as the central point for the storage of the plant's materials and replacement parts. The facilities are classified as non-safety-related. The team noted that warehouse No. 2 had a solid concrete base mat and steel I-beam construction; however, the corrugated metal sides did not appear sufficient to survive the design tornado loads and the LO storage shelves did not appear to be seismically restrained.

The team reviewed the building specifications for warehouse No. 2 and noted that the James A. FitzPatrick Warehouse Requirements Report, dated October 1, 1988, specified that warehouse No. 2 be constructed using a pre-fabricated metal building to accommodate Level C type storage. In addition, the team noted that the warehouses structural analysis certification, dated October 2, 1989, stated that the building was rated for 80 MPH wind loading. The team also noted that AOP-13, Severe Weather, Revision 25, did not contain any precautions and/or actions pertaining to the EDG LO inventory in response to high wind or tornado warnings.

In response to the teams questions, engineering concluded that the EDG LO inventory credited with satisfying TS SR 3.8.3.2 requirements was not located in a Class 1 structure. On April 22, 2016, Entergy initiated CR 2016-1471. Entergys short-term corrective actions included relocating the LO reserve inventory from warehouse No. 2 to the EDG building. Entergys long-term corrective actions included plans to revise applicable procedures and re-evaluate EDG sump capacity relative to the required volume to support seven days of EDG full load operation.

Analysis.

The performance deficiency associated with this finding was that Entergy did not verify FitzPatricks EDG LO supply storage facility was adequately designed to withstand the effects of natural phenomena so that the LO supply to meet the seven day mission time could be assured. The finding was considered more than minor because it was associated with the protection against external factors attribute of the Mitigating Systems cornerstone and adversely affected the cornerstones objective of ensuring reliability and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). The team evaluated the significance of this finding using IMC 0609, Appendix A, The Significance Determination Process for Findings at Power, Exhibit 2 - Mitigating Systems Screening Questions. The team determined that this finding screened as very low safety significance (Green) because the finding was a design deficiency which did not result in an actual loss of functionality of the EDGs.

This finding did not have a cross-cutting aspect because the most significant contributor of the performance deficiency occurred in 1988 during warehouse No. 2 construction and, thus, was not reflective of current Entergy performance.

Enforcement.

10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis as specified in the license are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, from October 1, 1988, to April 22, 2016, Entergy did not establish measures to assure that the design basis was correctly translated into specifications, drawings, and instructions used to construct the EDG LO storage facility. Specifically, Entergy did not ensure that the TS required LO inventory was stored in a Class I structure able to withstand the effects of natural phenomena induced plant events that the EDGs were designed to mitigate.

Entergys short-term corrective actions included entering the issue into their CAP and relocating the LO reserve inventory from warehouse No. 2 to the EDG building.

Because this violation is of very low safety significance and has been entered into Entergys CAP (CR 2016-1471), this violation is being treated as a NCV consistent with Section 2.3.2.a of the NRC Enforcement Policy. (NCV 05000333/2016007-01, Failure to Ensure Design Basis of EDG LO Storage Facility)

.2.1.2 Aligning Residual Heat Removal Service Water for Reactor Pressure Vessel Injection

a. Inspection Scope

The team evaluated manual operator actions to align RHRSW for RPV injection to verify that operator actions were consistent with design and licensing bases. Specifically, operator critical tasks for RHRSW loop A injection included:

Ensure available RHRSW pumps in loop A are running;

If RPV pressure is greater than 150 psig, throttle with 10MOV-89A to establish 2500 to 4000 GPM per RHRSW pump;

Open the RHRSW-to-RHR valves 10MOV-148A and 10MOV-149A;

When RPV pressure is less than 150 psig, ensure 10MOV-89A is closed;

Ensure low pressure coolant injection (LPCI) inboard injection valve 10MOV-25A is open; and

Throttle LPCI outboard injection valve 10MOV-27A to establish maximum injection rate, while maintaining RHRSW pump motor current less than or equal to maximum normal amperage loading.

The team interviewed licensed operators and operator simulator instructors, reviewed associated operating procedures and operator training, and performed plant walkdowns to evaluate the operators' ability to perform the required actions within the credited time.

The team walked down applicable control and indicating panels in the simulator and in the main control room to assess the likelihood of cognitive or execution errors. The team evaluated the available time margins to perform the actions to verify the reasonableness of Entergy's operating procedures and risk assumptions. The team also reviewed corrective action CRs and system health reports, and performed independent infield observations, to assess the material condition of the associated pumps, motors, valves, and support systems.

b. Findings

Introduction.

