IR 05000346/2016007

NRC Component Design Bases Inspection Report 05000373/2016007; 05000346/2016007

ML16174A094
Person / Time
Site:	Davis Besse, LaSalle
Issue date:	06/22/2016
From:	Jeffers M Division of Reactor Safety III
To:	Bryan Hanson Exelon Generation Co
References
IR 2016007
Preceding documents:	ML16292A811 (17 October 2016)
Download: ML16174A094 (47)

Text

UNITED STATES une 22, 2016

SUBJECT:

LASALLE COUNTY STATION, UNITS 1 AND 2 - NRC COMPONENT DESIGN BASES INSPECTION, INSPECTION REPORT 05000373/2016007; 05000374/2016007

Dear Mr. Hanson:

On May 13, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed a Component Design Bases Inspection at your LaSalle County Station, Units 1 and 2. The enclosed report documents the results of this inspection, which were discussed on May 13, 2016, with Mr. Trafton, Site Vice President, and other members of your staff.

Based on the results of this inspection, four NRC-identified findings of very-low safety significance were identified. The findings involved violations of NRC requirements. However, because of their very-low safety significance, and because the issues were entered into your Corrective Action Program, the NRC is treating the issues as Non-Cited Violations in accordance with Section 2.3.2 of the NRC Enforcement Policy.

If you contest the subject or severity to any of these Non-Cited-Violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, Region III; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the LaSalle County Station.

In addition, if you disagree with the cross-cutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region III, and the NRC Resident Inspector at the LaSalle County Station. In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS)

component of the NRC's Agencywide Documents Access and Management System (ADAMS).

ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Mark T. Jeffers, Chief Engineering Branch 2 Division of Reactor Safety Docket Nos. 50-373; 50-374 License Nos. NPF-11; NPF-18

Enclosure:

IR 05000373/2016007; 05000374/2016007

REGION III==

Docket No: 50-373; 50-374 License No: NPF-11; NPF-18 Report No: 05000373/2016007; 05000374/2016007 Licensee: Exelon Generation Company, LLC Facility: LaSalle County Station, Units 1 and 2 Location: Marseilles, IL Dates: April 4, 2016 - May 13, 2016 Inspectors: N. Féliz Adorno, Senior Reactor Inspector, Lead A Dahbur, Senior Reactor Inspector, Electrical J. Corujo Sandín, Reactor Inspector, Mechanical D. Reeser, Operations Inspector J. Leivo, Electrical Contractor C. Edwards, Mechanical Contractor Approved by: M. Jeffers, Chief Engineering Branch 2 Division of Reactor Safety Enclosure

SUMMARY

Inspection Report 05000373/2016007; 05000374/2016007, 04/04/2016 - 05/13/2016; LaSalle

County Station, Units 1 and 2; Component Design Bases Inspection.

The inspection was a 3-week onsite baseline inspection that focused on the design of components. The inspection was conducted by four regional engineering and operations inspectors, and two consultants. Four Green findings were identified by the team. These findings were considered Non-Cited Violations (NCVs) of U.S Nuclear Regulatory Commission (NRC) regulations. The significance of inspection findings is indicated by their color (i.e., greater than Green; or Green, White, Yellow, and Red) and determined using Inspection Manual Chapter 0609, Significance Determination Process, dated April 29, 2015.

Cross-cutting aspects are determined using Inspection Manual Chapter 0310, Aspects Within the Cross-Cutting Areas, dated December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated February 4, 2015. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 5, dated February 201

NRC-Identified

and Self-Revealed Findings

Cornerstone: Mitigating Systems

Green.

The team identified a finding of very-low safety significance (Green) and an associated NCV of Title 10, Code of Federal Regulations (CFR), Part 50, Appendix B,

Criterion V, Instructions, Procedures, and Drawings, for the failure to monitor the fouling conditions of the core standby cooling system (CSCS) equipment area coolers.

Specifically, the licensee did not develop performance test procedures to assess the fouling conditions of the safety-related CSCS equipment area coolers and did not have acceptance criteria that delineate when to remove accumulations. The licensee captured this issue in their Corrective Action Program (CAP) as Action Request (AR) 02665463 and established a standing order for operations to impose more restrictive service water temperature limits to reasonably assure the operability of the affected coolers until long term corrective actions were implemented to restore compliance.

The performance deficiency was determined to be more than minor because it was associated with the Mitigating System cornerstone attribute of equipment performance and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding screened as of very low safety significance (Green)because it did not result in the loss of operability or functionality of mitigating systems.

Specifically, the licensee reviewed actual service water temperature values measured during the last 12 months, performed an operability evaluation, and concluded that the historical temperatures did not exceed the operability limits established by the operability evaluation. The team did not identify a cross-cutting aspect associated with this finding because it was not confirmed to reflect current performance. Specifically, the test program for the CSCS equipment area coolers was developed in the decade of 1990s.

(Section 1R21.3.b(1))

Green.

The team identified a finding of very-low safety significance (Green) and an associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the failure to have the capability to verify the supply breakers of both reactor units feeding the swing diesel generator (DG) components were closed during normal plant operation.

Specifically, the circuit design and procedures for the swing DG room fan, fuel oil transfer pump, and fuel storage tank room exhaust fan did not ensure the detection of the condition where one of these feeder breakers was tripped in the open position during normal plant operation. The licensee captured this issue in their CAP as AR 02668759 and created a special log to monitor the associated breakers once per day.

The performance deficiency was determined to be more than minor because it was associated with the Mitigating System cornerstone attribute of equipment performance and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding screened as of very low safety significance (Green) because it did not result in the loss of system and/or function, represent an actual loss of function of at least a single train or two separate safety systems out-of-service for greater than its Technical Specifications (TS) allowable outage time, and represent an actual loss of function of one or more non-TS trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Specifically, a historical review did not find an example where the swing DG was non-functional for a period greater than the applicable TS allowable outage time as a result of this finding during the last year. The team did not identify a cross-cutting aspect associated with this finding because it was not confirmed to reflect current performance due to the age of the performance deficiency. Specifically, the mean to detect an opened breaker associated with the affected loads was established more than 3 years ago. (Section 1R21.3.b(2))

Green.

The team identified a finding of very-low safety significance (Green) and an associated NCV of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the failure to establish procedures that were appropriate to manage containment debris consistent with the emergency core cooling system strainer debris loading design basis and supporting design information. Specifically, the procedures did not contain instructions for evaluating containment debris sources consistent with the associated analyses and other design documents. The licensee captured the team concerns in their CAP as AR 02663076 and AR 02656299. The immediate corrective actions included an operability evaluation that reasonably determined all of the affected emergency core cooling system strainers remained operable.

The performance deficiency was determined to be more than minor because it was associated with the procedure quality attribute of the Mitigating Systems cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding screened as of very-low safety significance (Green)because it did not result in the loss of operability or functionality of mitigating systems.

Specifically, the licensee performed an operability review and reasonably determined that only a portion of the unqualified coatings would be available for transport to the strainers and this quantity was bounded by the associated design basis analysis. In addition, this review reasonably determined that sufficient analytical margin existed to accommodate the quantities of the other debris types found during recent inspections.

The team did not identify a cross-cutting aspect associated with this finding because it was not confirmed to reflect current performance due to the age of the performance deficiency. Specifically, the associated procedures were established more than 3 years ago. (Section 1R21.4.b(1))

Green.

The team identified a finding of very-low safety significance (Green) and associated NCV of the LaSalle County Station Operating License for the failure to ensure that procedures were in effect to implement the alternate shutdown capability.

