IR 05000382/2017011

NRC Special Inspection Report 05000382/2017011

ML17354A690
Person / Time
Site:	Waterford
Issue date:	12/20/2017
From:	Geoffrey Miller NRC/RGN-IV/DRP/RPB-D
To:	Dinelli J Entergy Operations
Miller G
References
IR 2017011
Download: ML17354A690 (46)

Text

ecember 20, 2017

SUBJECT:

WATERFORD STEAM ELECTRIC STATION, UNIT 3 - NRC SPECIAL INSPECTION REPORT 05000382/2017011

Dear Mr. Dinelli:

On July 31, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed its initial assessment of a reactor trip and subsequent loss of offsite power, which occurred on July 17, 2017, using Management Directive 8.3. Based on this initial assessment, the NRC sent a special inspection team to your site on August 7, 2017.

On November 9, 2017, the NRC team discussed the results of this inspection with you and other members of your staff. The results of this inspection and the Management Directive 8.3 assessment are documented in the enclosed report.

NRC inspectors documented four findings of very low safety significance (Green) in this report.

Three of these findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC resident inspector at the Waterford Steam Electric Station, Unit 3.

If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV, and the NRC resident inspector at the Waterford Steam Electric Station, Unit 3. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Geoffrey Miller, Branch Chief Projects Branch D Division of Reactor Projects Docket No. 50-382 License No. NPF-38 Enclosure:

Inspection Report 05000382/2017011 w/ Attachments:

1. Supplemental Information 2. Management Directive 8.3 Screening 3. Memorandum to Chris Speer dated August 1, 2017

ML17354A690 SUNSI Review: ADAMS: Non-Publicly Available Non-Sensitive Keyword:

By: JDixon/rdr Yes No Publicly Available Sensitive NRC-002 OFFICE RI:DRP/D RIV:DRS/EB2 SPE:DRP/D SRA:DRS BC:DRP/D NAME CSpeer NOkonkwo JDixon DLoveless GMiller SIGNATURE /RA/ /RA-E/ /RA/ /RA-E/ /RA/

DATE 12/19/17 12/15/17 12/18/17 12/20/17 12/20/17

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 05000382 License: NPF-38 Report: 05000382/2017011 Licensee: Entergy Operations, Inc.

Facility: Waterford Steam Electric Station, Unit 3 Location: 17265 River Road Killona, LA 70057 Dates: August 7 through August 11, 2017 Inspectors: Christopher Speer, Resident Inspector (Team Leader)

Nnaerika Okonkwo, Reactor Inspector David Loveless, Senior Reactor Analyst Approved By: Geoffrey Miller Chief, Project Branch D Division of Reactor Projects Enclosure

SUMMARY

IR 05000382/2017011; 08/07/2017 - 08/11/2017; Waterford Steam Electric Station, Unit 3;

Special Inspection Report.

The inspection activities described in this report were performed between August 7, 2017, and August 11, 2017, by the resident inspector at Waterford 3 and an inspector from the NRCs Region IV office. Four findings of very low safety significance (Green) are documented in this report. Three of these findings involved violations of NRC requirements. The significance of inspection findings is indicated by their color (i.e., Green, greater than Green, White, Yellow, or Red), determined using Inspection Manual Chapter 0609, Significance Determination Process, dated April 29, 2015. Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, Aspects within the Cross-Cutting Areas, dated December 4, 2014. Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, dated July 2016.

Cornerstone: Initiating Events

Green.

The inspectors reviewed a self-revealed, non-cited violation of Technical Specification 3.0.1 involving the failure to maintain at least two physically independent circuits between the offsite transmission network and the onsite Class 1E distribution system operable in Modes 1 through 4 as required by Technical Specification 3.8.1.1, A.C.

