IR 05000336/2023004

Integrated Inspection Report 05000336/2023004 and 05000423/2023004

ML24045A114
Person / Time
Site:	Millstone
Issue date:	02/14/2024
From:	Matt Young Division of Operating Reactors
To:	Carr E Dominion Energy
References
IR 2023004
Download: ML24045A114 (1)

Text

February 14, 2024

SUBJECT:

MILLSTONE POWER STATION, UNITS 2 AND 3 - INTEGRATED INSPECTION REPORT 05000336/2023004 AND 05000423/2023004

Dear Eric Carr:

On December 31, 2023, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at Millstone Power Station, Units 2 and 3. On January 25, 2024, the NRC inspectors discussed the results of this inspection with Michael OConnor, Site Vice President, and other members of your staff. The results of this inspection are documented in the enclosed report.

Six findings of very low safety significance (Green) are documented in this report. All of these findings involved violations of NRC requirements. We are treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2 of the Enforcement Policy.

If you contest the violations or the significance or severity of the violations documented in this inspection report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN:

Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region I; the Director, Office of Enforcement; and the NRC Resident Inspector at Millstone Power Station, Units 2 and 3.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region I; and the NRC Resident Inspector at Millstone Power Station, Units 2 and 3. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely, Matt R. Young, Chief Projects Branch 2 Division of Operating Reactor Safety

Docket Nos. 05000336 and 05000423 License Nos. DPR-65 and NPF-49

Enclosure:

As stated

Inspection Report

Docket Numbers:

05000336 and 05000423

License Numbers:

DPR-65 and NPF-49

Report Numbers:

05000336/2023004 and 05000423/2023004

Licensee:

Dominion Energy Nuclear Connecticut, Inc.

Facility:

Millstone Power Station, Units 2 and 3

Location:

Waterford, CT

Inspection Dates:

October 1, 2023 to December 31, 2023

Inspectors:

J. Fuller, Senior Resident Inspector

E. Allen, Resident Inspector

E. Bousquet, Resident Inspector

P. Cataldo, Senior Reactor Inspector

J. Demarshall, Senior Operations Engineer

N. Eckhoff, Health Physicist

T. Hedigan, Operations Engineer

K. Mangan, Senior Reactor Inspector

N. Mentzer, Reactor Inspector

P. Ott, Operations Engineer

D. Werkheiser, Senior Reactor Analyst

Approved By:

Matt R. Young, Chief

Projects Branch 2

Division of Operating Reactor Safety

SUMMARY

The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees performance by conducting an integrated inspection at Millstone Power Station, Units 2 and 3, in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors. Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information.

List of Findings and Violations

Diesel Fire Pump Failed to Start Due to Paint Covering the Starter Relays Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000423,05000336/2023004-01 Open/Closed

[H.1] -

Resources 71111.24 A finding of very low safety significance (Green) and associated non-cited violation (NCV) of Millstone Unit 2 License Condition 2.C(3), Fire Protection, and Millstone Unit 3 License Condition 2.H, Fire Protection, was self-revealed when the licensee failed to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee was unable to start the diesel driven fire pump due to paint covering the starter relays, which rendered the fire suppression water system nonfunctional from October 14 to November 10, 2023.

Turbine-Driven Pump Auxiliary Feedwater Control Valve Spuriously Cycled with No Demand Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000423/2023004-02 Open/Closed

[P.3] -

Resolution 71152A The inspectors identified a finding of very low safety significance (Green) and associated NCV of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion XVI,

Corrective Action, when the licensee failed to promptly identify and correct a condition adverse to quality associated with the Unit 3 turbine-driven auxiliary feedwater (TDAFW)control valve (3FWA*HV36A). Specifically, the licensee failed to promptly identify and correct a degraded controller/positioner circuit card, which rendered the TDAFW pump inoperable for longer than its technical specification allowed outage time.

Failure to Maintain Design Control of the 3B Emergency Diesel Generator Overspeed Trip Setpoints Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000423/2023004-03 Open/Closed

[P.2] -

Evaluation 71152A The inspectors identified a finding of very low safety significance (Green) and associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, when the licensee failed to apply design control measures to a change in the Unit 3 'B' emergency diesel generator (EDG) overspeed trip setpoint. Specifically, after replacing the governor on the 3B EDG in May 2022, the licensee accepted an overspeed trip setpoint of 561.3 rpm, which was less than the 565 rpm setpoint established by licensee procedures and vendor recommendations, without evaluating the change against established design and qualification testing requirements. With the lower overspeed trip setpoint, the EDG did not maintain adequate margin to ensure it would not inadvertently trip on overspeed during a full short-term load rejection event.

Failure to Identify and Correct a Degraded Overspeed Trip Mechanism on the 3A Emergency Diesel Generator Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000423/2023004-04 Open/Closed

[P.2] -

Evaluation 71152A A finding of very low safety significance (Green) and associated NCV of 10 CFR Part 50,

Appendix B, Criterion XVI, Corrective Action, was self-revealed on November 9, 2023, when the Unit 3 'A' EDG automatically tripped on overspeed during a fast start surveillance test because the licensee had failed to identify and correct a degraded overspeed trip mechanism after a previous overspeed trip on July 13, 2022.

Charging System Inoperable Due to Air Void Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000423/2023004-05 Open/Closed

[H.1] -

Resources 71152A The inspectors identified a Green finding and associated NCV of Millstone Unit 3 Technical Specification (TS) 6.8.1, Procedures and Programs, when the licensee failed to establish and implement an adequate procedure to vent and refill the emergency core cooling system (ECCS) piping following maintenance during the spring 2022 refueling outage. This resulted in the entrapment of an unacceptable volume of air that rendered one train of the ECCS inoperable for approximately 5 months.

Incorrect Assumptions Used to Determine Void Operability Limits for Charging Suction Piping Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000423/2023004-06 Open/Closed None (NPP)71152A The inspectors identified a Green finding and associated NCV of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, when the licensee failed to assure that applicable regulatory requirements and the design basis, for structures, systems, and components (SSCs) were correctly translated into specifications, drawings, procedures, and instructions and provisions to assure that appropriate quality standards were specified and included in design documents.

Specifically, the inspectors reviewed calculation 14-ENG-04518M3, MP3 GL-2008-01, Pump Suction Side Gas Void Allowable Volume Using Westinghouse Simplified Equation Method,

Revision 0, and determined that the incorrect pressures were used to determine the acceptable void size for ECCS crossover piping. As a result, the licensee incorrectly concluded that the charging system was operable when air voids were found in the piping.

Additional Tracking Items

Type Issue Number Title Report Section Status LER 05000423/2022-003-00 LER 2022-003-00 for Millstone Unit 3,

Gas Void in Emergency Core Cooling System Resulted in a Condition Prohibited by Technical Specifications 71153 Closed

PLANT STATUS

Unit 2 began the inspection period at approximately 65 percent rated thermal power due to one of the circulating water pumps (CWPs) being out of service for maintenance. Unit 2 returned to rated thermal power on October 5, 2023, and remained at or near rated thermal power for the remainder of the inspection period.

Unit 3 began the inspection period at 100 percent rated thermal power. On October 19, 2023, the unit was shut down for a scheduled refueling outage. On December 1, 2023, the unit was placed online, and power was raised to approximately 50 percent. On December 2, 2023, the unit was shut down due to a condenser tube leak. On December 13, 2023, the unit returned to 100 percent rated thermal power. On December 18, 2023, the operators performed a rapid downpower to approximately 57 percent due the failure of a CWP traveling screen. The unit returned to rated thermal power on December 21, 2023. On December 23, 2023, the operators performed a rapid downpower to 84 percent as required for the loss of a second off-site power line. The unit returned to rated thermal power later that day and remained at or near rated thermal power for the remainder of the inspection period.

INSPECTION SCOPES

Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with their attached revision histories are located on the public website at http://www.nrc.gov/reading-rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared complete when the IP requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter (IMC) 2515, Light-Water Reactor Inspection Program - Operations Phase. The inspectors performed activities described in IMC 2515, Appendix D, Plant Status, conducted routine reviews using IP 71152, Problem Identification and Resolution, observed risk-significant activities, and completed on-site portions of IPs. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.

71111.01 - Adverse Weather Protection

Seasonal Extreme Weather (IP Section 03.01) (2 Samples)

(1) The inspectors evaluated readiness for seasonal extreme weather conditions prior to the onset of seasonal cold temperatures for the Unit 2 condensate storage tank, refueling water storage tank, and service water pumps and strainers from October 16 to 20, 2023.

(2) The inspectors evaluated readiness for seasonal extreme weather conditions prior to the onset of seasonal cold temperatures for the Unit 3 'A' EDG, 'B' EDG, and TDAFW pump on November 21 and 28, 2023.

71111.04 - Equipment Alignment

Partial Walkdown (IP Section 03.01) (2 Samples)

The inspectors evaluated system configurations during partial walkdowns of the following systems/trains:

(1) Unit 3 spent fuel cooling during full core offload and low time to boil on October 30, 2023

(2) Unit 2 auxiliary feedwater system from the condensate storage tank to the suction of each auxiliary feed pump on November 28, 2023

Complete Walkdown (IP Section 03.02) (1 Sample)

(1) The inspectors evaluated system configurations during a complete walkdown of the Unit 3 emergency core cooling portions of the charging system on October 31 and November 1, 8, and 14, 2023.

71111.05 - Fire Protection

Fire Area Walkdown and Inspection (IP Section 03.01) (4 Samples)

The inspectors evaluated the implementation of the fire protection program by conducting a walkdown and performing a review to verify program compliance, equipment functionality, material condition, and operational readiness of the following fire areas:

(1) Unit 3 containment (fire area RC-1) during the fall refueling outage on November 5, 2023

(2) Unit 2 charging pump room (fire area A-6A) on November 27, 2023

(3) Unit 2 west main steam safety valve room (fire area A-8E) on December 1, 2023

(4) Unit 2 'B' safeguards pump room (fire area A-3) on December 4, 2023

71111.07A - Heat Exchanger/Sink Performance

Annual Review (IP Section 03.01) (1 Sample)

The inspectors evaluated readiness and performance of:

(1) Unit 3 'A' containment recirculation cooler (3RSS*E1A) on October 27, 2023

===71111.08P - Inservice Inspection Activities (Pressurized-Water Reactor (PWR))

The inspectors verified that the reactor coolant system boundary, reactor vessel internals, risk-significant piping system boundaries, and containment boundary are appropriately monitored for degradation and that repairs and replacements were appropriately fabricated, examined, and accepted by reviewing the following activities from October 23 to November 3, 2023.