Specifically, the abnormal operating procedures (AOPs) established to respond to a fire at the main control room did not include instructions for verifying that supply breakers for three reactor core isolation cooling motor-operated valves (MOVs) were closed to ensure they could be operated from the remote shutdown panel. Fire-induced failures could result in tripping MOV power supply breakers prior to tripping the MOV control power fuses. The licensee captured the team concerns in their CAP as AR 02668854 and established compensatory actions to reset the affected breakers, if required The performance deficiency was determined to be more than minor because it was associated with the Mitigating Systems Cornerstone attribute of protection against external events (fire), and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding screened as of very-low safety significance (Green) because it was assigned a low degradation factor. Specifically, the procedural deficiencies could be compensated by operator experience/familiarity and the fact that the AOPs included steps to verify other breakers at the same locations were closed would likely prompt operators to close the remaining breakers. The team determined that this finding had a cross cutting aspect in the area of problem identification and resolution because the licensee failed to take effective corrective actions for a similar issue identified in 2014. Specifically, the resolution of this issue included actions to revise the affected AOPs to include verifying all the reactor core isolation cooling MOVs supplied breakers were closed. However, the licensee failed to include all of the MOVs in the revised AOPs. [P.3] (Section 4OA2.b(1))

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R21 Component Design Bases Inspection

.1 Introduction

The objective of the Component Design Bases Inspection (CDBI) is to verify that design bases have been correctly implemented for the selected risk-significant components and that operating procedures and operator actions were consistent with design and licensing bases. As plants age, their design bases may be difficult to determine and an important design feature may be altered or disabled during a modification. The Probabilistic Risk Assessment (PRA) Model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems, and Barrier Integrity cornerstones for which there are no indicators to measure performance.

Specific documents reviewed during the inspection are listed in the Attachment of this report.

.2 Inspection Sample Selection Process

The team used information contained in the licensees PRA and the LaSalle County Station, Unit 1 and 2, Standardized Plant Analysis Risk Model to identify one scenario to use as the basis for component selection. The scenario selected was a loss of offsite power (LOOP) event. Based on this scenario, a number of risk-significant components were selected for the inspection. In addition, the team selected a risk-significant component with Large Early Release Frequency (LERF) implications using information contained in the licensees PRA and the LaSalle County Station, Units 1 and 2, Standardized Plant Analysis Risk Model.

The team also used additional component information such as a margin assessment in the selection process. This design margin assessment considered original design reductions caused by design modifications, power uprates, or reductions due to degraded material condition. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as performance test results, significant corrective actions, repeated maintenance activities, Maintenance Rule (a)(1) status, components requiring an operability evaluation, system health reports, and U.S. Nuclear Regulatory Commission (NRC) resident inspector input of problem areas and/or equipment. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in depth margins. A summary of the reviews performed and the specific inspection findings identified are included in the following sections of this report.

The team also identified procedures and modifications for review that were associated with the selected components. In addition, the team selected operating experience issues associated with the selected components.

This inspection constituted 17 samples (i.e., 11 components, 1 component with LERF implications, and 5 operating experiences) as defined in Inspection Procedure 71111.21-05.

.3 Component Design

a. Inspection Scope

The team reviewed the Updated Final Safety Analysis Report (UFSAR), Technical Specification (TS), Technical Requirements Manual, drawings, calculations, and other available design and licensing basis information to determine the performance requirements of the selected components. The team used applicable industry standards, such as the American Society of Mechanical Engineers Code, Institute of Electrical and Electronics Engineers Standards, and the National Electric Code, to assess the systems design. The team also reviewed licensee actions, if any, taken in response to NRC issued operating experience, such as Generic Letters (GL) and Information Notices (INs). The team reviewed the selected components design to assess their capability to perform their required functions and support proper operation of the associated systems. The attributes that were needed for a component to perform its required function included process medium, energy sources, control systems, operator actions, and heat removal. The attributes that verified component condition and tested component capability were appropriate and consistent with the design bases may have included installed configuration, system operation, detailed design, system testing, equipment and environmental qualification, equipment protection, component inputs and outputs, operating experience, and component degradation.

For each of the components selected, the team reviewed the maintenance history, preventive maintenance activities, system health reports, operating experience-related information, vendor manuals, electrical and mechanical drawings, operating procedures, and licensee Corrective Action Program (CAP) documents. Field walkdowns were conducted for all accessible components selected to assess material condition, including age-related degradation, configuration, potential vulnerabilities to hazards, and consistency between the as-built condition and the design. In addition, the team interviewed licensee personnel from multiple disciplines such as operations, engineering, and maintenance. Other attributes reviewed are included as part of the scope for each individual component.

The following 12 components (i.e., samples), including a component with LERF implications, were reviewed:

Unit 2, Reactor Core Insolation Cooking (RCIC) Pump (2E51-C001): The team reviewed the following hydraulic calculations to assess the pump capability to perform its required mitigating functions: pump minimum required flow, runout flow, flow capacity, and minimum required net positive suction head (NPSH). In addition, the team reviewed analyses associated with water hammer and other gas intrusion considerations, such as the condensate storage tank minimum water level setpoint and instrument uncertainty calculations. The team also reviewed test procedures and completed surveillance tests, including quarterly and comprehensive in-service testing, to assess the associated methodology, acceptance criteria, and test results. In addition, the team reviewed design analyses and test documents of the equipment area cooler to assess its capability to maintain room temperature below the maximum qualification temperature value of the RCIC pump support components. The team also assessed the pump protective measures against flooding, seismic, and high-energy line break (HELB) effects.

Unit 2, RCIC Turbine (2E51-C002): The team reviewed analyses for turbine minimum required steam flow, turbine required speed, and water hammer in the steam exhaust line to assess the RCIC turbine capability to perform its required mitigating functions. The team also reviewed turbine speed control and trip test procedures, results, and trends, as well as vendor information, such as General Electric Service Information Letters, to assess the turbine control system capability to perform its function. In addition, the team reviewed design analyses and test documents of the equipment area cooler to assess its capability to maintain room temperature below the maximum qualification temperature value of the RCIC turbine support components. The team also assessed the turbine protective measures against flooding, seismic, and HELB effects.

Unit 2, RCIC Steam Supply MOV (2E51-F045): The team reviewed analyses for maximum differential pressure, weak link, and minimum required thrust to assess the valve capability to provide its required mitigating functions. In addition, the team reviewed test procedures and recently completed surveillance tests to assess the associated methodology, acceptance criteria, and test results. The team also reviewed the valve seismic and HELB analyses to assess the associated protective measures. In addition, the team reviewed electrical load flow calculations to assess the motor capability to operate the valve under degraded voltage conditions. The team also reviewed the protective relaying scheme, including drawings, calculations and schematic diagrams, to assess its capability to provide motor protection and to preclude spurious tripping under accident conditions.

Unit 2, Drywell Purge Isolation Air-Operated Valve (2VQ-34): The team reviewed analyses for maximum differential pressure, weak link, and minimum required thrust to assess the valve capability to provide its function. The team reviewed leak rate test procedures and recently completed surveillance tests to assess the associated methodology, acceptance criteria, and test results, and ultimately assess the valve capability to perform its containment barrier function. In addition, the team reviewed the valve seismic and HELB analyses to assess the associated protective measures. This review constituted one component sample with LERF implications.

Swing Diesel Generator (DG) (0DG01K): The team reviewed the following DG test procedures and completed surveillance tests to assess the associated methodologies, acceptance criteria, and test results: single load rejection, full load rejection, and capability to accept load within it design bases time. In addition, the team reviewed tests and calculations associated with room heat up, combustion air, and exhaust design. The team also reviewed the DG protective measures against flooding, HELB, and tornado generated missiles. The following loading calculations were reviewed to assess the DG capability to perform its safety function: voltage, frequency, current, and loading sequences during postulated LOOP and loss-of-coolant accident (LOCA) conditions. The team also reviewed protective relay setpoint calculations and setpoint calibration test results to assess the DG protection during testing and emergency operations. A sample of TS surveillance results were reviewed to assess compliance with the acceptance criteria and test frequency requirements.