The team identified a finding of very low safety significance (Green)involving Entergys inability to perform a time critical operator action in sufficient time to prevent core damage under the postulated accident scenarios (i.e., using the RHRSW system as an alternate injection source into the RPV via the RHR system during a LOCA). Specifically, in response to a known degraded condition impacting an RHRSW valve, Entergy did not adequately evaluate an associated temporary procedure change to ensure that the operator actions to align RHRSW via RHR for alternate RPV injection could be accomplished within the PRA assumed accident mitigation time limit.

Description.

In both the NRC and Entergy Fitzpatrick PRA models, operator action is credited to establish RHRSW via the RHR system as an alternate injection to the RPV under certain accident scenarios to prevent core damage. The RPV level branch of emergency operating procedure (EOP)-2, RPV Control, Revision 9, directs control room operators to restore and maintain RPV level between 177 and 222.5 inches using one or more group 1 water level control systems (i.e., condensate/feedwater, control rod drive, high pressure coolant injection (HPCI), reactor core isolation cooling, LPCI, and core spray (CS)). If RPV level cannot be restored and maintained above 177 inches, then the operator is to maintain RPV level above 0 inches using one or more group 2 water level control systems (i.e., RHRSW crosstie, fire water crosstie, RHR keep-full, CS keep-full, condensate transfer and/or standby liquid control). Procedure EP-8, Alternate Injection Systems, Revision 3, provides the detailed instructions for establishing alternate injection using the RHRSW crosstie to the RHR system. The inspectors noted that numerous safety-related systems would need to fail to necessitate operators use of the RHRSW to RHR crosstie (i.e., HPCI, LPCI, and CS).

On August 26, 2015, operators initiated CR 2015-3793 in response to a degraded condition on 10MOV-89B (RHRSW discharge valve from the B RHR HX). The 10MOV-89B valve is normally closed and has a safety function to open to provide RHRSW cooling to the B RHR HX. Entergys corrective actions included throttling the 10MOV-89B open to satisfy its RHR HX cooling function, de-energizing the motor-operated valve (MOV) in this position, initiating compensatory measures to manually manipulate RHRSW pump discharge valves when starting RHRSW pumps, and making changes to applicable operating procedures that contained steps requiring operators to reposition 10MOV-89B to control RHR injection temperature. Entergy planned to maintain the compensatory measures and temporary procedure changes until maintenance could repair 10MOV-89B.

On September 2, 2015, Entergy approved a different temporary change (DRN-15-00198) to EOP support procedure EP-8 that directed additional manual operator actions locally at the pumps when starting B loop RHRSW pumps and substituted 10RHR-24B for 10MOV-89B manipulations. During a simulator walkdown to independently verify the adequacy of this temporary procedure change, the team questioned whether operators would be able to meet the PRA-credited time for this time critical operator action.

Specifically, the team noted that JAF-NE-09-00001, Appendix H, James A. FitzPatrick Nuclear Power Plant Probabilistic Safety Assessment Human Reliability Analysis, Revision 0, and AP-12.15, Control of Time Critical Operator Actions, Revision 2, credited control room operator action within two minutes for success; however, the procedure change substituted relatively simple switch manipulations from one control room panel with multiple manual operator actions at two different plant locations (the B RHRSW pump at the service water intake structure and the B RHR HX room). In particular, the team noted that 10RHR-24B (the substitute chosen for 10MOV-89B), was a locked-open manual valve located approximately ten feet off the ground in the B RHR HX room (a room posted as a high radiation area at power). In addition, during a walkdown in the B RHR HX room, the team noted that there was no readily accessible ladder for operators to use to access and operate the 10RHR-24B valve.

In response to the teams concerns, on April 15, 2016, operators performed an in-field (simulated) validation of the time critical operator action of aligning the B RHRSW loop to the B RHR system as would be done during an alternate RPV injection scenario.

Operators determined that the PRA-credited time critical operator action was no longer valid as it took a minimum of 15.5 minutes (vice 2 minutes) to execute. Operators promptly initiated CR 2016-1396 for this issue of concern. The team noted that in general, operators used a conservative approach during their validation (assuming that the equipment operator was not already in the reactor building and that the manual actions at the intake and in the B RHR HX room occurred in series vice concurrently).