PWR Inservice Inspection Activities - Nondestructive Examination (NDE) and Welding Activities (IP Section 03.01)===

The inspectors verified that the following NDE and welding activities were performed appropriately:

(1)

• Automated phased array ultrasonic testing and eddy current testing of Class 1 reactor pressure vessel outlet nozzle dissimilar metal welds in accordance with CC N-770-5 (Framatome Report 180-9371067-000)

• Manual ultrasonic testing of intragranular stress corrosion cracking-susceptible elbow-to-pipe weld, SIL-5-5-SW-K (NDE Report 3-UT-23-052)

• Radiograph, ultrasonic, and liquid penetrant testing of Class 1 welded attachments for replacement 3RCS*V106, SI-to-RCS check valve (Mistras Radiography Report Job #23044, dated October 18, 2023, NDE Reports 3-UT-23-079 and 080, and BOP-PT-23-065)

• Manual ultrasonic testing of reactor coolant loop stop valve stems for MV8001B and 2B, and MV8001D and 2D (NDE Reports 3-UT-23-004, 005, 006, and 007)

• Manual ultrasonic testing of 2-inch reactor coolant system hot-leg loop drain (V211) valve-to-pipe weld RCS-178-FW-15 (3-UT-23-026)

• Manual magnetic particle testing of reactor pressure vessel closure head-to-flange weld (NDE Report 3-MT-23-001)

• Manual liquid penetrant testing of 'A' residual heat removal heat exchanger Class 2 shell-to-skirt weld (NDE Report 3-PT-23-001)

• Visual testing of steam generator channel head drain nozzle-to-head penetration Class 1 dissimilar welds (NDE Reports 3-VT-23-014, 015, 016, and 017)

• Visual testing (augmented) of pressurizer heater nozzle/sleeve welds (NDE Reports 3-VT-23-008)

• Visual examinations of containment liner moisture barrier indications from the previous outage, conducted under problem identification and resolution (CR1196946)

PWR Inservice Inspection Activities - Vessel Upper Head Penetration Inspection Activities (IP Section 03.02) (1 Sample)

The inspectors verified that the licensee conducted the following vessel upper head penetration inspections and addressed any identified defects appropriately:

(1) Visual examinations based on American Society of Mechanical Engineers Code Case N-729-6 of penetrations 2, 12, 34, 44, and 75 (NDE Report 3-VE-23-006)

PWR Inservice Inspection Activities - Boric Acid Corrosion Control Inspection Activities (IP Section 03.03) (1 Sample)

The inspectors verified the licensee is managing the boric acid corrosion control program through a review of the following evaluations:

(1)

• Boric acid evaluation for 3SIL*V056 (CR1241389)

• Boric acid evaluation for 3CHS*V518 (CR1241252)

• Boric acid evaluation for 3SIL*V946 (CR1241046)

• Boric acid evaluation for 3RHS*8701C (CR1241119)

• Boric acid evaluation for 3RCS*V922 (CR1241136)

PWR Inservice Inspection Activities - Steam Generator Tube Inspection Activities (IP Section 03.04) (1 Sample)

The inspectors verified that the licensee is monitoring the steam generator tube integrity appropriately through a review of the following examinations:

(1)

• Eddy current testing of inservice tubes in steam generators 'A', 'B', and 'C'

• Secondary side visual examinations of steam generators 'A' and 'B'

• Primary side visual examinations of plugged tubes in steam generators 'A' and

'B'

71111.11A - Licensed Operator Requalification Program and Licensed Operator Performance

Requalification Examination Results (IP Section 03.03) (2 Samples)

(1) The inspectors reviewed and evaluated the licensed operator examination failure rates for the Unit 3 requalification annual operating tests administered October to December 2023 and the Unit 3 biennial written examinations administered November to December 2022.

(2) The inspectors reviewed and evaluated the licensed operator examination failure rates for the Unit 2 requalification annual operating exams completed on December 15, 2023.

71111.11B - Licensed Operator Requalification Program and Licensed Operator Performance

Licensed Operator Requalification Program (IP Section 03.04) (1 Sample)

(1) Biennial Requalification Written Examinations

The inspectors evaluated the quality of the Unit 3 licensed operator biennial requalification written examinations administered November to December 2022.

Annual Requalification Operating Tests

The inspectors evaluated the adequacy of the Unit 3 facility licensees annual requalification operating test administered during the week of December 11, 2023.

Administration of an Annual Requalification Operating Test

The inspectors evaluated the effectiveness of the facility licensee in administering requalification operating tests required by 10 CFR 55.59(a)(2) and that the facility licensee is effectively evaluating their licensed operators for mastery of training objectives.

Requalification Examination Security

The inspectors evaluated the ability of the facility licensee to safeguard examination material, such that the examination is not compromised.

Remedial Training and Re-examinations

The inspectors evaluated the effectiveness of remedial training conducted by the licensee, and reviewed the adequacy of re-examinations for licensed operators who did not pass a required requalification examination.

Operator License Conditions

The inspectors evaluated the licensees program for ensuring that licensed operators meet the conditions of their licenses.

Control Room Simulator

The inspectors evaluated the adequacy of the facility licensees control room simulator in modeling the actual plant, and for meeting the requirements contained in 10 CFR 55.46.

71111.11Q - Licensed Operator Requalification Program and Licensed Operator Performance

Licensed Operator Performance in the Actual Plant/Main Control Room (IP Section 03.01) (2 Samples)

(1) The inspectors observed and evaluated licensed operator performance in the Unit 3 control room during reactor shutdown and cooldown, feedwater heater level control challenges, and reactor coolant system decreased inventory on October 19, 23, and 24, 2023.

(2) The inspectors observed and evaluated licensed operator performance in the Unit 2 control room during tagout of 'B' EDG for diesel maintenance outage and response to repeated trip of enclosure building purge supply fan F-23, resulting in securing enclosure building purge on December 11, 2023

Licensed Operator Requalification Training/Examinations (IP Section 03.02) (2 Samples)

(1) The inspectors observed and evaluated operator performance in the Unit 2 simulator involving emergency operating procedures and a simulated emergency declaration on November 28, 2023.

(2) The inspectors observed and evaluated operator performance in the Unit 3 simulator involving emergency operating procedures and a simulated emergency declaration on December 12, 2023

71111.12 - Maintenance Effectiveness

Maintenance Effectiveness (IP Section 03.01) (2 Samples)

The inspectors evaluated the effectiveness of maintenance to ensure the following SSCs remain capable of performing their intended function:

(1) Unit 3 pressurizer power operated relief valve stroke time and full cycle test failure on October 20, 2023 (CR1241058, CA12192344)

(2) Unit 3 auxiliary feedwater control valve controller card, 3FWA-036A, failure on October 30, 2023 (CR1241666, CR1241127, CR1239874)

71111.13 - Maintenance Risk Assessments and Emergent Work Control

Risk Assessment and Management (IP Section 03.01) (3 Samples)

The inspectors evaluated the accuracy and completeness of risk assessments for the following planned and emergent work activities to ensure configuration changes and appropriate work controls were addressed:

(1) Unit 3 shutdown risk evaluation and protected equipment during reactor coolant system draining 1.5 to 2 feet below the reactor vessel flange with a low time to boil on October 25 and 26, 2023

(2) Unit 2 elevated risk and associated risk mitigating actions with one off-site power supply not available on October 27, 2023

(3) Unit 3 elevated risk and associated medium risk plan mitigating actions for protection of the 'B' CWP while the 'A' CWP was out of service on December 19, 2023, and protection of the 'A' CWP when the 'B' CWP was out of service on December 20, 2023

71111.15 - Operability Determinations and Functionality Assessments

Operability Determination or Functionality Assessment (IP Section 03.01) (3 Samples)

The inspectors evaluated the licensees justifications and actions associated with the following operability determinations and functionality assessments:

(1) Unit 2 reactor building closed-cooling water operability determination and engineering technical evaluation on inboard bearing clearance housing exceeding diameter tolerance on October 17, 2022 (CR1210440)

(2) Unit 3 residual heat removal system motor operated valves, 3RHS*MV8701C and 3RHS*MV8702C, after borescope inspection of the magnesium rotor revealed minor degradation of the cooling fin coatings on October 31, 2023 (CR1242323, CR1242184, CR1242206)

(3) Unit 3 main steam code safety valve, 3MSS*RV22D, lifted below setpoint on November 27, 2023 (CR1244821)

71111.18 - Plant Modifications

Temporary Modifications and/or Permanent Modifications (IP Section 03.01 and/or 03.02) (1 Sample)

The inspectors evaluated the following temporary or permanent modifications:

(1) Unit 3 permanent modification for canopy seal weld repair of spare reactor pressure vessel head penetration L-7 on November 1, 2023

71111.20 - Refueling and Other Outage Activities

Refueling/Other Outage (IP Section 03.01) (2 Samples)

(1) The inspectors evaluated Unit 3 refueling outage 3R22 activities from October 19 to December 1, 2023

(2) The inspectors evaluated Unit 3 forced outage activities from December 2 to 9, 2023

71111.24 - Testing and Maintenance of Equipment Important to Risk

The inspectors evaluated the following testing and maintenance activities to verify system operability and/or functionality:

Post-Maintenance Testing (IP Section 03.01) (8 Samples)

(1) Unit 3 'A' steam generator terry turbine isolation valve after replacement of the logic relay card 3FWA*HY36A4 on October 2, 2023 (work order (WO)53203388762, CR1239451)

(2) Unit 3 valve stroke of 3CHS*MV8468A after replacement of the packing on November 1, 2023 (WO53203399569)

(3) Unit 3 valve stroke and position verification following overhaul of CHS*HCV190A on November 11, 2023 (WO53102829468, WO53203351076)

(4) Unit 3 'A' EDG after repair to the mechanical overspeed trip mechanism on November 14, 2023 (CR1243459, WO53203403664)

(5) Unit 3 'A' steam generator terry turbine isolation valve after replacement of the controller/positioner card (3FWA*HY36A6) on November 15, 2023 (WO53203258458, CR1241127)

(6) Unit 2 'C' charging pump post-maintenance testing following pump overhaul on November 28, 2023 (WO53203398198)

(7) Unit 3 TDAFW pump after planned 12-year internal inspection and overhaul on November 30, 2023 (WO53203377155)

(8) Unit 2 'B' EDG after planned preventive maintenance on December 12, 2023 (WO53203383242, WO53203385717, CR1246584)

Surveillance Testing (IP Section 03.01) (1 Sample)

(1) Unit 3 steam generator 1A feedwater check valve failed surveillance testing on December 1, 2023 (WO53102935083, CR1245292)

Inservice Testing (IP Section 03.01) (1 Sample)

(1) Unit 3 auxiliary feedwater valve operability test for 3FWA*HV36A on October 20, 2023 (Surveillance Procedure (SP) 3622.8 and CR1239874)

Containment Isolation Valve Testing (IP Section 03.01) (1 Sample)

(1) Unit 3 containment leak test type 'C' 3CHS*RV8117 on November 9, 2023 (WO53203346286)

71114.06 - Drill Evaluation

Drill/Training Evolution Observation (IP Section 03.02) (1 Sample)

The inspectors evaluated:

(1) Unit 3 event notification from the control room on October 4,

71124.01 - Radiological Hazard Assessment and Exposure Controls

Radiological Hazards Control and Work Coverage (IP Section 03.04) (1 Sample)

The inspectors evaluated the licensees control of radiological hazards for the following radiological work:

(1) RWP-3230308

71124.05 - Radiation Monitoring Instrumentation

Walkdowns and Observations (IP Section 03.01) (2 Samples)

The inspectors evaluated the following radiation detection instrumentation during plant walkdowns:

(1) General Atomics radiation monitor (3HVR*RIY12A/B), Unit 3 auxiliary building

(2) General Atomics radiation monitor (3CMS*RIY22A/B), Unit 3 auxiliary building

Calibration and Testing Program (IP Section 03.02) (3 Samples)

The inspectors evaluated the calibration and testing of the following radiation detection instruments:

(1) General Atomics containment high-range radiation monitor (3RMS*RIY04A)

(2) General Atomics containment high-range radiation monitor (3RMS*RIY05A)

(3) General Atomics control building inlet radiation monitor (3HVC*RE16A)

71124.08 - Radioactive Solid Waste Processing and Radioactive Material Handling, Storage,

and Transportation

Shipment Preparation (IP Section 03.04)