In addition, the team reviewed the following DG auxiliary sub-components:

Air Start Receivers (0DG06TA/B) and Motors (0DG08KA/B/C/D): The team reviewed the pre-operational test results of the air start receivers to assess their capacity to support the minimum number of required DG starts. In addition, test procedures and completed surveillance tests were reviewed to assess the air start receivers and motors capability to start the DG.

Jacket Water Cooler (0DG01A): The team reviewed the jacket water cooler thermal analysis to assess its capability to maintain engine temperature within design limits and verified that the licensee had updated the analysis to reflect the latest design bases ultimate heat sink temperature limit changes. In addition, the team reviewed the implementation of the GL 89-13 Program and its commitments associated with the jacket water cooler. Specifically, the team reviewed thermal performance test and inspect-and-clean procedures and completed surveillances to assess the associated methodologies, acceptance criteria, and test results.

Fuel Oil Storage Tank (0DO2T): The team reviewed fuel oil consumption calculations, and main storage and day tank capacity calculations, including the associated level instrument setpoints and uncertainty analyses, to assess the availability of the required DG fuel oil supply.

The team also reviewed test procedures for fuel oil quality. In addition, the team reviewed the licensees evaluation and resolution of related operating experiences and a Non-Cited Violation (NCV) identified in a previous CDBI as discussed in Section 1R21.4.a and Section 4OA2.1.a of this report.

Fuel Oil Transfer Pump (0DO01P): The team reviewed hydraulic calculations to assess flow capacity, NPSH, and air-entraining vortices preventive measures. The team also reviewed the control circuit design and the pump protective devices.

Swing DG Room Fan (0VD01C) and Ventilation Balancing Dampers (0VD01/2/3YA/B): The team reviewed air flow calculations to assess the fan capability to maintain the swing DG room within its design bases temperature limit. The team also reviewed design documentation and procedures associated with the DG room temperature and fan intake filter differential pressure instrumentation to assess the licensee capability to detect and address degraded ventilation conditions. In addition, the team reviewed the preventative maintenance documents for the fan and dampers, including sub-components such as hydramotors and control logic circuitry, to assess their periodicity and consistency with vendor information. The team also reviewed the protective measures against flooding, seismic, and tornado generated missiles. The supply fan maximum brake horsepower requirements were reviewed to assess the motor capability to supply power during worse case design basis conditions.

The results of load flow and voltage regulation analyses were reviewed to assess the motor capability to start and run during degraded offsite voltage conditions coincident with a postulated design basis accident. The team also reviewed the motor breaker settings to assess the motor overcurrent protection during the most limiting design basis operating conditions. The DG operating and standby readiness procedures were reviewed to assess the consistency between the DG ventilation system operation and the design requirements. The team also reviewed the design of the instrumentation relied upon for the automatic room ventilation operation, including power supplies and setpoints, to assess the system operation.

Unit 2, RCIC High-Temperature and High-Steam Flow Isolation Instrumentation (TE-2E31-N004A/B, TE-2E31-N005A/B, TS-2E31-N602A/B, TS-2E31-N603A/B, 2E31-N013BA): The team reviewed schematic diagrams, instrument specifications such as range and accuracy, setpoint and uncertainty calculations, and the installation configuration to assess the temperature and flow instrumentation capability to perform its function. In addition, the team reviewed test and calibration procedures as well as recently completed surveillances to assess the associated methodology, acceptance criteria, and test results. The team also considered the protective measures against flooding, seismic, and HELB when reviewing the described analyses and during field walkdowns.

Unit 2, Suppression Pool Water Temperature and Level Instrumentation (2TE-CM-057/037, 2UY-CM037, 2LT-CM-030, 2LS-E22-N002): The team reviewed schematic diagrams, instrument specifications such as range and accuracy, margin and uncertainty calculations, and the installation configuration to assess the capability of the temperature and level instrumentation to perform its function. In addition, the team assessed the consistency between plant surveillance procedures and the methodology for determining average water temperature and data quality allowances described in vendor documentation.

The team also reviewed test and calibration procedures as well as recently completed surveillances to assess the associated methodology, acceptance criteria, and test results. In addition, the team considered the protective measures against flooding, seismic, and HELB when reviewing the described analyses and during field walkdowns.

Unit 2, 125 Volts Direct Current (Vdc) Distribution Panels 211Y/212Y (2DC11E/13E): The team reviewed design calculations for the loading, short circuit, voltage drop, ground detection/management, and electrical protection for the distribution panels and a sample of loads to assess the ratings and capability of the panels to serve the loads under design basis conditions, provide coordinated protection, and to preclude premature tripping. In addition, the team also reviewed the station blackout (SBO) load shedding procedures to assess their consistency with the design margins established by the calculations and the operators capability to perform the associated actions within the times assumed in the calculations. The team also reviewed test procedures and recently completed surveillances to assess the associated methodology, acceptance criteria, and test results. In addition, the team considered the protective measures against flooding and seismic when reviewing the described analyses and during field walkdowns.

Unit 2, RCIC Instrumentation 125Vdc to 120 Volts Alternating Current (Vac)

Inverter (2E51-K603): The team reviewed the loading and protection specifications and features for the inverter to assess its capability to serve the instrument power supply loads under design basis conditions, including operation under minimum direct current (DC) input voltage conditions. The team also reviewed the basis for the inverter qualification, including surge protection and electromagnetic compatibility. In addition, the team reviewed the modification discussed in Section 1R21.5.a of this report. The team also reviewed test procedures and recently completed surveillances to assess the associated methodology, acceptance criteria, and test results. In addition, the team considered the protective measures against flooding and seismic when reviewing the described analyses and during field walkdowns.

Unit 2, 250Vdc Motor Control Center (MCC) 221Y (2DC06E): The team reviewed the system short circuit and loading calculations to assess the available short circuit current under faulted conditions and the capability to serve the maximum anticipated bus load. The team also reviewed the bus, breaker, and cable ratings to assess their capability to carry maximum loading and interrupt maximum faulted conditions. In addition, the team reviewed cable separation design to assess compliance with single failure and Title 10, Code of Federal Regulations (CFR), Part 50, Appendix R criteria. Breaker coordination was also reviewed to assess their capability to interrupt overloads and faulted conditions.

The team also reviewed recent engineering changes (ECs) to assess the bus current capability to support design requirements. In addition, the team reviewed test procedures and recently completed surveillances to assess the associated methodology, acceptance criteria, and test results.

Unit 2, 4 Kilovolt (kV) Switchgear 241Y (2AP04E): The team reviewed the design of the 4.16kV bus degraded voltage protection scheme, including degraded voltage relay setpoint calculations, to assess its capability to supply the required voltage to safety-related devices at all voltage distribution levels.

The team also reviewed 125Vdc system voltage drop calculations to assess the 4.16kV bus circuit breakers control voltage. In addition, the team reviewed supply breaker control logic and wiring diagrams to assess the capability to automatically transfer between the normal and alternate sources under postulated conditions as described in the UFSAR and in accordance with operating procedures. This review included an assessment of the automatic and manual transfer schemes between alternate offsite sources and the swing DG.

The team also reviewed the control circuit voltage to assess the circuit breakers capability to close and trip. In addition, the team reviewed test procedures and recently completed surveillances to assess the associated methodology, acceptance criteria, and test results.

b. Findings

(1) Failure to Monitor the Fouling Conditions of the Core Standby Cooling System Equipment Area Coolers

Introduction:

The team identified a finding of very-low safety significance (Green)and an associated NCV of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the failure to monitor the fouling conditions of the core standby cooling system (CSCS) equipment area coolers. Specifically, the licensee did not develop performance test procedures to assess the fouling conditions of the safety-related CSCS equipment area coolers and did not have acceptance criteria that delineate when to remove accumulations.