However, the team noted that operations pre-staged a ladder in the B RHR HX prior to their timed validation. Operators also initiated CR 2016-1429 for their failure to perform a revalidation of the time critical operator action at the time of the EP-8 procedure change in September 2015. Based on a review of PRA small break loss of coolant accident (SBLOCA) sequences crediting the RHRSW to RHR crosstie for RPV water level recovery and discussions with the PRA engineer, the inspectors concluded that the operator action would not be successful in preventing core damage for all SBLOCAs given the projected extended time to complete the EP-8 actions.

Entergys short-term corrective actions included pre-staging a ladder for operator use, changes to EP-8, posting a copy of EP-8 outside the B RHR HX room, and providing additional guidance to plant operators. Entergys long-term corrective actions include evaluating additional changes to EP-8 and considering updating the PRA online risk model to remove credit for the RHRSW to RHR crosstie for the B loop until repairs on the 10MOV-89B valve are complete.

Analysis.

The performance deficiency associated with this finding was that Entergy did not adequately evaluate a temporary change to an EOP to ensure that the actions could be accomplished within the PRA assumed accident mitigation time limit. The finding is more than minor because it was associated with the design control attribute (i.e.,

associated with plant modifications to address a degraded 10MOV-89B condition) of the Mitigating Systems cornerstone and adversely affected the cornerstones objective of ensuring reliability, availability, and capability of systems and operators to respond to initiating events to prevent undesirable consequences (i.e., core damage). The team evaluated the finding in accordance with IMC 0609, Appendix A, The Significance Determination Process for Findings at Power, Exhibit 2 - Mitigating Systems Screening Questions, and concluded it required a detailed risk evaluation (DRE) since it represented a loss of function of a means of alternate RPV injection during a SBLOCA.

A Region I Senior Risk Analyst completed the DRE using the FitzPatrick Standardized Plant Analysis Risk model. Assuming an exposure period of one year and failing the operator action to align the RHRSW for RPV alternate injection (basic event RSW-XHE-XM-ERROR set to True), the estimated increase in core damage frequency for this issue is in the mid E-8/year range, or very low safety significance (Green). The dominant core damage sequence involves a plant centered loss of offsite power event with the subsequent loss of firewater system (back-up cooling to the EDGs).

The finding had a cross-cutting aspect in the area of Problem Identification and Resolution, Evaluation, because Entergy did not thoroughly evaluate the issue to ensure that resolutions address causes and extent of conditions commensurate with the safety significance. Specifically, Entergy did not thoroughly evaluate the effect of an alternate injection procedure change on a PRA-credited time critical operator action. [PI.2]

Enforcement.

The team did not identify a violation of regulatory requirements because the scenario of concern (e.g., SBLOCA with alternate RPV injection via the RHRSW system crosstied to the RHR system, due to failure of all Group 1 RPV water level control systems such as HPCI, LPCI, and CS) was beyond those design basis accidents described in the UFSAR. However, the team identified that actions credited in Entergys EOP support procedures could not be implemented as intended. Specifically, from September 2, 2015, to the present, time sensitive critical operator actions to align the RHRSW system for alternate RPV injection via the RHR system in accordance with EOP support procedure EP-8 could not be completed within the two minutes credited in Fitzpatricks PRA model as described in JAF-NE-09-00001, Appendix H and AP-15.15.

Entergys short-term corrective actions included entering the issue into their CAP (CR 2016-1396 and CR 2016-1429), pre-staging a ladder for operator use, changes to EP-8, posting a copy of EP-8 outside the B RHR HX room, and providing additional guidance to plant operators. Because this finding does not involve a violation and has very low safety significance, it is identified as a finding. (FIN 05000333/2016007-02, Failure to Adequately Evaluate a Procedure Change Impacting a PRA-Credited Time Critical Operator Action)

.2.1.3 Torus to Drywell Vacuum Breaker Valve (27VB-1)

a. Inspection Scope

The team reviewed torus-to-drywell vacuum breaker 27VB-1 to evaluate its ability to meet the design basis requirement to prevent suppression pool water from backing up into the drywell during various reactor coolant and suppression system condensation modes, and to limit negative pressure differentials on the drywell in conjunction with the torus vacuum relief system. The team reviewed applicable portions of the UFSAR, TS, associated design basis documents (DBDs), and calculations to identify the design basis functions for the torus-to-drywell vacuum breakers. The team verified that Entergy properly translated design inputs into system procedures and surveillance tests, and reviewed completed tests to verify vacuum breaker operability. The team performed several walkdowns of the torus-to-drywell vacuum breakers and remote position indication to assess configuration control, material condition, operating environment, and potential external hazards. Finally, the team reviewed corrective action documents, operating logs, surveillance tests, and system health reports to evaluate whether there were any adverse operating trends and to assess Entergy's ability to evaluate and correct problems.

b. Findings

No findings were identified.