(1) The inspectors observed the preparation of radioactive shipment 23-141 of contaminated OREX material on November 2,

OTHER ACTIVITIES - BASELINE

===71151 - Performance Indicator Verification

The inspectors verified licensee performance indicators submittals listed below:

OR01: Occupational Exposure Control Effectiveness (IP Section 02.15)===

(1) October 1, 2022 through September 30, 2023 PR01: Radiological Effluent Technical Specifications/Off-site Dose Calculation Manual Radiological Effluent Occurrences (RETS/ODCM) Radiological Effluent Occurrences (IP Section 02.16) (1 Sample)

(1) October 1, 2022 through September 30, 2023

71152A - Annual Follow-up of Problem Identification and Resolution Annual Follow-up of Selected Issues (Section 03.03)

The inspectors reviewed the licensees implementation of its corrective action program related to the following issues:

(1) Unit 3 'A' and 'B' EDG overspeed trip settings not within prescribed range (CR1198827, CR1243459, CR1243545)

(2) Identification of a gas void outside of acceptable limits in the 'A' residual heat removal piping (CR1209700, Level of Effort Evaluation (LEE) CA11305186)

(3) Unit 3 degraded supplementary leak collection and release system (SLCRS) dampers (CR1195831)

(4) Unit 3 TDAFW supply isolation valve to the 'A' steam generator (3FWA*HV36A)spuriously closed and reopened to a mid-position on September 4, October 1, and October 5, 2023 (CR1239874, CR1239451, CR1237072, CR1236980, CR1236949, CR1241666, CR1241127)

71153 - Follow-up of Events and Notices of Enforcement Discretion Event Report (IP Section 03.02)

The inspectors evaluated the following licensee event reports (LERs):

(1) Licensee Event Report 05000423/2022-003-00, "Gas Void in the Emergency Core Cooling System Resulted in a Condition Prohibited by Technical Specifications" (ADAMS Accession: ML23301A009). The inspection conclusions associated with this LER are documented in this report under Inspection Results Section 71152A.

Personnel Performance (IP Section 03.03) (1 Sample)

(1) The inspectors evaluated Unit 3 licensed reactor operator performance during a rapid down power from 100 percent to 57 percent rated thermal power after the 'A' traveling screen failed on December 18, 2023

Reporting (IP Section 03.05) (2 Samples)

(1) Unit 2 event notification (EN) retraction for EN 56637, including engineering technical evaluation ETE-MP-2023-1074 associated with the Unit 2 control room ventilation system on September 26, 2023

(2) Unit 3 steam TDAFW control valve (3FWA*HV36A) spuriously cycled without operator action on September 4, October 1, and October 5, 2023 (CR1236949, CR1239451, CR1239874)

INSPECTION RESULTS

Diesel Fire Pump Failed to Start Due to Paint Covering the Starter Relays Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000423,05000336/2023004-01 Open/Closed

[H.1] -

Resources 71111.24 A finding of very low safety significance (Green) and associated NCV of Millstone Unit 2 License Condition 2.C(3), Fire Protection, and Millstone Unit 3 License Condition 2.H, Fire Protection, was self-revealed when the licensee failed to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee was unable to start the diesel driven fire pump due to paint covering the starter relays, which rendered the fire suppression water system nonfunctional from October 14 to November 10, 2023.

Description:

On November 10, 2023, during the monthly surveillance testing, the diesel fire pump failed to auto-start based on simulated fire header pressure loss. Initial troubleshooting efforts were also unable to start the pump manually. The licensee entered this issue in its corrective action program as CR1243507. The inspectors noted that the last satisfactory surveillance test for this pump was on October 14, 2023.

The licensees troubleshooting identified that electrical contacts associated with the starting circuit were unable to be repositioned due to mechanical interference (paint) around the contacts. The condition of the contacts prevented the diesel fire pump from being started in any of the three starting modes (automatic, manual 1, or manual 2). Since the diesel fire pump was not able to be started in automatic or manual, it was not able to perform any of its credited functions.

The inspectors noted that painting had been performed in the diesel fire pump room on September 27, 2023, under the direction of WO53203357455. This work order provided direction to perform Unit 3 painting activities per specification SP-CE-245, Specification for Application of Protective Coating Materials Outside Containment at Millstone Power Station - Unit 3.

This specification stated that Appropriate precautions shall be taken to prevent coatings being applied in one area from dripping or drifting onto or damaging corrosion-resistant metals (stainless steel, etc.), machined contact surfaces, rotating machinery, gages, instrumentation dials, etc. Suitable protective coverings shall be used when applying materials, particularly when spraying adjacent to surfaces which are subject to damage from drifting paint. Paint spots and fogging from sprays shall be removed from surfaces affected in accordance with an approved procedure.

As described in Section 4.1.1, Site Water Supply System, of the Millstone Power Station Unit 3 Safety Analysis Report - Fire Protection Evaluation Report, two fire pump houses contain the stations three fire pumps, each rated at 2,000 gpm at 100 psi. All three pumps can take suction from either or both tanks and have individual connections to the underground supply system. All three fire pumps have separate control panels supplied from separate power supplies. If the two motor driven pumps fail to start or are unable to maintain system pressure, the diesel driven fire pump will automatically start when system pressure reaches 75 psig. The diesel driven fire pump is electrically independent with its own self-contained redundant battery system for starting.

Section 4.1.1 of the Fire Protection Evaluation Report also states, If a major fire in any location of Unit 3 should occur, the combined water tanks and makeup water capacity would provide an adequate water supply for Unit 3. The necessary pressure and flow would be maintained through the use of any two of the three station fire pumps.

Section 4.1.1, Site Water Supply Systems, of the Unit 2 Fire Hazard Analysis, U2-24-FPP-FHA, contains similar design commitments as stated above for Unit 3.

Additionally for Unit 2, in some fire scenarios, the fire hazard analysis and safe shutdown analysis credit fire water supply to the auxiliary feedwater system after the condensate storage tank is depleted after 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. This function is described in the Unit 2 Appendix R Compliance Report, 25203-SP-M2-SU-1046.

Unit 3 Technical Requirements 3.7.12.1, Fire Suppression Water System, and Unit 2 Technical Requirements 3.7.9.1, Fire Suppression Water System, states, in part, that The Fire Suppression Water System shall be FUNCTIONAL with three high-pressure fire pumps, each with a capacity of at least 1,800 gpm, with pump discharge aligned to the fire suppression header. The inspectors noted that the due to unrelated, planned maintenance on one of the fire water storage tanks, the licensee had taken the appropriate technical requirements manual (TRM) ACTION for one pump and/or one water supply nonfunctional.

Specifically, the licensee met Unit 3 TRM ACTION 3.7.12.1.a.2 and Unit 2 TRM ACTION 3.7.9.1.a.2 to provide an alternate backup pump or water supply and developed a plan for restoring the system to FUNCTIONAL status. This alternate pump was available from September 17 to November 28, 2023, which enveloped the time that the diesel fire pump is believed to have been nonfunctional due to the paint on the electrical contacts.

Corrective Actions: The licensee removed the paint, and the diesel fire pump was run successfully on the same day, November 10, 2023. The licensee determined that this was a maintenance rule functional failure of a risk-significant function and initiated a 10 CFR 50.65 (a)(1) evaluation.

Corrective Action References: CR1243507 and CR1243523

Performance Assessment:

Performance Deficiency: The failure to perform painting activities in accordance with WO53203357455 and specification MP-SPEC-ENG-SP-CE-245 was a performance deficiency.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Protection Against External Factors attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the inspectors determined that this issue was similar to example 2.e in IMC 0612, Examples of Minor Issues, Appendix E, because the diesel driven fire pump was not able to perform its function if called upon.

Significance: The inspectors assessed the significance of the finding using IMC 0609, Appendix F, Fire Protection Significance Determination Process. The inspectors determined that the safety significance of the finding was very low (Green) because the answer to question 1.4.3-A of IMC 0609, Appendix F, was answered Yes. Specifically, the inspectors determined that adequate fire water capacity (flow at required pressure) remained available for protection of equipment important to safe shutdown in the most limiting location on site.

Cross-Cutting Aspect: H.1 - Resources: Leaders ensure that personnel, equipment, procedures, and other resources are available and adequate to support nuclear safety.

Specifically, the work instructions provided to the painters did not provide adequate guidance for painting in the diesel fire pump room. Specifically, the procedures did not provide clear direction about what to paint and what not to paint.

Enforcement:

Violation: License Condition 2.C(3), Fire Protection, to Facility Operating License DPR-65 (Unit 2), requires the licensee to implement and maintain in effect all provisions of the approved fire protection program as described in the final safety analysis report and as approved in the Safety Evaluation Report dated September 19, 1978, and supplements dated October 21,1980, November 11, 1981, October 31, 1985, April 15, 1986, January 15, 1987, April 29, 1988, July 17, 1990, and November 3, 1995.

The Millstone Power Station Unit 2 Safety Analysis Report - Fire Protection Evaluation Report, Section 3.1, Fire Protection Program, states that, A fire protection program has been established at the Millstone 2 nuclear power plant. This program establishes the fire protection policy for the protection of SSCs important to the safety of the plant and the procedures, equipment, and personnel required to implement the program.

License Condition 2.H, Fire Protection, to Facility Operating License NPF-49 (Unit 3),requires the licensee to implement and maintain in effect all provisions of the approved fire protection program as described in the final safety analysis report for the facility and as approved in the Safety Evaluation Report (NUREG-1031) issued July 1985 and Supplements Nos. 2, 4, and 5 issued September 1985, November 1985, and January 1986, respectively...

The Millstone Power Station Unit 3 Safety Analysis Report, states, in part, that the A fire protection program has been established at Millstone Unit 3. This program establishes the fire protection policy for the protection of SSCs important to the safety of the plant and the procedures, equipment, and personnel required to implement the program.

Dominion Procedure MP-PROC-000-CM-AA-FPA-100, Fire Protection/Appendix R (Fire Safe Shutdown) Program, Revision 20, establishes and implements the Fire Protection/

Appendix R (Fire Safe Shutdown) Program at Dominion Energy nuclear sites, including Millstone Power Station Units 2 and 3. Attachment 1, Millstone Power Station Program Requirements, Section 3.9.1, states that Fire protection systems shall remain functional at all times except for maintenance testing or other evaluated reason.

Contrary to the above, from October 14 to November 10, 2023, the licensee failed to implement and maintain in effect all provisions of the approved fire protection program.

Specifically, the licensee was unable to start the diesel driven fire pump due to paint covering the starter relays, which rendered the fire suppression water system nonfunctional for 27 days.

Enforcement Action: This violation is being treated as an NCV, consistent with Section 2.3.2 of the Enforcement Policy.

Turbine-Driven Pump Auxiliary Feedwater Control Valve Spuriously Cycled with No Demand Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000423/2023004-02 Open/Closed

[P.3] -

Resolution 71152A The inspectors identified a finding of very low safety significance (Green) and associated NCV of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, when the licensee failed to promptly identify and correct a condition adverse to quality associated with the Unit 3 TDAFW control valve (3FWA*HV36A). Specifically, the licensee failed to promptly identify and correct a degraded controller/positioner circuit card, which rendered the TDAFW pump inoperable for longer than its technical specification allowed outage time.

Description:

On September 4, 2023, at 2:03 a.m., with Millstone Power Station Unit 3 in Mode 1 at 100 percent reactor power, the Unit 3 TDAFW pump control valve, 3FWA*HV36A, cycled closed with no demand signal to close. The valve indicated dual position, then closed, then reopened. Coincident with this, the control room operators received the associated bypass annunciator alarm. This event was promptly entered into the corrective action program as CR1236949.