Description:

On July 18, 1983, the NRC issued GL 89-13, Service Water System Problems Affecting Safety-Related Equipment, to alert licensees about operating experience and studies that raised concerns regarding service water systems in nuclear power plants. The GL requested licensees, in part, to provide a response describing the actions planned or taken to ensure that their service water systems were and will be maintained in compliance with applicable regulatory requirements. The licensee provided its response in a letter to the NRC titled Response to Generic Letter 89-13, dated January 29, 1990. Subsequent reviews revealed weaknesses in the licensee original GL 89-13 Program. As a result, the licensee re-baselined the program and revised its original response in a letter to the NRC titled Generic Letter 89-13 Revised Response, dated July 28, 1998. The revised response stated that the CSCS equipment area cooler testing program would include tube-side (chemical) cleaning on condition, air-side coil inspection, component flushing, air-side flow verification, cooling water flow verification, and cooling water dP [differential pressure] monitoring.

During this inspection period, the licensee controlled the implementation of GL 89-13 activities with Revision 7 of Procedure ER-AA-340, GL 89-13 Program Implementing Procedure. Step 4.2.3 stated Implement a heat exchanger performance-testing program. It also stated Develop performance test procedures that will verify the capabilities of the safety related heat exchangers, including test procedure and instrument uncertainties, and contain acceptance criteria based on the design requirements of the systems. In addition, Revision 9 of Procedure ER-AA-340-1001, GL 89-13 Program Implementation Instructional Guide, provided detailed guidance for the implementation of GL 89-13 activities. Step 4.1.1.1.C stated The program shall inspect/test for macroscopic biological fouling organisms, sediment, corrosion and general component condition. It also stated The inspection/test program shall have acceptance criteria that delineate when to remove accumulations.

The team noted that the licensee developed a test procedure to measure flowrate and dP for the CSCS cooler for the room containing the low pressure core spray and RCIC systems (i.e., cooler 2VY04A) on a biennial basis and to evaluate the flowrate results against an acceptance criterion. However, the dP results were only trended because an associated acceptance criterion was not established. In addition, the team noted that the cooler was cleaned four times since the GL 83-13 Program was established but was unable to determine the trigger for these cleaning activities. The team was concerned because flow verification by itself was insufficient to assess the cooler fouling condition.

Moreover, the team was concerned about the actual cooler fouling conditions because the dP trend data since year 2010 showed a dP of approximately 8 times the dP measured in the early 1990s when dP was first measured. A simplified calculation, which assumed tube blockage was the cause for the increased dP results, determined that approximately 60 percent of the tubes were completely blocked. In contrast, the design basis analysis for the cooler only assumed 5 percent of the tubes were blocked.

The licensee captured the team concerns in their CAP as AR 2665463. The immediate corrective actions included an extent of condition that determined this concern was applicable to all four CSCS room coolers of each reactor unit. The other coolers supported the residual heat removal (RHR) and high-pressure core spray systems.

The licensee also performed an operability evaluation that reasonably determined all of the affected equipment were operable based, in part, on the actual service water temperatures. In addition, because operability could not be supported at the service water temperature TS limit, the licensee established a control room standing order to declare some of the affected coolers inoperable at reduced service water temperature limits until the coolers were cleaned. The licensee proposed plan to restore compliance at the time of this inspection was to clean the affected coolers and revise the GL 89-13 Program documents to incorporate applicable Electric Power Research Institute monitoring guidance.

Analysis:

The team determined the failure to monitor the fouling conditions of the CSCS room coolers was contrary to licensee Procedures ER-AA-340 and ER-AA-340-1001, and was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Mitigating System Cornerstone attribute of equipment performance and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to verify that the fouling conditions of the CSCS room coolers are consistent with the associated design analysis does not ensure that these coolers would be capable of performing their mitigating functions.

The team determined the finding could be evaluated using the Significance Determination Process (SDP) in accordance with Inspection Manual Chapter (IMC) 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, issued on June 19, 2012. Because the finding impacted the Mitigating Systems cornerstone, the team screened the finding through IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power, issued on June 19, 2012, using Exhibit 2, Mitigating Systems Screening Questions. The finding screened as of very-low safety significance (Green) because it did not result in the loss of operability or functionality of mitigating systems. Specifically, the licensee reviewed actual service water temperature values measured during the last 12 months and concluded that these values did not exceed the operability limits established by the operability evaluation.

The team did not identify a cross-cutting aspect associated with this finding because it was not confirmed to reflect current performance due to the age of the performance deficiency. Specifically, the test program for the CSCS equipment area coolers was developed in the decade of 1990s.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality be prescribed by documented procedures of a type appropriate to the circumstances and be accomplished in accordance with these procedures. The licensee established Revision 7 of Procedure ER-AA-340 an Revision 9 of Procedure ER-AA-340-1001 as the implementing procedures for monitoring, in part, CSCS room coolers capability to perform their required safety functions, an activity affecting quality.

Procedure ER-AA-340, Step 4.2.3, stated Implement a heat exchanger performance-testing program. It also stated Develop performance test procedures that will verify the capabilities of the safety-related heat exchangers, including test procedure and instrument uncertainties, and contain acceptance criteria based on the design requirements of the systems. In addition, Procedure ER-AA-340-1001, Step 4.1.1.1.C, stated The program shall inspect/test for macroscopic biological fouling organisms, sediment, corrosion and general component condition. It also stated The inspection/test program shall have acceptance criteria that delineate when to remove accumulations.

Contrary to the above, as of May 4, 2016, the licensee failed to follow Step 4.2.3 of Procedure ER-AA-340 and Step 4.1.1.1.C of Procedure ER-AA-340-1001. Specifically, the licensee did not develop performance test procedures that verify the capabilities of the safety-related CSCS room coolers because the test program did not inspect or test for macroscopic biological fouling organisms, sediment, corrosion and general component condition, and did not have acceptance criteria that delineate when to remove accumulations.

The licensee is still evaluating its planned corrective actions. However, the team determined that this issue does not present an immediate safety concern because the licensee established a standing order for operations to impose more restrictive service water temperature limits to reasonably assure the operability of the affected coolers.

Because this violation was of very-low safety significance (Green) and was entered into the licensees CAP as AR 2665463, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy. (NCV 05000373/2016007-01; 05000374/2016007-01, Failure to Monitor the Fouling Conditions of the CSCS Equipment Area Coolers)

(2) Failure to Ensure that Both Feed Supply Breakers for Swing Diesel Generator Components Were Closed During Normal Plant Operation

Introduction:

The team identified a finding of very-low safety significance (Green) and an associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the failure to have the capability to verify the supply breakers of both reactor units feeding the swing DG components were closed during normal plant operation. Specifically, the circuit design and procedures for the swing DG room fan, fuel oil transfer pump, and fuel storage tank room exhaust fan did not ensure the detection of the condition where one of these feeder breakers was tripped in the open position during normal plant operation.

Description:

Section 8.1.2.2 of the UFSAR, Unit Class 1E AC [Alternating Current]

Power System, stated that All of the ESF [engineered safety feature] equipment required to shut down the reactor safely and to remove reactor decay heat for extended periods of time following a LOOP and/or a LOCA are supplied with AC power from the Class 1E AC power system. This UFSAR section defined Class 1E AC power systems as that portion of the station auxiliary power system which supplies AC power to the ESF and stated that The unit Class 1E AC power system is divided into three divisions (Divisions 1, 2 and 3 for Unit 1; Divisions 1, 2, and 3 for Unit 2), each of which is supplied from a 4160-volt bus (141Y, 142Y, and 143 for Unit 1 respectively) and (241Y, 242Y, and 243 for Unit 2 respectively). It also stated that Two ESF groups (Division 2 and 3) of each unit are supplied standby power from individual diesel-generator units, while the third ESF group (Division 1) for each unit obtains its standby power from a common diesel-generator unit, "0", which serves either of the corresponding switch groups in each unit (Bus 141Y or 241Y). In addition, it stated that With this arrangement, alternate or redundant components of all ESF systems are supplied from separate switch groups so that no single failure can jeopardize the proper functioning of redundant ESF.