.2.1.4 D Residual Heat Removal Pump (10P-3D)

a. Inspection Scope

This D RHR pump was designed to provide flow to support LPCI, decay heat removal (DHR), and containment spray safety functions to mitigate various design basis events.

Each of two redundant RHR loops contains two RHR pumps. The team reviewed applicable portions of TS, the UFSAR, and system DBDs to identify design basis requirements for the RHR pump. The team reviewed pump net positive suction head (NPSH) requirements and calculations to ensure adequate NPSH was available during normal and design basis operation (including implementation of NRC Bulletin 96-03, Potential Plugging of Emergency Core Cooling Suction Strainers by Debris in Boiling-Water Reactors). The team reviewed hydraulic calculations to ensure the system piping was adequately sized and designed. The team reviewed the in-service test (IST)program requirements, test procedures, test results, and trends for this component which included flow, pressure, and vibration monitoring. The team interviewed the system engineer and IST program manager, performed an in-plant walk down, and reviewed the system health report to assess the operational and material condition of the pump. The team reviewed the maintenance history and PM history for the pump to ensure the pump and motor were properly maintained. The team reviewed the pump vendor manual to ensure vendor best practices and recommendations were properly implemented. The team reviewed the pump maximum brake horsepower requirement to confirm the adequacy of the motor capability to supply power during worse case design basis conditions. The team reviewed the results of load flow and voltage regulation analyses to assess the adequacy of motor starting and running during degraded offsite voltage conditions coincident with a postulated design basis accident. Corrective action documents were reviewed to evaluate whether problems were properly identified, characterized, and corrected. Seismic evaluation documents were reviewed to ensure the pump was seismically qualified.

b. Findings

No findings were identified.

2.1.5 Residual Heat Removal Shutdown Cooling Isolation Valve (10MOV-18)

a. Inspection Scope

This valve is maintained closed during power operation to preserve the reactor coolant system pressure boundary and containment isolation. Operators open the valve to permit suction flow during the Shutdown Cooling mode of RHR system operation. The valve was designed to automatically close upon receiving an isolation signal to prevent the core from becoming uncovered. The team reviewed the TS, operating procedures, and UFSAR to determine the licensing and operating basis for the valve. The team reviewed MOV calculation analyses to ensure the valve was capable of functioning under design basis conditions. These included calculations for required thrust, maximum differential pressure, and valve weak link analysis. The team reviewed operating and test procedures to ensure the valve was operationally ready to perform its design functions. Diagnostic testing and IST results, including exercise test, position indication, available thrust, and leak rate testing were reviewed to verify acceptance criteria were met and performance degradation could be identified. The team interviewed the system engineer and MOV program manager to assess valve operational readiness. The team reviewed the system health report to assess the material condition of the valve. Maintenance history and PM history were reviewed to ensure the valve and motor operator were properly maintained. Corrective action documents were reviewed to evaluate whether problems were properly identified, characterized, and corrected. Seismic evaluation documents were reviewed to ensure the valve is seismically qualified. The Entergy response to NRC Information Notice 2012-14, Motor-Operated Valve Inoperable Due To Stem-Disc Separation, was reviewed to verify this valve was properly evaluated and that remote position verification was assured.

b. Findings

No findings were identified.

2.1.6 Fuel Pool Cleanup Recirculation Pump (19P-1B)

a. Inspection Scope

The fuel pool cooling and cleanup system, including recirculation pump 19P-1B, was designed to remove decay heat from spent fuel stored in the spent fuel storage pool and to maintain specified water temperature, purity, clarity, and level. The team reviewed the performance monitoring program, which included periodic visual inspection and operator rounds where pressure, flow, and temperature are monitored, to assess pump degradation and assure pump performance was maintained. The team reviewed pump NPSH requirements to ensure adequate NPSH was available during operation. The team reviewed available pipe sizing and hydraulic calculations to ensure the system was adequately designed. The team interviewed the system engineer, maintenance practices, history, and work orders to assess the material condition of the pump.