This normally open solenoid operated valve must remain open to provide a flow path and throttle flow from the discharge of the TDAFW pump to the 'A' steam generator. This valve is manually controlled from the control room or auxiliary shutdown panel. This function is required to ensure that the TDAFW pump can provide sufficient flow to the steam generators to minimize temperature increases in the reactor coolant system and minimize subsequent releases of primary coolant from the pressurizer relief valves. This valve fails open on loss of electrical power. This valve must also close to isolate a faulted steam generator following a main steam line break or steam generator tube rupture to preserve demineralized water storage tank inventory and ensure it is available for the intact steam generators. This function ensures that reactor coolant system temperature increases are minimized. This valve is considered a containment isolation valve and must close to isolate containment from the auxiliary feedwater system.

TS 3.7.1.2, Auxiliary Feedwater System, requires that while the plant is in Modes 1, 2, and 3, at least three independent steam generator auxiliary feedwater pumps and associated flow paths shall be operable. TS 3.7.1.2, Action c, requires if one auxiliary feedwater pump is inoperable in operating Modes 1, 2, and 3, it must be returned to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />; or the plant must be placed in at least hot standby within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in hot shutdown within the following 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. Additionally, 3FWA*HV36A is required to be able to close for containment isolation per TS 3.6.3. For Modes 1, 2, 3, and 4, with one or more of the isolation valve(s) inoperable, the required actions are to maintain at least one isolation barrier OPERABLE in the affected penetration(s) and restore the inoperable valve(s) to OPERABLE status within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, or isolate the affected penetration(s) within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> by use of deactivated automatic valve(s) secured in the isolation position(s), or isolate the affected penetration(s) within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> by use of closed manual valve(s) or blind flange(s); or isolate the affected penetration that has only one containment isolation valve and a closed system within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> by use of at least one closed and deactivated automatic valve, closed manual valve, or blind flange; or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

When the valve spuriously closed, the licensee declared the TDAFW pump inoperable and entered TS 3.7.1.2, because the TDAFW pump could not reliably supply water to the 'A' steam generator (i.e., the TDAFW flow path was not operable). In accordance with step 3.1.5 of the licensees operability determination procedure, OP-AA-102, Operability Determination, the presumption of operability for the TDAFW pump was lost.

The licensee performed troubleshooting in accordance with MA-AA-103, Conduct of Troubleshooting. The licensee identified six circuit cards that could potentially cause the valve to go closed, but troubleshooting did not clearly identify the cause of the deficient condition. The licensee documented all troubleshooting activities in ETE-MP-2023-2003, Unit 3 3FWA*HV36A closed and then opened without operator action, and completed a deficient condition assessment as required by procedure OP-AA-102. The licensee also applied its operational decision making process, as described by procedure OP-AA-101, Operational Decision Making, to 1) inform operators of possible actions to control 3FWA*HV36A if it fails open or closed, 2) inform operators of indications to observe if the problem recurs, 3) establish station actions for preparedness in case of failure recurrence, and 4) establish actions to prepare for investigative or corrective maintenance during the upcoming refueling outage. Based on this, the licensee exited TS 3.7.1.2 on September 6, 2023, at 12:52 p.m. The licensee created CR1237072 to document its troubleshooting efforts and track future troubleshooting activities associated with this valve.

On October 1, 2023, at 10:22 a.m., with Unit 3 in Mode 1 at 100 percent reactor power, 3FWA*HV36A again spuriously closed and reopened to a mid-position without any operator action. The demand from the controller was for 100 percent open throughout the event. Once again, the licensee promptly declared the TDAFW pump not operable and entered TS 3.7.1.2 and initiated CR1239451. The licensee recognized that this was the same deficient condition that occurred on September 4, 2023. After this failure, the licensee updated its failure mode /

cause table. While other circuit cards had not been refuted, the licensees troubleshooting team determined that the most likely cause was the 3FWA*HY36A4 relay logic card. They replaced the card, performed post-maintenance testing, and then declared the TDAFW pump operable at 1:20 a.m. on October 3, 2023. The inspectors noted that the licensee did not establish compensatory measures to address the possibility that the card replaced was not the cause of the spurious operation of the valve.

On October 5, 2023, at 3:52 p.m., with Unit 3 in Mode 1 at 100 percent reactor power, 3FWA*HV36A again spuriously closed and reopened to a mid-position without any operator action. Once again, the licensee promptly declared the TDAFW pump not operable and entered TS 3.7.1.2 and initiated CR1239874. The licensee recognized that this was the same deficient condition that occurred on September 4 and October 1, 2023. Troubleshooting was initiated, and the voltage to current card, 3FWA*HY36A5, was replaced. A temporary engineering change was implemented to install instrumentation to monitor the control circuit for 3FWA*HV36A. An operability determination was developed and, as a compensatory action, fuses were removed to fail 3FWA*HV36A to its full-open position. If 3FWA*HV36A would need to be throttled for auxiliary feedwater flow control or closed for isolation of the 'A' steam generator, instructions were provided to reinstall the fuses to allow operators to control the valve as required by plant conditions. The licensee declared the valve operable with compensatory actions on October 8, 2023, at 1:03 p.m.

Further investigation and troubleshooting continued during the refueling outage in October 2023. The results obtained from the instrumentation installed per the temporary engineering change identified that the Target Rock controller/positioner card, 3FWA*HY36A6, was the component that had caused the intermittent failures. This card was one of the six cards that the licensee had identified as a possible cause of the issue after the September 4, 2023, failure; but based on feedback from the vendor, the licensee did not believe this card was a likely cause.

The licensee performed a past operability review and determined that the reoccurring intermittent failure provided evidence that the valve may not have been reliable when needed to perform its safety function. 3FWA*HV36A is required to support operability of the TDAFW pump to provide water to the 'A' steam generator. The failure to identify and correct the degraded HY36A6 card resulted in the TDAFW pump being inoperable for longer than the 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed outage time for TS 3.7.1.2 and TS 3.6.3. The licensee submitted Licensee Event Report 05000423/2023-002-00, Auxiliary Feedwater Control Valve Failure Resulting in a Condition Prohibited by Technical Specifications, on November 30, 2023.

Corrective Actions: Each time valve 3FWA*HV36A spuriously closed, the licensee entered the applicable technical specification and entered the issue into the corrective action program. The licensee performed troubleshooting to provide reasonable assurance of operability the first time, performed maintenance the second time, and developed an operability determination with compensatory actions the third time. On October 29, 2023, the licensee identified and replaced the faulty Target Rock controller/positioner card under WO53203258458.

Corrective Action References: CR1236949, CR1237072, CR1239451, CR1239874, CR1241127, CR1241666,

Performance Assessment:

Performance Deficiency: The licensee failed to promptly identify and correct a condition adverse to quality in accordance with its corrective action program procedure PI-AA-200, Corrective Action, or establish compensatory measures in accordance with OP-AA-102, Operability Determination, which resulted in continued inoperability of the TDAFW pump.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, this issue was like example 4.f in IMC 0612, Appendix E, because the failure to identify and correct the degraded controller/positioner card or establish compensatory actions to ensure the valve could perform its open and close safety function, led to continued inoperability of the TDAFW pump.

Significance: The inspectors assessed the significance of the finding using IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power. Based on Appendix A, Exhibit 2, question 3, a detailed risk evaluation was performed by a senior resident analyst (SRA) because the degraded condition, spurious cycling of 3FWA*HV36A, represented a loss of the probabilistic risk assessment function of one train of a multi-train technical specification system for greater than its technical specification allowed outage time.

The SRA used Systems Analysis Program for Hands-On Integrated Reliability Evaluations (SAPHIRE), Version 8.2.9, and Millstone Unit 3 Standardized Plant Analysis Risk (SPAR)

Model, Version 8.82, to evaluate the risk significance of a degraded isolation path from the TDAFW to the 'A' steam generator via 3FWA*HV36A. The SRA considered the auxiliary feed to the 'A' steam generator and its isolation function contributions to the total estimated risk assessment. The SRA bounded the exposure period to be from September 4, 2023, when the condition self-revealed, until October 19, 2023 (45 days), when the unit was shut down for a planned outage and the assessed safety functions were no longer applicable.

For the auxiliary feed function, the SRA used a surrogate basic event (AFW-CKC-CC-F043)and set to TRUE to represent the loss of auxiliary feed function to the 'A' steam generator from the TDAFW pump. The increase in core damage probability (CDP) is estimated at 7E-9/year for this degraded function. For the steam generator isolation function, the SRA assumed 3FWA*HV36A would not function, and isolation would rely upon operator action (i.e., established compensatory measures or via closing in-series valve 3FWA*HV32A). The operators would need to diagnosis symptoms of a failed isolation and take action to perform an alternate isolation. The SRA adjusted two basic events related to main steam and faulted steam generator isolation (MSS-XHE-XM-MSISOL and MSS-XHE-XM-SGISO) after a base case was estimated using a SPAR-H action-only human error probability calculated value of 2E-3. Two condition cases (nominal and high stress) were assessed where diagnosis considerations were also included. This used a human error probability value of 1.2E-2 and 2.4E-2, respectively, and resulted in an estimated CDP range of 2.6E-7 to 5.4E-7 per year for the isolation function. The total estimated CDP is the sum of the two and is in the range of 3.3E-8/year, ((7E-9/year + 2.6E-7/year) x 45 days/365 days per year), to 6.7E-8/year,

((7E-9/year + 5.4E-7/year) x 45 days/365 days per year). The overall dominant core damage sequence is a small break loss-of-coolant event and operator failure to establish high/low-pressure recirculation cooling. This estimate is below CDP 1E-7/year and hence not evaluated for large early release frequency or contributions from external events. The total increase in CDP associated with this performance deficiency is estimated less the 1E-6/year; therefore, this finding is characterized as an issue of very low safety significance (Green).

Cross-Cutting Aspect: P.3 - Resolution: The organization takes effective corrective actions to address issues in a timely manner commensurate with their safety significance. Specifically, the corrective actions taken after the valve spuriously closing on September 4 and October 1, 2023, were not effective to address the degraded positioner card in a timely manner.

Enforcement:

Violation: 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective equipment, and non-conformances are promptly identified and corrected.

Contrary to the above, from September 4 to October 8, 2023, the licensee failed to identify and correct a condition adverse to quality associated with the steam TDAFW pump flow path to the 'A' steam generator. Specifically, the licensee failed to promptly identify and correct a degraded controller/positioner circuit card which rendered the TDAFW pump inoperable for longer than its technical specification allowed outage time.

Enforcement Action: This violation is being treated as an NCV, consistent with Section 2.3.2 of the Enforcement Policy.

Failure to Maintain Design Control of the 3B Emergency Diesel Generator Overspeed Trip Setpoints Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000423/2023004-03 Open/Closed

[P.2] -

Evaluation 71152A The inspectors identified a finding of very low safety significance (Green) and associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, when the licensee failed to apply design control measures to a change in the Unit 3 'B' EDG overspeed trip setpoint.

Specifically, after replacing the governor on the 3B EDG in May 2022, the licensee accepted an overspeed trip setpoint of 561.3 rpm, which was less than the 565 rpm setpoint established by licensee procedures and vendor recommendations, without evaluating the change against established design and qualification testing requirements. With the lower overspeed trip setpoint, the EDG did not maintain adequate margin to ensure it would not inadvertently trip on overspeed during a full short-term load rejection event.