Sources. Specifically, the licensee implemented an inadequate design change that prevented the fast bus transfer between the unit auxiliary transformers and the startup transformers from occurring. As a result, following a manual trip of the main generator on July 17, 2017, the fast bus transfer failed and a loss of offsite power to the 6.9 kV and the 4.16 kV electrical busses. The licensee entered the condition into their corrective action program as Condition Report CR-WF3-2017-05842. The corrective action taken to restore compliance was to install the previous style relays used prior to the design change and to install a suppression diode to eliminate the induced voltage surge transient.

The performance deficiency was more than minor, and therefore a finding, because it adversely affected the design control attribute of the Initiating Events Cornerstone and its objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the licensees inadequate plant modification resulted in the licensees inability to maintain offsite power following a trip of the main generator. The inspectors screened the finding in accordance with Inspection Manual Chapter 0609, Significance Determination Process, Appendix A,

The Significance Determination Process (SDP) for Findings At-Power. Inspection Manual Chapter 0609, Appendix A, Exhibit 1, Initiating Events Screening Questions, required a detailed risk evaluation because the finding involved the complete loss of a support system that caused an initiating event and affected mitigation equipment. The detailed risk evaluation determined that the finding is of very low safety significance (Green). The senior reactor analyst calculated the incremental core damage frequency to be 4.57E-7/year. The analyst also determined the impact to large early release frequency to be negligible.

The inspectors determined that the finding did not have a cross-cutting aspect because it did not reflect current licensee performance. Specifically, the design change procedure used to implement the inadequate plant modification, Procedure EN-DC-115, Engineering Change Process, Revision 18, is not currently in use at the site. The inspectors found that the current plant procedure for design changes, Procedure IP-ENG-001, Standard Design Process, Revision 0, contained significantly more guidance for design considerations, specifically for critical characteristics. (Section 3.11)

Green.

The inspectors reviewed a self-revealed finding that occurred because the licensee did not follow procedural guidance when performing periodic maintenance on the main transformer isophase buses. Specifically, the licensee did not implement portions of the procedure to check for tightness of the isophase bus bolted connections as required by Procedure ME-004-004, Isophase Bus Maintenance and Inspection, Revision 302. The licensee entered this condition into their corrective action program as Condition Report CR-WF3-2017-05857. The licensees corrective actions included tightening the bolted connections associated with all of the main transformer isophase busses and revising Procedure ME-004-004 to remove the note allowing for the step to not be performed.

The performance deficiency was more than minor, and therefore a finding, because it adversely affected the human performance attribute of the Initiating Events Cornerstone and its objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the failure to ensure the appropriate tightness of the isophase bus bolted connection led to an electrical fault that required a manual trip of the main generator. The inspectors screened the finding in accordance with Inspection Manual Chapter 0609, Significance Determination Process, dated April 29, 2015. Using Inspection Manual Chapter 0609, Appendix A, Exhibit 1,

Initiating Events Screening Questions, the inspectors determined the finding to be of very low safety significance (Green) because the finding did not cause a reactor trip and the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition.

The finding had a conservative bias cross-cutting aspect in the human performance area because individuals did not use decision making practices that emphasized prudent choices over those that are simply allowable. Specifically, when faced with unclear procedural guidance, licensee personnel did not question the validity of their actions and accepted them as allowable [H.14]. (Section 3.11)

Cornerstone: Barrier Integrity

Green.

The inspectors identified a non-cited violation of Technical Specification 6.8,

Procedures and Programs, associated with the licensees failure to implement procedures for abnormal, off-normal, or alarm conditions. Specifically, on July 17, 2017, the licensee exited off-normal Procedure OP-901-513, Spent Fuel Pool Cooling Malfunction,

Revision 21, without addressing the conditions that required entry into that procedure. The licensee entered this condition into their corrective action program as Condition Report CR-WF3-2017-06617. The licensee restored the spent fuel pool water inventory to above the required level and took corrective action to complete a performance review to identify areas for additional operator training.