Because the swing DG was designed to supply power to the division 1 ESF bus for either reactor unit, several safety-related components that supported the swing DG operation (i.e., room vent fan, fuel storage tank room exhaust fan, and fuel transfer pump) were designed with one power supply from each reactor unit. As an example, Unit 1 supplied power to the swing DG room fan (i.e., 0VD01C) via compartment B4 of MCC135X-2 while Unit 2 supplied power to this component via compartment B4 of MCC235X-2. Schematic diagram 1E-0-4433AA, Diesel Generator Room Ventilation System, showed the following operational sequence for the associated control circuit design:

If both MCCs were energized with no breaker or fuse failures during normal operation, the fan would be powered from Unit 1. In addition, the plant process computer (PPC) alarm contact from relay 74, Overload Relay, would be closed causing the alarm to not be displayed at the Main Control Room (MCR). During a LOOP event, the fan control circuit would connect to the MCC of the reactor unit with a LOCA signal. Thus, the Units 1 and 2 MCCs were not considered redundant or backup to each other.

If the Unit 1 MCC feed breaker tripped open and/or the Unit 1 control transformer fuse opened during normal operation, relays AR1 and AR2 would de-energize and power would automatically transfer to the Unit 2 MCC. At the same time, the loss of power from Unit 1 would cause relay 74 to drop out until Unit 2 power picked up. If the PPC alarm contact from relay 74 opened before relay 74 was energized by Unit 2 power, the PPC alarm would appear on the ESF panel.

However, the team noted that the circuit design did not preclude a contact/relay race between relays AR1/AR2 and relay 74 and, thus, the PPC alarm contact from relay 74 was not assured to open before relay 74 was energized by Unit 2 power to provide the alarm function.

If the Unit 2 breaker tripped and/or the Unit 2 control transformer fuse opened when the fan was powered from Unit 1 during normal operation, no PPC or annunciator alarm would appear at the MCR.

If both Unit 1 and 2 MCCs de-energized during normal operation, relay 74 would dropout to activate the ESF display and overload alarm at the MCR annunciator, which would prompt operators to respond in accordance with Procedure LOR-0PL17J-2-1, Diesel Generator Ventilation Fan 0VD01C Automatic Trip.

If either the Unit 1 MCC or the Unit 2 MCC thermal overload relays tripped during normal operation, the fan control circuit would de-energize. The fan would not run from either power source until the thermal overload relays was reset. In addition, relay 74 would drop out to activate the ESF display and overload alarm in the MCR.

The circuit designs for the swing DG fuel storage tank room exhaust fan and fuel oil transfer pump were similar.

The team was concerned because the licensee had not assure that the failure of the Unit 1 or Unit 2 feed breakers for these swing DG components during normal plant operation would be detected. Specifically, the licensee relied on an alarm at the MCR to detect a failure of either feed breaker during normal operation but the associated circuit design did not assure an alarm signal would be generated by either of these conditions.

The team further noted that an undetected breaker failure during normal operations would allow the swing DG to be and remain inoperable during normal operations, which would result in the loss of total DG system given a postulated accident assuming a single failure of the redundant DG train. In addition, the team noted that a failure of either of these breakers during normal operations was credible given recent internal operating experience. Specifically, on July 24, 2011, an equipment operator found the Unit 1 swing DG room fan feed breaker (i.e., MCC 135X-2, B4) tripped during an operator round. The licensee captured the discovery of this issue in their CAP as AR 01243373, verified that the Unit 2 swing DG room fan feed breaker (i.e., MCC 235X-2, B4) was closed, declared the swing DG inoperable for Unit 1, and replaced the failed Unit 1 breaker. In addition, the licensee reviewed historical PPC data and determined that the Unit 1 breaker tripped on July 22, 2011, during the DG monthly surveillance run. Thus, the operators missed the PPC alarm and the previous equipment operator rounds did not identified the condition.

The licensee capture the team concern in their CAP as AR 02668759. The immediate corrective actions was to create a special log to monitor the associated breakers once per day. At the time of this inspection, the licensee was still evaluating its planned corrective actions to restore compliance.

Analysis:

The team determined that the failure to have the capability to verify the supply breakers of both reactor units feeding the swing DG components were closed during normal plant operation was contrary to 10 CFR Part 50, Appendix B, Criterion III, Design Control, and was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Mitigating Systems cornerstone attribute of equipment performance and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to have the capability to verify the supply breakers of both reactor units feeding the swing DG components were closed during normal plant operation would allow a condition where one of the feeder breakers is in the open position during normal plant operation to go undetected, which did not ensure power would be available to these components to support the swing DG operability.

The team determined the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, issued on June 19, 2012. Because the finding impacted the Mitigating Systems cornerstone, the team screened the finding through IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power, issued on June 19, 2012, using Exhibit 2, Mitigating Systems Screening Questions. The finding screened as of very-low safety significance (Green) because it did not result in the loss of system and/or function, represent an actual loss of function of at least a single train or two separate safety systems out-of-service for greater than its TS allowable outage time, and represent an actual loss of function of one or more non-TS trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Specifically, a historical review did not find an example where the swing DG was non-functional for a period greater than the applicable TS allowable outage time as a result of this finding during the last year.

The team did not identify a cross-cutting aspect associated with this finding because it was not confirmed to reflect current performance due to the age of the performance deficiency. Specifically, the means to detect an opened breaker associated with the affected loads were established more than 3 years ago.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that measures be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions. Section 7.3.6.2 of the UFSAR stated The diesel generators are applied to the various plant buses so that the loss of any one diesel generators will not prevent the safe shutdown of either unit. Further, it stated The total system satisfies single-failure criteria.

Contrary to the above, as of May 13, 2016, the licensee failed to assure that applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the licensees design control measures did not assure that the swing DG was applied to the buses supplying power to its room fan, fuel oil transfer pump, and fuel storage tank room exhaust fan such that the total DG system would be able to satisfy the single-failure criteria. The associated circuit design and procedures did not ensure the detection of a condition where the feeder breaker of one of the associated buses was tripped in the open position during normal plant operation.

The licensee is still evaluating its planned corrective actions. However, the team determined that the continued non-compliance does not present an immediate safety concern because the licensee established a special log to monitor the associated breakers once per day.

Because this violation was of very-low safety significance (Green) and was entered into the licensees CAP as AR 02668759, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy. (NCV 05000373/2016007-02; 05000374/2016007-02, Failure to Ensure that Both Feed Supply Breakers for Swing DG Components Were Closed During Normal Plant Operation)

.4 Operating Experience

a. Inspection Scope

The team reviewed five samples of operating experience issues to ensure that NRC generic concerns had been adequately evaluated and addressed by the licensee. The operating experience issues listed below were reviewed as part of this inspection:

IN 2006-22, New Ultra-Low-Sulfur Diesel Fuel Oil Could Adversely Impact Diesel Engine Performance; IN 2009-02, Biodiesel in Fuel Oil Could Adversely Impact Diesel Engine Performance; IN 2012-16, Preconditioning of Pressure Switches Before Surveillance Testing; IN 2013-14, Potential Design Deficiency in MOV Control Circuitry; and Bulletin 96-03, Potential Plugging of Emergency Core Cooling Suction Strainers by Debris in Boiling-Water Reactors.

b. Findings

(1) Inadequate Procedures for Containment Debris Management

Introduction:

The team identified a finding of very-low safety significance (Green) and an associated NCV of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the failure to establish procedures that were appropriate to manage containment debris consistent with the emergency core cooling system (ECCS)strainer debris loading design basis and supporting design information. Specifically, the procedures did not contain instructions for evaluating containment debris sources consistent with the associated analyses and other design documents.