Description:

During a review of past overspeed trip test data for the 'B' EDG, the inspectors noted that the most recent overspeed trip test of the 'B' EDG, May 7, 2022, recorded an overspeed setpoint of 561.3 rpm, which was less than the minimum procedure and vendor requirement of 565 rpm. This deficient condition was documented in CR1198827, which was closed to a log entry that justified a lower setpoint because it was less than the Regulatory Guide 1.9 and Institute of Electrical and Electronics Engineers (IEEE) Std 387-1977 limit of 115 percent of nominal operating speed, or 591 rpm. The condition report failed to evaluate the possibility that the 'B' EDG reliability could be challenged with this lower setpoint (less than 565 rpm) and known possibility that the overspeed trip mechanism spring can relax over time. The plant impact statement of the condition report stated the overspeed trip serves as a safety function to prevent damage from high RPM. The licensee acceptance of a lower setpoint that did not meet its procedural requirements or the vendor guidelines, increased the likelihood of an inadvertent trip on overspeed after full short-term or partial load rejection. The inspectors noted that accepting a lower over speed trip setting, 561.3 versus 565, reduced the available margin and could invalidate the previously performed load reject qualification testing that was performed in accordance with Regulatory Guide 1.9 and IEEE Std 387-1977.

In accordance with the vendor technical manual (25212-241-001, Installation, Operation, and Maintenance of Emergency Diesel Engine) and Fairbanks Morse Owners Group maintenance recommendations, the licensee performs overspeed trip testing of each diesel every 4 years. The overspeed trip test is performed in accordance with mechanical SP 3712N, Emergency Diesel Generator Overspeed Trip Test, Revision 7, which states that Regulatory Guide 1.9 stipulates diesel generator units used in nuclear standby applications be protected from damage due to excessive overspeed conditions. EDGs have an overspeed trip device setting of between 110 to 112 percent (565 to 576 rpm) of nominal speed (514 rpm), as recommended by the manufacturer.

Section 8.2.3 of SP 712N lists the vendor technical manual as the only applicable technical manual and instruction book.

Section 8.3.1.1.3, Emergency AC Power Source, of the Millstone Unit 3 Updated Final Safety Analysis Report, states, in part, that Each emergency generator is an on-site, independent, automatically starting power source which has the capacity, capability, and reliability to provide on-site power for safe shutdown of the unit after loss of off-site power and meet the requirements of Regulatory Guide 1.9 and IEEE 387.

The inspectors noted that Section 5.6.1, Mechanical and Electrical Design Features, of IEEE 387-1977, IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations, states that moving parts shall be designed to withstand, without damage, that level of overspeed that is caused by the following: 1) full short-time load rejection, plus 2) margin to allow the overspeed device to be set sufficiently high to guarantee that the unit will not trip on full short-time load rejection.

Moreover, Section 6.3.1, load capability qualification, states, in part, that the continuous rating load rejection test shall be performed. The load rejection test will be acceptable if the increase in speed of the diesel does not exceed 75 percent of the difference between nominal speed and the overspeed trip setpoint, or 15 percent above nominal, whichever is lower.

Using the guidance above, with a 565 rpm overspeed trip setpoint, the IEEE qualification test would be acceptable if the increase in engine speed did not exceed 552 rpm. Using a 561 rpm overspeed trip setpoint, the test would be acceptable if the engine speed did not exceed 549 rpm. The 3 'B' EDG typically achieves a speed of 552 rpm during full load rejection testing; therefore, with an overspeed trip setpoint of 561 rpm, the EDG did not maintain an acceptable margin to guarantee that the diesel would not trip during a full short-term load rejection event.

The inspectors raised this concern to the licensee November 14, 2023. Based on the inspectors questions, the licensee added a work order to its planned maintenance outage to inspect the 'B' EDG overspeed trip mechanism. On November 19, 2023, during removal of the 'B' EDG overspeed trip mechanism, the as found configuration was not in accordance with the vendor technical manual. The licensee discovered that the shim was incorrectly located under the head of the plunger. Adjustments were made, and the final as-left overspeed trip setpoint was determined to be 578.8 rpm, which exceeded the vendor recommended limit of 576 rpm. The licensee accepted this value based on an engineering technical evaluation (ETE-MP-2023-2035), which stated that there were no licensing barriers to setting the overspeed trip setpoint high outside the vendor recommended band and below the maximum speed of 591 rpm.

Corrective Actions: The licensee adjusted the 'B' EDG overspeed trip mechanism and performed post-maintenance testing to ensure the EDG would not inadvertently trip during a fast start or full load rejection event.

Corrective Action References: CR1198827, CR1244311, CR1244549, CR1244594

Performance Assessment:

Performance Deficiency: The licensees failure to evaluate the lower overspeed trip setpoint, which reduced the available margin to meet the IEEE 387-1977 design requirements, represented a failure to apply design control measures commensurate with those applied to the original design of the EDG, which was contrary to 10 CFR Part 50, Appendix B, Criterion III, Design Control.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Design Control attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, regardless of the final operability of the EDG, the as-left trip setpoint reduced assurance in the EDGs ability to not trip after a complete loss of load, which is a principal design feature described in IEEE Std 387-1977. The inspectors also noted that this issue was like example 2.d of IMC 0612, Appendix E.

Significance: The inspectors assessed the significance of the finding using IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power. The finding was a deficiency affecting the design or qualification of a mitigating SSC, but the SSC maintained its probabilistic risk assessment functionality; therefore, the issue screened as Green.

Cross-Cutting Aspect: P.2 - Evaluation: The organization thoroughly evaluates issues to ensure that resolutions address causes and extent of conditions commensurate with their safety significance. Specifically, the licensee failed to thoroughly evaluate the possibility of an inadvertent overspeed trip of the 3 'B' EDG after the overspeed trip test performed on May 7, 2022, did not meet established acceptance criteria.

Enforcement:

Violation: 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that design changes, including field changes, shall be subject to design control measures commensurate with those applied to the original design and be approved by the organization that performed the original design unless the applicant designates another responsible organization.

Contrary to the above, from May 7, 2022, to November 24, 2023, the licensee failed to apply design control measures to a change in the 3 'B' EDG overspeed trip setpoint. Specifically, the EDG overspeed trip setpoint of 565 rpm was changed to 561.3 rpm and the licensee did not evaluate whether this change invalidated the original design and qualification of the EDG to demonstrate proper operation during diesel generator load shedding, including a loss of the largest single load and complete loss of load event as required by the EDG design basis.

Enforcement Action: This violation is being treated as an NCV, consistent with Section 2.3.2 of the Enforcement Policy.

Failure to Identify and Correct a Degraded Overspeed Trip Mechanism on the 3A Emergency Diesel Generator Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000423/2023004-04 Open/Closed

[P.2] -

Evaluation 71152A A finding of very low safety significance (Green) and associated NCV of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, was self-revealed on November 9, 2023, when the Unit 3 'A' EDG automatically tripped on overspeed during a fast start surveillance test because the licensee had failed to identify and correct a degraded overspeed trip mechanism after a previous overspeed trip on July 13, 2022

Description:

On November 9, 2023, the Unit 3 'A' EDG tripped on overspeed during a fast start surveillance test. During troubleshooting activities, the licensee discovered that the overspeed trip setpoint was 560 to 562 rotations per minute (rpm), which was less than the specified range of 565 to 576 rpm. The licensee consulted with the vendor who recommended that the overspeed trip mechanism be inspected to determine if the spring had relaxed over time and remove or install overspeed trip shims as required to bring the setpoint into the specified range. The licensee disassembled the overspeed trip mechanism and adjusted the shims to restore the overspeed trip setpoint to 565 to 576 rpm.

Section 8.3.1.1.3, Emergency AC Power Source, of the Millstone Unit 3 Updated Final Safety Analysis Report states, in part, that Each emergency generator is an on-site, independent, automatically starting power source which has the capacity, capability, and reliability to provide on-site power for safe shutdown of the unit after loss of off-site power and meet the requirements of Regulatory Guide 1.9, Selection, Design, and Qualification of Diesel Generator Units Used as Standby (Onsite) Electrical Power Systems at Nuclear Power Plants, and Institute of Electrical and Electronics Engineers (IEEE) 387.

The inspectors noted that Section 5.6.1, Mechanical and Electrical Design Features, of IEEE 387-1977, IEEE Standard Criteria for Diesel Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations, states that moving parts shall be designed to withstand, without damage, that level of overspeed that is caused by the following: 1) full short-time load rejection, plus 2) margin to allow the overspeed device to be set sufficiently high to guarantee that the unit will not trip on full short-time load rejection.

In accordance with the vendor technical manual 25212-241-001, Installation, Operation, and Maintenance of Emergency Diesel Engine, and Fairbanks Morse Owners Group maintenance recommendations, the licensee performs overspeed trip testing of each diesel generator every 4 years. The overspeed trip test is performed in accordance with mechanical SP 3712N, Emergency Diesel Generator Overspeed Trip Test, Revision 7, which states that Regulatory Guide 1.9 stipulates diesel generator units used in nuclear standby applications be protected from damage due to excessive overspeed conditions. EDGs have an overspeed trip device setting of between 110 to 112 percent (565 to 576 rpm) of nominal speed (514 rpm), as recommended by the manufacturer. Section 8.2.3 of SP 3712N lists the vendor technical manual as the only applicable technical manual and instruction book.

The inspectors noted that the detailed guidance section of the Pielstick Engine Maintenance Guidelines, Item 53, Dynamic test check overspeed trip setting and verify proper operation of mechanical emergency stop, states, in part, that Fairbanks Morse recommends the overspeed trip be set to trip when the engine speed exceeds 10 percent to 12 percent (565 rpm to 576 rpm) over [the] rated speed. Moreover, the guidelines state, If the trip settings are not within prescribed settings, remove or install overspeed trip shims as required and retest. The guidelines also say that experience has shown that the overspeed trip mechanism counterweight spring relaxes which results in a trip at a lower speed. The vendor technical manual states that if overspeed trips at speed under 110 percent (565 rpm), add additional shims to raise overspeed setting within above limits, and if overspeed trips at speed over 112 percent (576 rpm) with no shims installed, it will be necessary to grind off face of nut.

With respect to past performance of the 'A' EDG, the inspectors noted that prior to the overspeed trip on November 9, 2023, the most recent overspeed trip test was performed on September 2, 2021, and the trip setpoint was 568 rpm. However, the inspectors also noted that the 'A' EDG tripped on overspeed during a hot restart surveillance on July 13, 2022. The licensees level of effort cause evaluation for the July 13, 2022, event identified that the EDG tripped at a speed of 553 rpm, and a potential cause of the overspeed trip could be an issue with the overspeed trip mechanism including degradation of the spring or missing/degraded shims. The licensee refuted these possible causes based on review of past overspeed trip testing data but did not perform an inspection of the overspeed trip components as stipulated by the vendor recommended maintenance guidelines. The inspectors determined that this was a missed opportunity to identify a degraded overspeed trip mechanism and the likely cause of the overspeed trip event on July 13, 2022.

The failure to identify that the overspeed setpoint had drifted, during investigation of the July 13, 2022, event resulted in a subsequent overspeed trip on November 9, 2023.

Corrective Actions: The licensee adjusted the 'A' EDG overspeed trip mechanism and performed post-maintenance testing to ensure the EDG would not inadvertently trip during a fast start or full load rejection event.