The performance deficiency was more than minor, and therefore a finding, because it adversely affected the human performance attribute of the Barrier Integrity Cornerstone and its objective to provide reasonable assurance that physical design barriers protect the public from radionuclide releases caused by accidents or events. Specifically, inappropriately exiting Procedure OP-901-513 reduced the licensees ability to address the low water level in the spent fuel pool to assure that sufficient water depth was available to protect the public from radionuclide release in the event of the rupture of an irradiated fuel assembly stored in the spent fuel pool consistent with the licensees safety analysis. The inspectors screened the finding in accordance with Inspection Manual Chapter 0609, Significance Determination Process, Appendix M, Significance Determination Process Using Qualitative Criteria, because the finding resulted in a loss of spent fuel pool water inventory decreasing below the minimum analyzed level limit specified in the site-specific licensing basis. The regional senior reactor analyst determined that the minimum analyzed spent fuel pool level limit was based on the minimum level for a fuel handling accident. The licensee was not moving fuel during the exposure period of the performance deficiency. Therefore, the analyst determined using qualitative methods that the change in risk from the performance deficiency was of very low safety significance (Green).

The finding had a challenge the unknown cross-cutting aspect in the human performance area because individuals did not stop when faced with uncertain conditions and risks were not evaluated and managed before proceeding. Specifically, operations personnel did not challenge the decision to exit Procedure OP-901-513 without taking actions to address the low level condition in the spent fuel pool despite the spent fuel pool low level alarm being received and low level being verified locally by field operators. Further, operations personnel did not evaluate or manage the risk associated with allowing the loss of spent fuel pool inventory to continue unaddressed [H.11]. (Section 3.11)

Green.

The inspectors identified a non-cited violation of 10 CFR 50.65, paragraph (a)(2),

Requirements for Monitoring the Effectiveness of Maintenance of Nuclear Power Plants, because the licensee did not demonstrate that performance of components were being effectively controlled through appropriate preventive maintenance, and did not monitor the performance of the component against licensee-established goals to provide reasonable assurance that the component was capable of fulfilling its intended function. Specifically, the licensee failed to demonstrate that performance of the spent fuel pool cooling and purification valves were being effectively controlled through the performance of appropriate preventive maintenance, and the licensee did not monitor their performance against established goals. The licensee entered this issue into their corrective action program as Condition Report CR-WF3-2017-06542. Planned corrective actions include evaluating functional failures of the cooling and purification system valves against the established maintenance rule functional failure criteria and establishing new preventive maintenance strategies for the valves.

The performance deficiency was more than minor, and therefore a finding, because it adversely affected the structures, systems, and components performance attribute of the Barrier Integrity Cornerstone and its objective to provide reasonable assurance that physical design barriers protect the public from radionuclide releases caused by accidents or events.

Specifically, the failure to demonstrate that the performance of spent fuel pool cooling and purification valves were being effectively controlled through preventive maintenance resulted in reduced reliability. The inspectors screened the finding in accordance with Inspection Manual Chapter 0609, Significance Determination Process, Appendix M, Significance Determination Process Using Qualitative Criteria, because the finding resulted in a loss of spent fuel pool water inventory decreasing below the minimum analyzed level limit specified in the site-specific licensing basis. The regional senior reactor analyst determined that the minimum analyzed spent fuel pool level limit was based on the minimum level for a fuel handling accident. The licensee was not moving fuel during the exposure period of the performance deficiency. The analyst determined using qualitative methods that the change in risk from the performance deficiency was of very low safety significance (Green).

The finding had an evaluation cross-cutting aspect in the problem identification and resolution area because the organization did not thoroughly evaluate issues to ensure that resolutions address causes and extent of condition commensurate with their safety significance. Specifically, the evaluations associated with prior failures of the spent fuel pool purification valves never thoroughly evaluated the issues or questioned the maintenance of the valves that caused repeated leaks from the spent fuel pool [P.2]. (Section 3.11)

REPORT DETAILS

1.0 Special Inspection Scope The NRC conducted this special inspection to better understand the facts and circumstances surrounding the failure of the fast bus transfer circuitry and subsequent loss of offsite power following a manual turbine trip on July 17, 2017. This inspection reviewed information regarding the fault in the switchyard that led to a manual turbine trip, the failure of the fast bus transfer following the turbine trip that led to the loss of offsite power to the 6.9 kV and the 4.16 kV electrical busses and a resulting automatic reactor trip. Other additional equipment issues that arose complicating operators response to the event involved a valve leak leading to the loss of spent fuel pool inventory, the failure a rupture disk associated with main feed pump B, a rupture of fire protection piping, and a leak associated with the instrument air system. The inspectors used NRC Inspection Procedure 93812, Special Inspection Procedure, to conduct the inspection.