Periodic maintenance on this pump included changing pump oil on a 1.5 year frequency (last performed January 21, 2016) and rebuilding the pump on a 3 year frequency (last performed July 2, 2014). The team reviewed corrective action documents to evaluate whether problems were properly identified, characterized, and corrected. The team reviewed the pump vendor manual, alarm response and operating procedures, and pump operating curves to assure adequate flow and pressure were provided by the pump.

b. Findings

No findings were identified.

2.1.7 B Residual Heat Removal Heat Exchanger (10E-2B)

a. Inspection Scope

The team inspected the B RHR HX (10E-2B) to determine if it was capable of meeting its design basis function. Specifically, the team evaluated the ability of the HX to adequately remove decay heat during normal operations after a plant shutdown and following a postulated accident. The team reviewed applicable portions of the UFSAR, DBDs, and drawings to identify the design basis requirements for the HX. The team also reviewed design calculations to evaluate whether the HX had adequate capacity to transfer the required heat load during normal operations and postulated accident conditions. The team also interviewed system and design engineers and performed a walkdown of the HX to assess the material condition of the equipment. Actions taken in response to Generic Letter 89-13, Service Water System Problems Affecting Safety-Related Equipment, as applied to service water side of the A and B RHR HXs including periodic inspections and heat exchange capability verifications were reviewed.

Finally, the team reviewed corrective action documents and system health reports to evaluate whether there were any adverse operating trends and to assess Entergys ability to identify and correct problems.

b. Findings

No findings were identified.

2.1.8 Fuel Pool Heat Exchanger (19E-1B)

a. Inspection Scope

The team inspected the fuel pool HX (19E-1B) to determine if it was capable of meeting its design basis function. Specifically, the team reviewed design calculations and evaluated the ability of the HX to adequately remove decay heat during normal operations and following a postulated accident. The team reviewed applicable portions of the vendor manual, UFSAR, and DBDs to identify the design basis requirements for the HX. Additionally, the team reviewed the tube plugging limit, current tube plugging status, cleaning and inspection results, and thermal performance results to determine if the physical condition of the HX was within the design calculation assumptions. The team interviewed system and design engineers, reviewed maintenance history, and performed a walkdown of the HX to assess the current material condition of the equipment. Finally, the team reviewed corrective action documents and system health reports to evaluate whether there were any adverse operating trends and to assess Entergys ability to identify and correct problems.

b. Findings

No findings were identified.

2.1.9 A Decay Heat Removal Pump (IC-P-1B)

a. Inspection Scope

The primary requirement for the A DHR pump was to provide an alternate cooling water source to the spent fuel pool cooling system via the spent fuel pool cooling HX. The pump is not safety-related, and is not in the IST program. The A and the B DHR pumps and their corresponding sides of the outdoor water to air fan driven HXs provide redundant spent fuel pool cooling capability. The team reviewed the operating procedure, the system startup process, system maintenance procedures, and system backup electrical power provision. The team reviewed pump NPSH requirements to ensure adequate NPSH was available during operation. The team interviewed the system engineer, performed a walkdown, and reviewed system past performance to assess the material condition of the pumps. Maintenance history and PM history were reviewed to ensure the pump and motor were properly maintained. The team discussed procedure OP-30B, DHR System Operation, Revision 17, with system engineers to determine whether system operation with two DHR pumps was properly controlled (CR 2016-1508). Corrective action documents were reviewed to evaluate whether problems were identified, characterized, and corrected.

b. Findings

No findings were identified.