Corrective Action References: CR1203517, CR1243459, CR1243545, CR1243621

Performance Assessment:

Performance Deficiency: The licensees failure to inspect the overspeed trip mechanism as prescribed by the vendor technical manual and Fairbanks Morse Owners' Group maintenance guidelines after the 'A' EDG tripped at 553 rpm on July 13, 2022, was a performance deficiency.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors determined that this finding was like example 2.d in IMC 0612, Appendix E, because the 'A' EDG overspeed trip settings did not meet licensee and vendor requirements and increased the likelihood of an inadvertent overspeed trip, which reduced the reliability of the EDG.

Significance: The inspectors assessed the significance of the finding using IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power. Based on Appendix A, Exhibit 2, question 3, a detailed risk evaluation was performed by a SRA because the degraded overspeed trip mechanism resulted in two overspeed trips of the 'A' EDG, which represented a potential loss of the probabilistic risk assessment function of one train of a multi-train technical specification system for greater than its technical specification allowed outage time. Though the 'A' EDG did successfully pass full load rejection tests on October 23, 2023, and May 14, 2022, the SRA performed a bounding risk estimate to assess the risk of increased overspeed trips.

The SRA used Systems Analysis Program for Hands-On Integrated Reliability Evaluations (SAPHIRE), Version 8.2.9, and Millstone Unit 3 Standardized Plant Analysis Risk (SPAR)

Model, Version 8.82, to evaluate the risk significance of improper overspeed trip settings.

The SRA made the following bounding assumptions based on two unexpected overspeed trips in at least 16 starts (one start per month over 1 year, 4 months): 1) a mean probability increase of 10 percent for 'A' EDG failure to start based on a two-failure Bayes-Binomial update (8 percent increase rounded up to 10 percent), 2) Similarly, increased failure to load run and failure to run (FTR) probabilities for 'A' EDG by 10 percent as a surrogate for the overspeed trip potential, and 3) maximum 1-year exposure period. A sensitivity case was also evaluated with doubling the failure probability. The increase in CDP is estimated at 3E-8/year. The dominant core damage sequence is a small break loss-of-coolant event and operator failure to establish high/low-pressure recirculation cooling. Since this estimate, and its doubling, is below CDP 1E-7/year and hence is not evaluated for large early release frequency or contributions from external events. The increase in CDP associated with this performance deficiency is estimated less the 1E-6/year; therefore, this finding is characterized as an issue of very low safety significance (Green).

Cross-Cutting Aspect: P.2 - Evaluation: The organization thoroughly evaluates issues to ensure that resolutions address causes and extent of conditions commensurate with their safety significance. Specifically, the licensee failed to thoroughly investigate the overspeed trip setpoint after an overspeed trip on the 'A' EDG, which tripped at 553 rpm, below the 565 to 576 rpm setpoint.

Enforcement:

Violation: 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective equipment, and non-conformances are promptly identified and corrected.

Contrary to the above, from approximately July 13, 2022, to November 9, 2023, the licensee did not promptly identify and correct a condition adverse to quality. Specifically, it failed to identify that the Unit 3 'A' EDG overspeed trip setpoint had drifted below the required range, which resulted in reasonable doubt about the reliability of the EDG to perform its safety function.

Enforcement Action: This violation is being treated as an NCV, consistent with Section 2.3.2 of the Enforcement Policy.

Charging System Inoperable Due to Air Void Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000423/2023004-05 Open/Closed

[H.1] -

Resources 71152A The inspectors identified a Green finding and associated NCV of Millstone Unit 3 TS 6.8.1, Procedures and Programs, when the licensee failed to establish and implement an adequate procedure to vent and refill the ECCS piping following maintenance during the spring 2022 refueling outage. This resulted in the entrapment of an unacceptable volume of air that rendered one train of the ECCS inoperable for approximately 5 months.

Description:

The inspectors reviewed the licensees causal evaluations and corrective actions to address air voids identified via routine pipe ultrasonic testing (UT) of safety-related piping high points on October 6 and 14, 2022. The inspectors observed that this piping is used for ECCS operation during the containment sump recirculation phase of a postulated accident. The system lineup involves the recirculation pump taking suction from the containment sump to supply water to the inlet of two in parallel charging pumps through the piping identified with an air void. The charging pumps then discharge water via piping to the reactor vessel.

The inspectors determined that during the spring 2022 Millstone Unit 3 refueling outage, the

'A' charging system was partially drained for maintenance. On April 27, 2022, following maintenance, the licensee implemented their procedure OP 3250.04A, Charging System Fill and Vent, Section 4.4, to fill and vent the charging system lines. The inspectors ascertained that prior to the refueling outage, the licensee specified this procedure to refill the system based on the planned maintenance scope. Unit 3 entered Mode 2 requiring ECCS systems to be operable on June 2, 2022, following the refueling outage.

On October 6, 2022, during monthly UT of piping high points, the licensee identified an air void adjacent to the high point vent in the pipe segment. Operators declared the system inoperable, vented the piping, and declared the system operable. The inspectors noted that additional UTs on the piping segment were not specified by the procedure following the venting. On October 14, 2022, air was again identified at the high point vent location.

Operators declared the system inoperable, vented the air, and performed additional troubleshooting which identified air voids in the 90-foot pipe segment. The licensee quantified the total air void, performed several vent and fill activities, ultrasonic tested the piping with acceptable results, and declared the system operable on October 15, 2022.

In evaluating the air void causes, the licensee concluded that their procedure OP 3250.04A did not contain adequate guidance to fill and vent the system. They concluded that a detailed venting plan, as described in OP 3250, Section 1.1, should have been created to fill the system in order to vent the air and fill this section of piping.

The inspectors noted that on October 6, 2022, the licensee initially calculated an air void of 1.551 cubic feet (ft3) assuming the void was present along the entire 90-foot pipe segment and declared the system inoperable. The licensee further performed UTs on each side of the high point location to the point where the pipe was full. The licensee considered this result and recalculated a void size of 0.028 ft3. The operators vented air and returned the system to service. The licensee concluded the system had remained operable notwithstanding the voids because this size void did not exceed the operability acceptance criteria of 0.245 ft3.

On October 14, 2022, the licensee performed additional UTs as a corrective action assignment for the void identified on October 6, 2022. The licensee identified a void in the crossover piping and declared the ECCS system inoperable. The licensee subsequently performed UTs along the entire 90-foot pipe segment and determined a 1.067 ft3 void was present. The licensee conducted activities to vent the void, reducing the as-left air void to 0.437 ft3. On October 17, 2022, they revised their void acceptance limit to 1.212 ft3 based on calculation 14-ENG-04518M3, MP3 GL-2008-01 Pump Suction Side Gas Void Allowable Volume Using Westinghouse Simplified Equation Method, Revision 0, and declared the system operable. Based on the revised operability limit, the licensee also concluded that the ECCS system had been operable with the 1.067 ft3 void found previously.

The inspectors assessed the licensees performance associated with the voids found on October 6 and 14, 2022. The inspectors independently reviewed the calculations credited to support the change (14-ENG-04528M3). The review found the methodology used determined the maximum void size allowed during normal operations to ensure the centrifugal charging pump would not become air bound and lose pumping capability during accident conditions.

The methodology was based on WCAP-17275-P which was accepted with conditions in an NRC safety evaluation (PWROG-15060-P-A). The inspectors reviewed the inputs and noted the acceptable void size found during surveillance tests is calculated, in part, based on system pressure at the location during UT. The inspectors identified the calculation input for this pipe section was based on pressure from the refueling water storage tank elevation; however, the inspectors noted the pipe section appeared to be pressurized by the volume control tank during normal operation. The inspectors questioned if the calculation was correct. The licensee reviewed the calculation and affirmed that the volume control tank pressure should be used. The licensee reperformed the calculation with a resulting lower void acceptance criteria of 0.833 ft3.

Based on the revised acceptance criteria, the inspectors concluded the 1.067 ft3 air void had caused the ECCS system to be inoperable from June 2 to October 14, 2022. The licensee reached a similar conclusion and submitted LER 05000423/2022-003-00, Gas Void in the Emergency Core Cooling System Resulted in a Condition Prohibited by Technical Specifications, to the NRC on October 28, 2023.

Subsequently, the inspectors also questioned whether the accident pressures in 14-ENG-04528M3 for the single pump and dual pump configuration were limiting (233.9 psia and 123.9 psia) for this location. The licensee reviewed the assumptions and determined there were more limiting suction pressures (67.6 psia and 58.5 psia). Following identification of this problem, the licensee again reperformed this calculation with a resulting void acceptance criteria of 0.291 ft3 for the particular location. The inspectors considered the charging pumps were additionally inoperable from October 14 to November 2, 2022, when the pipe was adequately filled. The inspectors addressed this additional performance deficiency in NCV 2023004-06, Incorrect Assumptions Used to Determine Void Operability Limits for Charging Suction Piping documented in this inspection report.

Corrective Actions: The licensee vented the piping system, enhanced their UT surveillance procedure to better quantify air voids if discovered, added guidance to their vent and fill procedure, and submitted a license event report.

Corrective Action References: CR1209700, CR1210351, CA11305186, CR1237228

Performance Assessment:

Performance Deficiency: The inspectors determined the failure to develop and implement a procedure to vent and fill the charging system piping following draining of the 'A' train piping to conduct maintenance activities was a performance deficiency.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Configuration Control attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, following draining of the 'A' charging system piping, the system was returned to service and declared operable with an unacceptable air void in the system piping.

Significance: The inspectors assessed the significance of the finding using IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power. Based on Appendix A, Exhibit 2, question 3, a detailed risk evaluation was performed by an SRA because the degraded condition, partial air voids in the cross-connect piping from the residual heat removal system to the charging pumps, represented a potential loss of the probabilistic risk assessment function of one or more trains of a multi-train technical specification system for greater than its technical specification allowed outage time.

The SRA used Systems Analysis Program for Hands-On Integrated Reliability Evaluations (SAPHIRE), Version 8.2.9, and the Millstone Unit 3 Standardized Plant Analysis Risk (SPAR) Model, Version 8.82, to evaluate the risk significance. The SRA reviewed Millstone 3 Updated Final Safety Analysis Report and probabilistic risk assessment system notebooks and noted the high-pressure recirculation (HPR) function is supported by both the charging system and safety injection pumps. One of four pumps is required for success for most events; however, two of four are required for large-break loss-of-coolant events. The primary events of interest for this finding involve loss-of-coolant events (particularly small and medium), including steam generator tube rupture, and steam line breaks where reactor pressure is high and the HPR function is influential. The charging system also has an installed spare/swing pump (P3C). Recovery of a charging pump malfunction was not explicitly considered in this risk assessment but was considered in the common cause failure (CCF) estimate.

The SRA reviewed the licensees calculation MP-CALC-ENG-14-04518M3, Revision 0, Addendums A and B (updated February 2024), that evaluated the impact of the non-conservative void volume calculation assessing the impact to the charging pumps from the identified void in the crossover piping. Using a simplified equation method for gas transport (WCAP-17276-NP, Investigation of Simplified Equation for Gas Transport, Revision 1), the licensee concluded that under worse case conditions charging pumps would be considered inoperable, based on exceeding the revised allowable void limit. The licensee conservatively made this conclusion based on the requirements of the methodology, though it is recognized that a more realistic assumption would be a split of the void between the two charging pumps.