Description:

On May 6, 1996, the NRC issued Bulletin 96-03, Potential Plugging of Emergency Core Cooling Suction Strainers by Debris in Boiling-Water Reactors, to request addressees to implement appropriate procedural measures and plant modifications to minimize the potential for clogging of ECCS suppression pool suction strainers by debris generated during a LOCA and to provide a response describing these actions. The licensee provided an initial response in a letter to the NRC titled LaSalle County Station Unit 1 and 2 Response to the NRC Bulletin 96-03, dated November 1, 1996. This response stated, in part, that the licensee planned to install larger capacity passive strainers designed using the guidance contained in NEDO-32686, Boiling Water Reactors Owners Group Utility Resolution Guidance for ECCS Suction Strainer Blockage, which was endorsed with exceptions by the NRC.

By letter titled Completion Report for NRC Bulletin 96-03, dated April 28, 2000, the licensee informed the NRC that all actions requested by the bulletin were completed, including the implementation of procedures for periodic drywell and wetwell inspections and periodic suppression chamber desludging. The NRC documented its review and acceptance of the licensee responses in letter titled Completion of Actions for Bulletin 96-03, LaSalle County Station, Units 1 and 2, dated June 2, 2000.

The licensee estimated the head loss across the debris bed formed on the strainers due to accumulation of debris produced during a LOCA in calculation L-002051. This calculation established separate design limits for different debris sources at specified containment locations, such as unqualified coatings, rust flakes, and sludge. During this inspection period, the licensee used Revision 9 of Procedure CC-AA-205, Control of Undocumented/Unqualified Coatings inside the Containment, to control the amount of undocumented/unqualified coatings within the design limits. In addition, Revision 8 of Procedure LTS-600-41, Primary Containment Inspections for ECCS Suction Strainer Debris Sources, was used to perform and document the periodic drywell and wetwell inspections to identify and maintain containment debris quantities below their design limits. Moreover, Revision 18 of Procedure OP-AA-108-108, Attachment 1, Engineering Department Start-Up Checklist, step 24, required the licensee to verify that the ECCS strainer debris loads were within design limits prior to unit startup. The licensee completed this step by performing an evaluation using ECs.

However, the team noted that the procedures were inadequate to maintain containment debris quantities consistent with the design basis and design supporting information.

Specifically, Procedure CC-AA-205 did not contain instructions to ensure that the appropriate coating supporting design information (i.e., thickness and density) was used when evaluating degraded coatings that were originally considered as qualified against the applicable strainer debris loading design basis limit. Specifically, the licensee documented the identified areas of unqualified coatings in a log using units of square feet. Because calculation L-002051 established a design limit of 328 pounds, the licensee converted the units from square feet to pounds.

However, the team noted that the licensee used the coating supporting design information for the coating system that was originally installed as unqualified, which had smaller thickness and density values than the originally qualified coating system that was found degraded during the inspections and, thus, was no longer qualified. As a result, the licensee underestimated the amount of drywell unqualified coatings. Specifically, the incorrect logs showed an available margin of about 16 percent and 44 percent for Units 1 and 2, respectively.

When the logs were corrected, the design basis limits were exceeded by about 20 percent and 7 percent for Units 1 and 2, respectively.

Procedure LTS-600-41 contained a sludge acceptance criterion that was inconsistent with the applicable design basis limit and was non-conservative.

Specifically, calculation L-002051 established a sludge design limit of 750 pounds. However, procedure LTS-600-41 contained an acceptance criteria of 1000 pounds.

Procedure LTS-600-41 did not contain appropriate instructions to evaluate the as-found conditions against the design basis limit for each debris type evaluated by calculation L-002051. As a result, the licensee was not evaluating the as-found conditions consistent with this calculation. For example, the diver inspection report attached to Work Order 01317612 described the identified sludge piles as The size of the material in these piles ranged from particulate to 3 [inches] long by 1 [inch] wide, but averaged in the dime to quarter size. In contrast, the NEDO-32686 sludge particle maximum size was 0.003 inches.

Based on other documented inspection report descriptions, the team determined that the likely debris type described by the diver was rust flakes, which had a design basis limit of 100 pounds as opposed to 750 pounds for sludge. A second example is documented in the next bullet.

Procedure LTS-600-41 did not contain appropriate instructions to evaluate the aggregate effects of the debris found when performing different inspection activities at different containment locations. Specifically, the team noted instances when the inspection for the entire containment was not completed in a single effort and the evaluation of the results for each inspection effort did not account for the results for the other inspection activities when comparing the identified condition against the design basis limits. For example, EC 392593, which used the LTS-600-41 sludge results and was performed to meet Step 24 of Procedure OP-AA-108-108, Attachment 1, evaluated only the suppression pool sludge against the design basis allowances of multiple debris sources.

Specifically, it stated Design Analysis L-002051 describes the following suppression pool particulate matter debris assumed in the ECCS suction strainer head loss analysis: 750 lbs. [pounds] of sludge, 300 lbs. [pounds]

of dirt/dust, 85 lbs. [pounds] of qualified paint debris, 328 lbs. [pounds] of unqualified paint debris, and 100 lbs. [pounds] of rust flakes. It also concluded that The estimated amount of sludge in the suppression pool at L2R14 (205 lbs.

[pounds]) and the predicated accumulation by L2R15 (365 lbs. [pounds]) are well below the amount assumed in Design Analysis L-002051 (750 lbs. [pounds] plus additional allowances for dust/dirt, paint, and rust. The team noted that EC 392593 did not consider the amount of debris sources at both the drywell and wetwell other than suppression pool sludge when crediting the design basis limits for multiple drywell and wetwell debris sources. The team was concerned that this licensee practice would allow a condition where the debris amount identified in each inspection location is within the design basis limits but, in aggregate, would exceed them. This example also illustrates the concern described in the previous bullet. The team noted similar observations on other start-up ECs.

Overall, the team was concerned because the procedures were not adequate to ensure that the containment debris quantities were consistent with the design basis analysis and their relative distribution were consistent with the design information, including testing, that supported the design basis analysis assumptions.

The licensee captured the team concerns in their CAP as AR 02663076 and AR 02656299. The immediate corrective actions included an operability evaluation that reasonably determined all of the affected ECCS strainers remained operable.

Specifically, the licensee reasonably concluded that only a fraction of the unqualified coatings would be available for transport to the strainers during a LOCA and this amount was bounded by the associated design basis limit. This determination was based, in part, on unqualified coating testing and the documented condition of the unqualified coatings. In addition, the licensee reviewed containment cleaning records and the inspection results for the other debris sources and reasonably determined that the associated design basis limits were met. The licensee proposed plan to restore compliance at the time of this inspection was to revise the affected procedures and the coating logs. In addition, the licensee planned to revise calculation L-002051 if additional margin is required to meet the corrected coating log values.

Analysis:

The team determined the failure to establish procedures that were appropriate to manage containment debris consistent with the ECCS strainer debris loading design basis and supporting design information, was contrary to 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, and was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the procedure quality attribute of the Mitigating Systems cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to establish procedures that were appropriate to manage containment debris does not ensure that the ECCS strainer debris loading during a LOCA will be bounded by the associated design basis analysis.

The team determined the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, issued on June 19, 2012. Because the finding impacted the Mitigating Systems cornerstone, the team screened the finding through IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power, issued on June 19, 2012, using Exhibit 2, Mitigating Systems Screening Questions. The finding screened as of very-low safety significance (Green) because it did not result in the loss of operability or functionality of mitigating systems. Specifically, the licensee performed an operability review and reasonably determined that only a portion of the unqualified coatings would be available for transport to the strainers and this quantity was bounded by the associated design basis analysis. In addition, this review reasonably determined that sufficient analytical margin existed to accommodate the quantities of the other debris types found during recent inspections.

The team did not identify a cross-cutting aspect associated with this finding because it was not confirmed to reflect current performance due to the age of the performance deficiency. Specifically, the associated procedures were established more than 3 years ago.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality be prescribed by documented procedures of a type appropriate to the circumstances and be accomplished in accordance with these procedures. The licensee established Revision 9 of Procedure CC-AA-205 and Revision 8 of Procedure LTS-600-41 as the implementing procedures for containment debris management, an activity affecting quality.