2.1.10 D Emergency Diesel Generator (Electrical) (93-EDGD)

a. Inspection Scope

The team inspected the D EDG to evaluate the ability of the EDG to respond to design basis accidents and station blackout conditions for the most limiting engine and generator control system auxiliary power supply conditions. The design function of the D EDG is to provide standby power to the Class 1E safety-related emergency 4160V bus, when the preferred power supply is not available. The team reviewed the electrical DBD to determine the required operational parameters. The team confirmed that vendor documentation for selected diesel starting components, such as the diesel starting air solenoids and the diesel engine speed detection and controls, and for critical generator auxiliaries and controls, such as generator field flash power and control and the generator circuit breaker closing controls, were properly rated for limiting control power design basis conditions. The team reviewed the maintenance and functional history of the EDG by evaluating corrective action reports, the system health report, corrective and PM activities, operating procedures, and surveillance test procedures and results to confirm that the EDG would perform the intended safety function. The team confirmed that surveillance testing adequately demonstrated the capability of the diesel generator to respond to design basis conditions. The team also reviewed a design modification for the diesel starting air solenoids to confirm that design basis requirements were adequately maintained. The team reviewed the EDG reliability test program to confirm that station blackout coping duration requirements were maintained. The team performed walkdowns of the D EDG and the EDG emergency switchgear bus, and interviewed system engineers to assess equipment environmental conditions, material condition, and settings for electrical protective devices. Finally, the team reviewed a sample of CRs related to the D EDG to evaluate whether Entergy appropriately identified, characterized, and corrected problems.

b. Findings

No findings were identified.

2.1.11 4160 Volt Bus10500 (71H05), and Incoming Line and EDG Circuit Breakers (71-10514 and 71-10512)

a. Inspection Scope

The team inspected the 4160V bus 10500 to evaluate the capability of the switchgear bus to supply the voltage and current requirements to one train of essential loads during design basis accident conditions. The inspectors reviewed the system voltage drop analysis to confirm the adequacy of voltage at selected components for the minimum conditions of offsite power system voltage. The team also reviewed the bus incoming line feeder and the EDG breaker overcurrent protective relay trip settings to verify the relays were appropriately coordinated for fault conditions and provided adequate equipment and cable protection. The team reviewed and verified that breaker protective relay setpoints were properly translated and incorporated into completed calibration tests. The team reviewed the maintenance and functional history of the bus by evaluating corrective action reports, the system health report, corrective and PM activities, operating procedures, and surveillance test procedures and results to confirm that the bus and breakers would operate to perform the intended safety function. The team performed walkdowns of the switchgear bus, and interviewed system engineers to assess equipment environmental conditions, material condition, and settings for electrical protective devices. Finally, the team reviewed a sample of CRs related to the Bus 10500 and associated electrical breakers to evaluate whether Entergy appropriately identified, characterized, and corrected problems.

b. Findings

No findings were identified.

2.1.12 600 Volt Emergency Bus 12600 (including 12602 Breaker) and 71T-16 4kV/600V Transformer===

a. Inspection Scope

The team inspected the 600V emergency bus 12600 (including bus feeder breaker

===12602) and the 71T-16 4kV/600V transformer to verify its ability to meet design basis requirements in response to steady-state, transient, and accident events and conditions.

Bus 12600 is fed from safety-related bus 4.16 kV bus 10600, through breaker 12602 and the 71T-16 4kV/600V transformer. The bus incoming feeder breaker is 12602 on the low voltage side of the transformer. The team reviewed the electrical DBD to determine the required operational parameters. The team reviewed vendor documentation to determine if the equipment was properly rated and to verify that it met design requirements. The team reviewed the maintenance and functional history of the switchgear by sampling corrective action reports, the system health report, operating procedures, and maintenance procedures and results. The team evaluated short circuit, voltage drop, and protective relaying calculations to ensure that adequate voltage and current would be available to meet design basis conditions. The team verified that protective relay and breaker setpoints were properly translated into system procedures and tests, and reviewed completed tests intended to demonstrate component operability.

The team reviewed drawings, component calculations, and system calculations to verify that calculation inputs and assumptions were accurate and justified. The team also conducted several walkdowns to visually inspect the physical condition of the switchgear and transformer to ensure adequate configuration control and material condition, and to assess potential vulnerability to hazards. The team also reviewed a sample of corrective action CRs related to the 12600 600VAC bus and the 71T-16 4kv/600V transformer to evaluate whether Entergy appropriately identified, characterized, and corrected problems.

b. Findings

No findings were identified.