The SRA determined that based on initiating events that credit HPR, crew response, and pump line-up, there are various pump flow and void conditions that could exist once the HPR cross-connect valve (3SIL8804A) is opened. The SRA recognized that the established void limit during surveillance testing was based on maximum volume control tank band pressure (55 PSIA) and represents a minimum allowable air volume before pump degradation is expected to occur. An average volume control tank control band pressure (42.5 PSIA) would have a higher void limit result. The SRA further reviewed operating experience documents and analyses related to the impact of gas on pump performance documented in NUREG/

CR 2792, An Assessment of Residual Heat Removal and Containment Spray Pump Performance Under Air and Debris Ingesting Conditions, and Generic Safety Issue (GSI) - 193, BWR ECCS Suction Concerns. From this review a general accepted conclusion is that air ingestion levels below 2 percent void fraction, pump degradation is not a concern for flows near rated conditions; for ingestion levels between 2 percent and 15 percent, performance is dependent on pump design; and for ingestion levels greater than about 15 percent, most pumps are fully degraded (i.e., failed). Based on this and scaling the plant -specific and as -found void information for comparison, the SRA estimated a bounding failure probability of the charging pump(s) using a representative function assuming nominal failure probability at the acceptance limit with increased FTR as a fraction of increased air void volume. This qualitative, yet technically informed approach, bounds the failure characteristics documented in NUREG/CR-2792 and represents similar failure probability estimations previously documented in NRC GSI-193 studies.

The SRA assessed four possible cases: 1) single pump flow configuration where one pump is exposed to the void, 2) dual pump flow configuration where both pumps are exposed to the void, but ingested by one pump (consistent with simplistic void methodology assumption),3) dual pump flow configuration where both pumps are exposed, but the void is split 50/50 to each pump (this is considered a best-estimate case), 4) a single pump flow configuration where one pump is considered failed (a sensitivity case and considered bounding since based on a review of the licensees calculation, the location and size of the void, it is the inspectors and SRAs assessment that neither charging pump would conclusively fail). The following represent the results of the four cases:

• Case 1 (single pump): The SRA set 'A' charging system pump FTR basic event (CVC-MDP-FR-P3A) to 0.53 and 'B' charging system pump FTR to 1E-3. The CCF basic event for the charging pumps (CVC-MDP-CF-FR) set to 1E-5 to account for the increased CCF probability for these FTR inputs. This resulted in a mean increase in CDP of 6.0E-8 per year (i.e., delta core damage frequency (CDF/year) converted to an annualized CDP).

• Case 2 (dual pump): 'A' charging system pump FTR basic event set to 0.50 and 'B' charging system pump FTR basic event set to 1E-2; CCF basic event set to 8.88E-5.

This resulted in a mean increase in CDP of 1.0E-7 per year.

• Case 3 (dual pump - best estimate) 'A' and 'B' charging system pump FTR basic event set to 0.1 and CCF set to 8.76E-4. This resulted in a mean increase in CDP of 1.4E-7 per year.

• Case 4 (single pump failed - sensitivity / bounding) 'A' charging system pump FTR basic event set to TRUE and 'B' charging system pump FTR basic event set to 1E-2; CCF automatically set to 2.42E-2. This resulted in a mean increase in CDP of 3.6E-7 per year.

The bounding exposure time was determined to be from May 18, 2022, when the unit entered Mode 3 until October 17, 2022, when all actions to remove voids were completed and the system was declared operable; however, additional void remediation actions continued until approximately November 2, 2022 (168 days). A minimal exposure time can be considered when the unit entered Mode 2 and began power ascension on June 2 until October 6, 2022, when initial identification and actions to remove voids began (126 days).

The estimated risk increase range for the exposure (average 147 days / bounding 168 days):

• Case 1 CDP (6.0E-8/year) * (147 days / 365 days per year) = 2.4E-8/year

• Case 2 CDP (1.0E-7/year) * (147 days / 365 days per year) = 4.0E-8/year

• Case 3 CDP (1.4E-7/year) * (147 days / 365 days per year) = 5.6E-8/year

• Case 4 CDP (3.6E-7/year) * (168 days / 365 days per year) = 1.7E-7/year

The overall dominant core damage sequence is a small/medium-break loss-of-coolant event and operator failure to establish high/low-pressure recirculation cooling. This overall estimate is below CDP 1E-7/year and hence not evaluated for contributions from external events. A SAPHIRE LERF estimation was below 1E-7/year. The total increase in CDP associated with this performance deficiency is estimated less the 1E-6/year; therefore, this finding is characterized as an issue of very low safety significance (Green).

Cross-Cutting Aspect: H.1 - Resources: Leaders ensure that personnel, equipment, procedures, and other resources are available and adequate to support nuclear safety.

Specifically, during the spring 2022 refueling outage, the licensee did not adequately review the adequacy of the procedure used to vent and fill the charging system. As a result, the restoration procedure used to fill and vent the 'A' charging system piping, identified prior to the outage, was not adequate resulting in the system not being properly refilled prior to declaring it operable.

Enforcement:

TS 6.8.1, Procedures and Programs, Appendix A, states, in part, written procedures shall be established, implemented, and maintained covering the activities referenced below. Part (a)listed below describes the applicable procedures recommended in Appendix A of Regulatory Guide 1.33, Revision 2, February 1978. Regulatory Guide 1.33 states activities for energizing, filling, venting, draining, startup, shutdown, and changing modes of operation should be prepared, as appropriate, for the ECCS.

Additionally, TS 3.5.2 states, in part, two independent ECCS subsystems shall be OPERABLE with each subsystem comprised of: a. One OPERABLE centrifugal charging pump.

Contrary to the above requirements, on April 27, 2022, following draining of the 'A' charging system, the licensee did not establish and implement a written procedure to fill the charging system prior to declaring it operable. As a result, the two centrifugal charging pumps were inoperable due to an air void in the suction crossover piping from June 2, 2022, until it was sufficiently filled on November 2, 2022.

The disposition of this violation closes LER 05000423/2022-003-00, Gas Void in the Emergency Core Cooling System Resulted in a Condition Prohibited by Technical Specifications.

Enforcement Action: This violation is being treated as an NCV, consistent with Section 2.3.2 of the Enforcement Policy.

Incorrect Assumptions Used to Determine Void Operability Limits for Charging Suction Piping Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Green NCV 05000423/2023004-06 Open/Closed None (NPP)71152A The inspectors identified a Green finding and associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, when the licensee failed to assure that applicable regulatory requirements and the design basis, for structures, systems, and components were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the inspectors reviewed calculation14-ENG-04518M3, MP3 GL-2008-01, Pump Suction Side Gas Void Allowable Volume Using Westinghouse Simplified Equation Method, Revision 0, and determined that the limiting pressures (accident pump suction pressures and surveillance operating pressures) were not used to determine the acceptable void size for ECCS crossover piping. As a result, air void acceptance criteria in surveillance procedures and instructions did not ensure the charging system was operable with respect to air voids found in the piping.

Description:

The inspectors reviewed the licensees causal evaluations and corrective actions associated with an air void found by the licensee on October 6, 2022, in safety-related piping.

The inspectors noted that this pipe segment is used for ECCS operation during the containment sump recirculation phase of a postulated accident. This pipe segment provides a flow path from the recirculation pump discharge to the suction of both charging pumps. The charging pumps then discharge water via piping to the reactor vessel during HPR operation.

The inspectors noted that both charging pumps could be made inoperable by the air void in this section of piping.

The inspectors observed, following identification of an air void on October 6, 2022, that the licensee vented the air and returned the system to operable status. On October 14, 2022, the licensee identified additional air in the crossover piping and declared the ECCS system inoperable. The licensee quantified the air void as 1.067 ft3, which exceeded the acceptance criteria of 0.245 ft3 in SP 3610A.3, Residual Heat Removal System Vent and Valve Verification. The licensee vented the piping, but an air void of 0.437 ft3 remained in the pipe segment which exceeded the void acceptance criteria. The licensee reviewed Calculation 14-ENG-04518M3, MP3 GL-2008-01 Pump Suction Side Gas Void Allowable Volume Using Westinghouse Simplified Equation Method, Revision 0, and found this methodology determined the acceptable void size in this pipe segment to be 1.212 ft3. Based on the new acceptance criteria, the licensee declared the system operable. The licensee also re-evaluated the impact of the air present in the piping system and determined, based on the new acceptance criteria, that the ECCS system had been operable with the 1.067 ft3 void in the system.

The inspectors reviewed 14-ENG-04528M3 and found that that the methodology calculated the maximum void size during normal operations that would not cause a pump to become air bound during accident conditions. The methodology was based on WCAP-17275-P which was accepted by the NRC (PWROG-15060-P-A). The inspectors reviewed the inputs and noted the acceptable void size found during surveillance tests was calculated, in part based on system pressure at the location during UT.

The inspectors observed the calculation pressure input for this pipe section was based on pressure from the refueling water storage tank water elevation; however, the inspectors noted the pipe section appeared to be pressurized by the volume control tank during normal operation. The inspectors questioned if the calculation was correct. The licensee reviewed the calculation and affirmed that the volume control tank pressure should be used. The licensee reperformed the calculation with a resulting lower void acceptance criteria of 0.833 ft3. Based on the revised acceptance criteria, the licensee submitted LER 05000423/2022-003-00, Gas Void in the Emergency Core Cooling System Resulted in a Condition Prohibited by Technical Specifications, to the NRC on October 28, 2023.

The inspectors subsequently questioned if the accident pressures assumed at the suction of the pumps for the single pump and dual pump configuration were limiting (233.9 psia and 123.9 psia). The licensee reviewed the assumptions and determined there were more limiting suction pressures (67.6 psia and 58.5 psia).

Following identification of this deficiency, the licensee reperformed this calculation resulting in a void acceptance criterion of 0.291 ft3 for the location. As a result, the inspectors considered the ECCS charging pumps were inoperable following venting of the system on October 15, 2022, until UTs performed on November 2, 2022, showed the void had been reduced to below the revised void limits.

Corrective Actions: Following identification of the issue, the licensee entered the issue into the corrective action program and revised the calculation and surveillance procedure.

Corrective Action References: CR1249963, CR1250056, CR1209700, CR1210351, CA11305186, CR1237228

Performance Assessment:

Performance Deficiency: The licensees use of incorrect pressure to develop acceptance criteria for air voiding in ECCS systems was a performance deficiency.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Design Control attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, following identification of air in the 'A' charging system piping, the piping system was vented and declared operable with an unacceptable air void remaining in the system piping.

Significance: The detailed risk evaluation performed for NCV 2023004-05, Charging System Inoperable Due to Air Void, documented in this report, bounds the exposure time, and assesses relevant failure probabilities of the charging pump(s) for this performance deficiency. Therefore, this issue was determined to be Green.

Cross-Cutting Aspect: Not Present Performance. No cross-cutting aspect was assigned to this finding because the inspectors determined the finding did not reflect present licensee performance. Specifically, the incorrect pressure inputs in calculation 14-ENG-04518M3 were introduced when the calculation was approved in 2015.

Enforcement:

Violation: 10 CFR Part 50, Appendix B, Criterion III, Design Control states, in part, measures shall be established to assure that applicable regulatory requirements and the design basis, as defined in §50.2 and as specified in the license application, for those SSCs to which this appendix applies are correctly translated into specifications, drawings, procedures, and instructions.

Contrary to the above, on June 14, 2015, the licensee failed to assure that the design basis for the ECCS was correctly translated into specifications, drawings, procedures, and instructions. Specifically, a calculation to determine as found void acceptance criteria in ECCS piping for assessing the operability of ECCS equipment was based on incorrect operational and design basis pressure inputs. From October 15 to November 2, 2022, the licensee used the acceptance criteria developed in the calculation to incorrectly conclude the ECCS system was operable with air voids more than limits.