Contrary to the above, as of April 29, 2016, the licensee failed to have procedures of a type appropriate to manage containment debris consistent with the ECCS strainer debris loading design basis and supporting design information, as evidenced by the following examples:

Procedure CC-AA-205 did not contain instructions to ensure that the appropriate coating supporting design information (i.e., thickness and density) was used when evaluating degraded coatings that were originally considered as qualified against the applicable strainer debris loading design basis limit.

Procedure LTS-600-41 contained a sludge acceptance criterion that was inconsistent with the applicable design basis limit and was non-conservative.

Procedure LTS-600-41 did not contain appropriate instructions to evaluate the as-found conditions against the corresponding design basis debris type.

Procedure LTS-600-41 did not contain appropriate instructions to evaluate the aggregate effects of the debris found when performing different inspection activities at different containment locations.

The licensee is still evaluating its planned corrective actions. However, the team determined that the continued non-compliance does not present an immediate safety concern because the licensee performed an operability review and reasonably determined that ECCS was operable based on the as-found conditions documented in recent inspection reports.

Because this violation was of very-low safety significance (Green) and was entered into the licensees CAP as AR 2656299 and AR 2663076, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy.

(NCV 05000373/2016007-03; 05000374/2016007-03, Inadequate Procedures for Containment Debris Management)

.5 Modifications

a. Inspection Scope

The team reviewed two permanent plant modifications related to the selected risk significant components to verify that the design bases, licensing bases, and performance capability of the components had not been degraded through modifications. The modifications listed below were reviewed as part of this inspection effort:

EC 396093, Install 125Vdc/120Vac Inverter to Power Existing 120Vac/24Vdc Power Supply that Feeds Existing Containment Instrumentation; and EC 395217, Unit 2 Division 1 and 2 DG Feed Breaker Logic Modification due to C RHR and LPCS [Low-Pressure Core Spray] anti-Pump Logic.

b. Findings

No findings were identified.

.6 Operating Procedure Accident Scenarios

a. Inspection Scope

The team performed a detailed reviewed of the procedures listed below associated with a loss of offsite power and a complete loss of AC power (i.e., SBO). The procedures were compared to UFSAR, design assumptions, and training materials to asses for constancy. The following operating procedures were reviewed in detail:

LOA-DG-101(201), DG Failure [Unit 1(2)], Revision 9(8);

LOA-FC-101(201), Unit 1(2) Fuel Pool Cooling System/Reactor Cavity Level Abnormal, Revision 25(23);

LGA-RH-103(203), Unit 1(2) A/B RHR Operations in the LGAS/LSAMGS, Revision 12(13);

LOP-RH-01, Filling and Venting the Residual Heat Removal System, Revision 57; LOP-RH-02, Venting the Residual Heat Removal System, Revision 9; LOA-IN-101, Loss of Drywell Pneumatic Air Supply, Revision 9; and LOP-IN 05, Replacing Nitrogen Bottles on Instrument Nitrogen System, Revision 25.

For the procedures listed, time critical operator actions were reviewed for reasonableness. This review included walkdowns of in-plant actions with a licensed operator and the observation of licensed operator crews actions during the performance of an SBO scenario on the station simulator to assess operator knowledge level, procedure quality, availability of special equipment where required, and capability to perform time critical operator actions within the required time. The simulated scenario started with a dual unit loss of offsite power and then degraded, several minutes later, into an SBO on Unit 1 with limited power available to Unit 2. In addition, the team evaluated operations interfaces with other departments and the transition to beyond licensing basis event procedures to assess the interface between licensing basis and beyond licensing basis procedures. The following operator actions were reviewed:

establish automatic depressurization system control in the auxiliary electric equipment room; DC load shedding; placement of RHR in the suppression pooling cooling mode following an SBO; and replacing drywell pneumatic air supply nitrogen bottles.

b. Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems

.1 Review of Items Entered Into the Corrective Action Program

a. Inspection Scope

The team reviewed a sample of problems identified by the licensee associated with the selected components and that were entered into the CAP. In addition, the team reviewed a sample of CAP documents for the last 3 years resulting from degraded conditions. The team reviewed these issues to assess the licensees threshold for identifying issues and the effectiveness of corrective actions related to design issues.

In addition, corrective action documents written on issues identified during the inspection were reviewed to assess the incorporation of the problem into the CAP. The specific corrective action documents sampled and reviewed by the team are listed in the attachment to this report.

The team also selected three issues identified during previous CDBIs to assess the associated licensees evaluation and resolution. The following issues were reviewed:

NCV 2007009-03, Lack of Station Blackout Analysis for Reactor Core Isolation Cooling (RCIC);

NCV 2010006-02, DG Usable Fuel and RHR Pump NPSH Calculations Failed to Consider Appropriate DG Frequency Variations; and NCV 2010006-04, Fast Bus Transfer

b. Findings

(1) Alternate Shutdown Procedures Failed to Ensure RCIC MOVs Supply Breakers Were Closed

Introduction:

The team identified a finding of very-low safety significance (Green) and associated NCV of the LaSalle County Station Operating License for the failure to ensure that procedures were in effect to implement the alternate shutdown capability.

Specifically, the AOPs established to respond to a fire at the MCR did not include instructions for verifying that supply breakers for three RCIC MOVs were closed to ensure they could be operated from the remote shutdown panel (RSP). Fire-induced failures could result in tripping MOV power supply breakers prior to tripping the MOV control power fuses.

Description:

In the event of an MCR evacuation due to a fire, the safe shutdown analysis credited the RCIC system for the alternate shutdown method from the RSP.

Specifically, RCIC was credited for reactor water makeup and decay heat removal.

During this event, the MCR control circuits for the RCIC MOVs needed to be transferred from the MCR to the RSP. To accomplish this transfer, the licensee included instructions to the operators for placing the RCIC remote shutdown transfer switches in the emergency position at the RSP in Procedure LOA-FX-101, Unit 1 Safe Shutdown with a Fire in the Control Room, and Procedure LOA-FX-201, Unit 2 Safe Shutdown with a Fire in the Control Room. This transfer was intended to ensure that the alternate shutdown capability was independent of the MCR fire area by isolating the MCR control circuits for the RCIC MOVs and connecting a different set of control fuses that fed from a separate power source at the RSP for each MOV.

However, in 2014, the NRC identified that the licensee failed to ensure that the alternate shutdown capability was independent of the MCR during the NRC Triennial Fire Protection inspection. Specifically, the inspectors noted that the control circuit design did not ensure the MOV control power fuses trip before the associated feeder breakers as a result of fire-induced failures, such as a short circuit in the control circuit. A tripped MOV feed breaker would impair the operation of the associated MOV from the RSP.

In addition, the inspectors noted that Revision 26 of LOA-FX-101 and Revision 27 of LOA-FX-201 did not include instructions to reset the affected breakers. This issue was documented by the inspectors as NCV 05000373/2014008-01; 05000374/2014008-01, Failure to Ensure Circuits Associated with Alternate Shutdown Capability Free of Fire-Induced Damage, in Inspection Report 05000373/2014008; 05000374/2014008, dated February 27, 2015. The licensee captured this issue in their CAP as AR 02424674 and reviewed the control circuits of the affected MOVs. Specifically, the licensee completed analysis L-004017, 250 Vdc Breaker Fuse Coordination for RCIC, Revision 0, which evaluated breaker-fuse coordination for all 28 RCIC MOVs (14 per reactor unit) during a postulated MCR fire event. This analysis identified 16 MOVs (8 per reactor unit) that could be adversely affected by a postulated MCR fire and, thus, required further evaluation for potential lack of breaker fuse coordination. In addition, the licensee revised Procedures LOA-FX-101 and LOA-FX-201 to verify closed the breakers associated only with these 16 MOVs after control was transferred to the RSP.