2.1.13 Low Pressure Coolant Injection Motor Operated Valves Independent Power Supply (71INV-3B)

a. Inspection Scope

The team inspected the 600V LPCI MOVs independent power supply to verify its ability to meet design basis requirements in response to steady-state, transient, and accident events and conditions. The 600VAC power supply system is designed to provide a reliable and independent power source for the operation of three MOVs in each of two redundant RHR LPCI systems during a loss of offsite power coincident with a design basis loss of coolant accident. During normal operation, power to the LPCI motor control center (MCC) 165 bus is supplied from 600V emergency MCC 162 via the rectifier-charger and inverter of the uninterruptible power supply and the alternate power supply MCC 163. On an automatic LPCI actuation signal, the 600V emergency MCC power is cut-off and the LPCI MCC bus is supplied from the 419V DC battery and the inverter via an alternate power supply MCC 163. The team reviewed the electrical DBD and UFSAR to determine the required operational parameters. The team reviewed vendor documentation to determine if the equipment was properly rated and to verify that it met design requirements. The team reviewed the maintenance and functional history of the inverter by sampling corrective action reports, the system health report, operating procedures, and maintenance procedures and results. The team reviewed drawings, component calculations, and system calculations to verify that calculation inputs and assumptions were accurate and justified. The team also conducted several walkdowns to visually inspect the physical condition of the inverter and 419V battery to verify adequate configuration control. Finally, the team reviewed a sample of corrective action CRs related to 71INV-3B to evaluate whether Entergy appropriately identified, characterized, and corrected problems.

b. Findings

No findings were identified.

2.2 Review of Industry Operating Experience and Generic Issues===

The team reviewed one OE issue for applicability at FitzPatrick. The team performed a detailed review of the OE issue listed below to verify that Entergy had appropriately assessed potential applicability to site equipment and initiated corrective actions when necessary.

.2.2.1 NRC Information Notice 2010-023, Malfunctions of EDG Speed Switch Circuits

a. Inspection Scope

The team assessed Entergys applicability review and disposition of NRC Information Notice 2010-023. The team found that similar speed switch circuitry failures were identified at FitzPatrick in 2009 and that Entergy had initiated effective corrective actions under CR-JAF-2009-03439 to replace the speed switches.

b. Findings

No findings were identified.

4OA2 Identification and Resolution of Problems

a. Inspection Scope

The team reviewed a sample of problems that Entergy had previously identified and entered into the CAP. The team reviewed these issues to verify an appropriate threshold for identifying issues and to evaluate the effectiveness of corrective actions.

In addition, the team reviewed CRs written on issues identified during the inspection to verify adequate problem identification and incorporation of the problem into the CAP.

The specific corrective action documents that the team sampled and reviewed are listed in the Attachment.

b. Findings

No findings were identified.

4OA6 Meetings, including Exit

On April 29, 2016, the team presented the inspection results to Mr. David Poulin, Director of Engineering, and other members of the FitzPatrick staff. The team verified that no proprietary information was retained by the inspectors or documented in the report.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Entergy Personnel

R. Apa, Supply Chain Manager

A. Barton, Electrical Design Engineer

V. Bacanskas, Director and Chief Engineer, Entergy

J. Bishop, System Engineer

D. Bittinger, Acting Design Engineering Manager

J. Chartrand, System Engineer

C. Clancy, Performance Improvement Manager

M. Cook, System Engineer

J. Cooney, PRA Engineer

M. Cronk, Production Manager

B. Davis, Acting Performance Improvement Manager

B. Drews, Regulatory Assurance Manager

J. Ekman, Supervisor, Design Electrical/I&C

R. Giguere, System Engineer

C. Gill, Electrical Design Engineer

S. Glover, Senior Electrical Design Engineer

K. Habayeb, Mechanical Design Engineer

M. Hawes, Regulatory Assurance Specialist

J. Henderson, Acting Maintenance Manager

R. Hennessey, Code Engineer

J. Jackson, System Engineer

R. Kester, Senior Structural Engineer

A. Lauzon, EQ Engineer

M. Lewis, System Engineer

J. Mansfield, Welding Engineer

C. Parker, Code Engineer

M. Ponzo, Chemistry Manager

D. Poulin, Director of Engineering

M. Reno, Training Manager

T. Restuccio, Senior Operations Manager

J. Richardson, Systems Engineering Manager

M. Saunders, Design Engineer

D/ Starczewsli, Acting Systems Manager

L. Wilson, Simulator/Training Support Superintendant

T. Yost, Senior Electrical Design Engineer

NRC personnel

E. Knutson, Senior Resident Inspector

B. Sienel, Resident Inspector

LIST OF ITEMS

OPENED, CLOSED AND DISCUSSED

Open and

Closed

05000333/2016007-01 NCV

Failure to ensure design basis of EDG LO

storage facility. (Section 1R21.2.1.1)

05000333/2016007-02 FIN

Failure to adequately evaluate a procedure

change impacting a PRA-credited time

critical operator action. (Section

1R21.2.1.2)