Enforcement Action: This violation is being treated as an NCV, consistent with Section 2.3.2 of the Enforcement Policy.

Observation: Unit 3 Supplementary Leak Collection and Release System Degraded Isolation Dampers 71152A The inspectors reviewed the licensees corrective actions that were performed following the Unit 3 SLCRS 'B' train not achieving the required drawdown on April 6, 2022, in accordance with TS 3.6.6.1, Supplementary Leak Collection and Release System. The licensee entered the issue into their corrective action program (CR1195831). The NRC inspectors documented a self-revealing finding of very low safety significance (Green) and an associated NCV of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, in Millstone Power Station, Units 2 and 3 - Integrated Inspection Report 05000336/2022003 and 05000423/2022003, Agencywide Documents Access and Management System Accession No. ML22318A030, NCV 05000423/2022003-01, Failure to Correct Degraded Isolation Dampers Associated with the Unit 3 Supplemental Leak Collection and Release System. The inspectors reviewed the licensee's corrective actions, which included: repairing the ventilation dampers that did not fully close, successfully reperforming the SLCRS drawdown surveillance test during the 2022 refueling outage, revising maintenance procedure MP 37204-600 to include a damper blade gap acceptance criteria, and increasing the frequency to cycle/lubricate/inspect the main steam valve building inlet dampers. In addition, the licensee continued the procurement process to replace degraded and obsolete dampers.

While reviewing the licensees performance to address the damper issues identified in April 2022, the inspectors noted a similar damper problem showed itself on October 19, 2023, when the SLCRS 'B' train did not achieve the required drawdown. The inspectors noted the redundant 'A' train passed the surveillance test. The licensee entered the issue into their corrective action program (CR1240948), performed troubleshooting, and determined the main steam valve building ventilation support damper (3HVV*MOD51C) did not fully close. Visual inspection showed the damper bearing support sheared at the lower bolt hole which permitted lateral shifting and prevented full damper blade rotation during cycling (CR1241612). In addition, during the MOD51C damper blade neoprene seal inspection, the licensee found the damper seized (CR1243504). As a result, the MOD51C damper was not fully closed during the surveillance tested and was determined to be the cause of not achieving the required drawdown. The licensees corrective actions included replacing the degraded bearing and bearing support, installing a thicker blade neoprene seal to improve the sealing capability, and performing a post-maintenance test that cycled the damper to verify satisfactory operation. Following the corrective actions, the surveillance test of the 'B' train of Unit 3 SLCRS was performed satisfactorily on November 23, 2023. Lastly, the licensee scheduled the MOD51C damper to be replaced during the next refueling outage (WO53203299037).

The inspectors reviewed the revised maintenance procedure and preventive maintenance work orders and determined the licensee completed their corrective actions from April 2022.

The inspectors concluded the recent October 2023 damper issue resulted from a different problem than previous issues and was not foreseeable. The inspectors also performed a walkdown of the MOD51C damper during troubleshooting, and determined the licensee appropriately repaired and restored the damper to service.

Observation: Emergency Core Cooling System Gas Void Evaluation and Corrective Actions 71152A The inspectors reviewed the licensees LEE CA11305186 related to air voids found in the ECCS crossover piping in October 2022. The inspectors considered whether the licensee identified the likely causes of air voids and completed actions to correct the condition.

The inspectors found that during the Millstone Unit 3 2022 spring refueling outage, the licensee drained portions of the residual heat removal and charging system piping to install a new valve. The procedure used to fill portions of the crossover piping (piping between recirculation pump discharge and charging pump suction piping) was not adequate resulting in air remaining in the pipe. Post-maintenance tests and subsequent monthly UT inspections during operation did not identify the air void until October 6, 2022. The licensee declared the system inoperable, vented the pipe, and declared the system operable the same day.

Subsequent UT measurements found an air void on October 14, 2020. The licensee quantified the entire 90-foot pipe segment and ascertained there was 1.067 ft3 of air. The licensee took action to vent the piping but could not remove an air void they sized to be 0.437 ft3. The system was determined to be operable and returned to service on October 15, 2020. Subsequent UT results, performed on November 2, 2022, found that the air void was 0.291 ft3.

The inspectors review of the LEE found that the licensee concluded the air moved into the ECCS piping high point following cycling of a valve in the piping system. Following the inspectors' questions, the licensee determined that valve operation had not occurred; and, therefore, this was not the cause of the air moving to the high point UT location.

Subsequently, the licensee concluded that the piping configuration prevented the entire air void from reaching the high point. The inspectors considered the LEE did not correctly ascertain the plant configuration but that this did not change the likely cause of the air intrusion being from inadequate venting post maintenance.

The inspectors noted that licensee evaluations completed in response to NRC Generic Letter 2008-01, Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems, identified this pipe segment as highly susceptible to air accumulation and recommended an additional vent valve be installed. Subsequently, the licensee identified air in the section of pipe in 2014 following an outage. The inspectors found that actions were not taken to address this vulnerability to enhance air void identification and removal capability in October 2022.

Following identification and quantification of the air void on October 14, 2022, licensee operators declared the system inoperable because the void exceeded the acceptance criteria of 0.245 ft3. The inspectors found the licensee subsequently revised the acceptance criteria based on a calculation completed in 2015. The calculated acceptable void volume for this location was taken to be 1.212 ft3 and the licensee concluded the system had been operable notwithstanding the air voids.

The inspectors found this increased acceptance criteria was applied without adequate review of the underlying calculation. The inspectors determined the calculation applied refueling water storage tank pressure to determine an acceptable void size at this pipe location when the volume control tank pressure was applicable. The licensee affirmed this and when the correct pressure was used and calculation reissued, the acceptance criteria for this location was reduced to 0.833 ft3. Subsequently, based on the inspectors questions related to the assumed accident suction pipe pressures and flows, the licensee recalculated the acceptable void size to be 0.291 ft3, very close to the original value. The inspectors questions highlighted the change to a new void acceptance size resulted in an unidentified system inoperability from June to November 2022. The inspectors concluded the licensee performance to evaluate the causes and acceptability of air voiding in this instance was insufficient to provide for effective corrective actions. The licensee made additional entries into their corrective action process as a result of NRC inspector reviews.

EXIT MEETINGS AND DEBRIEFS

The inspectors verified no proprietary information was retained or documented in this report.

• On October 31, 2023, the inspectors presented the occupational and public portions of the performance indicator verification inspection results to Lori Armstrong, Director of Nuclear Safety and Licensing, and other members of the licensee staff.

• On November 6, 2023, the inspectors presented the radiological hazard assessment and exposure controls inspection results to Michael OConnor, Site Vice President, and other members of the licensee staff.

• On November 6, 2023, the inspectors presented the radiological monitoring instrumentation inspection results to Michael OConnor, Site Vice President, and other members of the licensee staff.

• On November 6, 2023, the inspectors presented the radioactive waste preparation inspection results to Michael OConnor, Site Vice President, and other members of the licensee staff.

• On December 14, 2023, the inspectors presented the inservice outage activities inspection results to Michael OConnor, Site Vice President, and other members of the licensee staff.

• On December 21, 2023, the inspectors presented the degraded SLCRS dampers inspection results to Daniel Beachy, Licensing and NRC Coordinator Supervisor, and other members of the licensee staff.

• On January 25, 2024, the inspectors presented the integrated inspection results to Michael OConnor, Site Vice President, and other members of the licensee staff.

• On February 14, 2024, the inspectors presented the results of the ECCS gas void LER closure and problem identification and resolution inspection sample results to Lori Armstrong, Director of Nuclear Safety and Licensing, and other members of the licensee staff.

DOCUMENTS REVIEWED

Inspection

Procedure

Type

Designation

Description or Title

Revision or

Date

71111.04

Corrective Action

Documents

CR1239634

CR1242064

CR1242731

CR1243199

CR1243388

CR1243419

Drawings

2515-26904

P&ID Chemical and Volume Control, Sheet 1

Revision 58

2515-26904

P&ID Sheet Chemical and Volume Control 3

Revision 33

212-26911

P&ID Fuel Pool Cooling and Purification System

Revision 39

212-26913

P&ID High-Pressure Safety Injection, Sheet 1

Revision 58

Procedures

OP 3304A

Charging and Letdown

Revision 47

OP 3305

Spent Fuel Cooling and Purification

Revision 30

71111.05

Corrective Action

Documents

CR1243591

Procedures

PROC-ENG-U3-

24-FFS-BAP01-

RC

MP3 Fire Fighting Strategies

Revision 0

71111.08P Calculations

EDY-04643M3

Calculation of Effective Degradation Years (EDY) and

Re-Inspection Years (RIY) per ASME Code Case N-729-6

for Millstone Unit 3 Reactor Vessel Head Penetrations for

Cycle 24

Revision 0

Corrective Action

Documents

CR1121494

CR1121542

CR1241747

CR1241824

CR1242076

Miscellaneous

MP-24-CII-PRG

Containment Inservice Inspection Program

Revision 9

MPS3 Ten-Year

ISI Plan

For the Fourth Ten-Year Interval February 23, 2019 to

February 22, 2029

Revision 2

Procedures

VPROC ENG-10-

013

Multi-Frequency Eddy Current Examination of Tubing

(54-ISI-400)

Revision 7

71111.15

Procedures

MOV 1222A

Inspection of 480 Volt Magnesium Rotored MOV Motors

Revisions 4

and 5

71111.18

Corrective Action

Documents

242076

Miscellaneous

MISC-MECH-EP-

073

Technical Manual for Spare Penetration Canopy Seal Clamp

Assembly (CSCA) for Millstone 3

Revision 1

MISC-MECH-SP-

034

Design Specification for the Canopy Seal Clamp Assembly

for Millstone Unit 3

Revision 1

MP3-23-01117

Design Equivalent Change Package, Canopy Seal Repair of

Reactor Pressure Vessel Head Penetration L-7

Revision 0

71111.20

Miscellaneous

PRE-3R22 Shutdown Risk Schedule Review (memorandum

from Operations to Nuclear Outage and Planning, dated

October 14, 2023)

Revision 1

71111.24

Calculations

NM-027-ALL MP3 Active Valve Response Times

Revision 4

Corrective Action

Documents

CR1242059

CR1242064

Procedures

SP 3604A.5-006

Remote Position Indication Verification

Revision 8

SP 3604A.5-01

Quarterly Chemical and Volume Control System Stroke

Testing Train A

Revision 10

SP 3621.1

Main Feedwater Valve Operability Test

Revision 16

Work Orders

53102829468

203351076

203380278

71152A

Calculations

14-ENG-

04518M3

MP3 GL-2008-01 Pump Suction Side Gas Void Allowable

Volume Using Westinghouse Simplified Equation Method

Revision 0

Corrective Action

Documents

Cause Eval

CA11305186

CR118359

CR1195831

CR1209700

CR1210313

CR1210351

CR1210404

CR1240948

CR1241612

CR1243504

OD CA11307360

Engineering

Evaluations

M3-EV-08-0026

Generic Letter 2008-01 Response

Revision 2

Procedures

SP 3610A.3

RHR System Vent and Valve Lineup Verification

Revision 13

SP 3614I.3A

Supplementary Leak collection and Release System

Boundary Isolation Damper Test

Revision 1

Work Orders

203287705

203376813

203388316