During this CDBI inspection, the team noted that analysis L-004017 calculated the fault current using the maximum DC bus voltage divided by the resistance of each cable (using a value of 0.273 ohms per 1000 feet). Thus, shorter cable lengths led to smaller cable resistances resulting in higher fault current values. However, the analysis did not consider all potential fire-induced short circuits that could potentially affect breaker-fuse coordination and, as a result, failed to evaluate short circuits that resulted in shorter short circuit cable lengths. Specifically, the analysis only considered a short circuit (conductor to conductor dead short) for the control cable associated with each MOV and that provided the shortest path for each MOV from the 250Vdc power source to the MCR. For example, the analysis determined that the existing breaker settings for MOVs 1E51-F019, 2E51-F019, and 1E51-F059 were acceptable because their maximum calculated fault current was less than the minimum breaker trip setting using a cable length of 2926 feet, 3512 feet, and 1821 feet, respectively. The analysis also determined the margins between the minimum breaker setting and maximum fault current were 14.49 percent, 19.92 percent, and 2.57 percent for these MOVs, respectively. However, the analysis did not consider fire-induced circuit failures such as shorts between cables associated with these MOVs and other MOVs from the same 250Vdc power source resulting in shorter short circuit cable lengths. The analysis also failed to consider shorts between cables associated with these MOVs and the ground, and cables associated with other MOVs with shorter cable lengths and the ground that would end with short circuit via the ground.

The team was concerned because the unanalyzed fire-induced circuit failures (i.e., short between cables and short to grounds) would have the potential to result in higher available fault current values that could trip the feeder breaker for the affected MOVs. In addition, the team was concerned because the AOPs revisions in effect at the time of this inspection (i.e., Revision 27 of LOA-FX-101 and Revision 29 of LOA-FX-201)did not include instructions to verify that the feeder breakers were closed for all of the affected MOVs based on the conclusions of analysis L-004017. The team further noted that the AOPs required operators to open valves 1E51-F019 and 2E52-F019 as part of the expected response for a safe shutdown with a fire in the MCR and the AOPs did not include alternative instructions in the event these valves could not be opened.

In addition, the AOPs required operators to open valve 1E15-F059 if RCIC flow was not within the expected range. Thus, the team determined that the inability to operate these values would not be within the bounds of the AOPs for a safe shutdown with a fire in the MCR.

The licensee captured the team concerns in their CAP as AR 02668854. The immediate corrective actions included revising Standing Order S14-09 to establish compensatory actions to reset the affected breakers, if required. The licensee proposed plan to restore compliance at the time of this inspection was to revise the AOPs to reset the affected breakers, if required.

Analysis:

The team determined that the licensees failure to ensure that procedures were in effect to implement the alternate shutdown capability was contrary to LaSalle County Station Operating License conditions for the Fire Protection Program and was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Mitigating Systems Cornerstone attribute of protection against external events (fire), and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the failure to ensure that procedures were in effect to transfer RCIC control from the MCR to the RSP in the event of an MCR fire does not ensure the alternate shutdown capability of RCIC.

The team determined the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, issued on June 19, 2012. Because the finding affected the ability to reach and maintain safe shutdown conditions in case of a fire, the team screened the finding through IMC 0609, Appendix F, Fire Protection Significance Determination Process, issued on September 20, 2013, using Attachment 1, Part 1:

Fire Protection SDP Phase 1 Worksheet, issued on September 20, 2013. The finding screened as of very-low safety significance (Green) because it was assigned a low degradation factor based on the criteria in IMC 0609, Appendix F, Attachment 2, Degradation Rating Guidance, issued on February 28, 2005. Specifically, the team assigned a low degradation factor because the procedural deficiencies could be compensated by operator experience/familiarity and the fact that the procedure included steps to verify other breakers at the same MCCs were closed.

The team determined that this finding had a cross cutting aspect in the area of problem identification and resolution because the licensee failed to take effective corrective actions. Specifically, AR 02424674 included actions to revise the affected AOPs to include verifying all the RCIC MOVs supplied breakers were closed to correct an issue identified on 2014. However, the licensee failed to include all of the MOVs in the revised AOPs. [P.3]

Enforcement:

License conditions 2.C.25 and 2.C.15 of the LaSalle County Station, Unit 1 and Unit 2 Operating Licenses, respectively, require, in part, that the licensee implement and maintain all provisions of the approved Fire Protection Program as described in the UFSAR for LaSalle County Station, and as approved in NUREG-0519, Safety Evaluation Report, dated March 1981 through Supplement No. 8 and all associated amendments. The license conditions also indicate that the licensee may make changes to the approved Fire Protection Program without prior approval of the NRC only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

LaSalle Comparison to 10 CFR Part 50, Appendix R, in Revision 7 of the Fire Protection Program, Section 3, stated in the 10 CFR 50 Appendix column that The shutdown capability for specific fire areas may be unique for each such area, or it may be one unique combination of systems for all such areas. It also stated In either case, the alternative shutdown capability shall be independent of the specific fire area(s) and shall accommodate post fire conditions where offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In addition, it stated Procedures shall be in effect to implement this capability. The LaSalle Conformance column stated Comply, specific post fire safe shutdown procedures have been developed for the Control Room and AEER. LOA-FX-101(201).

Contrary to the above, from December 12, 2015, to at least May 13, 2016, the licensee failed to have procedures in effect to implement the alternative shutdown capability for a fire area where alternative shutdown capability was established. Specifically, the safe shutdown procedures developed for the MCR, a fire area, (i.e., Revision 27 of LOA-FX-101 and Revision 29 of LOA-FX-201) did not include instructions for verifying that the supply breakers for all RCIC MOVs susceptible to fire-induced failures were closed to ensure the successful operation of the RCIC system, which is the credited alternate shutdown system in the event of a fire in the MCR.

The licensee is still evaluating its planned corrective actions. However, the team determined that the continued non-compliance does not present an immediate safety concern because the licensee established compensatory actions to reset the affected breakers, if required.

Because this violation was of very low safety significance (Green) and was entered into the licensees CAP as AR02668854, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy. (NCV 05000373/2016007-04; 05000374/2016007-04, Alternate Shutdown Procedures Failed to Ensure RCIC MOVs Supply Breakers Were Closed)

4OA6 Management Meetings

.1 Exit Meeting Summary

On May 13, 2016, the team presented the inspection results to Mr. Trafton, Site Vice President, and other members of the licensee staff. The licensee acknowledged the issues presented. The team asked the licensee whether any materials examined during the inspection should be considered proprietary. Several documents reviewed by the team were considered proprietary information and were either returned to the licensee or handled in accordance with NRC policy on proprietary information.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

W. Trafton, Site Vice President

H. Vinyard, Plant Manager

J. Kowalski, Engineering Director

J. Keenan, Operations Director

V. Shah, Engineering Deputy Director

G. Ford, Regulatory Assurance Manager

M. Chouinard, Design Engineer

P. Patel, Electrical Engineer

A. Ahmad, Design Engineer

D. Murray, Regulatory Assurance Engineer

U.S. Nuclear Regulatory Commission

M. Jeffers, Chief, Engineering Branch 2

N. Féliz Adorno, Senior Reactor Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000373/2016007-01; NCV Failure to Monitor the Fouling Conditions of the CSCS

05000374/2016007-01 Equipment Area Coolers (Section 1R21.3.b(1))

05000373/2016007-02; NCV Failure to Ensure that Both Feed Supply Breakers for

05000374/2016007-02 Swing DG Components Were Closed During Normal Plant Operation (Section 1R21.3.b(2))

05000373/2016007-03; NCV Inadequate Procedures for Containment Debris

05000374/2016007-03 Management (Section 1R21.4.b(1))

05000373/2016007-04; NCV Alternate Shutdown Procedures Failed to Ensure RCIC

05000374/2016007-04 MOVs Supply Breakers Were Closed (Section 4OA2.b(1))

Discussed

None