A list of specific documents the inspectors reviewed is provided in Attachment 1. The Management Directive 8.3 risk evaluation for the event is provided in Attachment 2. The charter for the special inspection is provided in Attachment 3.

2.0 System and Event Description 2.1 System Description During normal full power operations, the licensees main generator is used to energize the unit auxiliary transformers, which power the 6.9 kV and the 4.16 kV nonsafety-related electrical buses and their associated loads at the site. The nonsafety 6.9 kV electrical buses provide power to many large loads, including the reactor coolant pumps.

The nonsafety 4.16 kV electrical buses power several nonsafety loads and provide the power source for the 4.16 kV safety-related electrical buses.

The design of the onsite ac distribution provides an automatic bus transfer of both the 6.9 kV and the 4.16 kV nonsafety-related electrical buses and their associated loads from the unit auxiliary transformers to the startup transformers in the event of a loss of electrical power from the main generator to the unit auxiliary transformers. This automatic bus transfer helps to ensure that the safety-related electrical loads will maintain a source of offsite power following a trip of the main generator. The feature is required per 10 CFR Part 50, Appendix A, General Design Criterion 17, Electrical Power Systems, and the licensees Updated Final Safety Analysis Report to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by unit.

If the fast bus transfer from the unit auxiliary transformers to the startup transformers does not happen in a short period of time following the loss of power to the unit auxiliary transformers, equipment damage can result. To protect against this, the fast bus transfer system is equipped with timing relays to prevent the fast bus transfer if conditions warrant. If the fast bus transfer does not occur, the 6.9 kV and the 4.16 kV nonsafety-related electrical buses will lose power. Under those conditions, the emergency diesel generators provide power to the 4.16 kV safety-related electrical busses and their associated loads.

2.2 Event Description On July 17, 2017, control room operators received a report from field operators of arcing observed from a main transformer bus duct. As part of their response, control room operators manually tripped the main turbine and generator. Following the turbine trip, the circuit breakers associated with the unit auxiliary transformers automatically opened as designed, but the fast bus transfer to automatically close the circuit breakers associated with the startup transformers failed. This failure resulted in a loss of offsite electrical power to the safety-related and nonsafety-related ac electrical buses. The loss of power caused the reactor coolant pumps to trip and the reactor automatically tripped as designed due to the tripped reactor coolant pumps. Following the failure of the fast bus transfer both emergency diesel generators started and loaded the safety-related electrical busses.

A detailed chronology of the event is provided in Section 3.2 of this report.

2.3 Preliminary Significance The NRC staff considered the deterministic criteria established in NRC Management Directive 8.3, NRC Incident Investigation Program, to determine whether a special inspection would be performed. The NRC staff determined that two deterministic criteria were met:

(1) the failure of the fast bus transfer system involved significant unexpected system interactions; and

(2) the failure of the fast bus transfer system involved a repetitive failure of safety-related equipment.

An NRC senior risk analyst performed a preliminary risk assessment and determined the conditional core damage probability was within the overlap region for a special inspection or an augmented inspection. Based on meeting the deterministic criteria and the estimated incremental conditional core damage probability, the NRC determined that a special inspection was appropriate to further examine the circumstances surrounding the event.

3.0 Special Inspection Items The inspectors performed data gathering and fact-finding to address items from the special inspection charter, which is included in Attachment 3 of this report:

3.1 Provide a recommendation to Region IV management as to whether the inspection should be upgraded to an augmented inspection team response. This recommendation should be provided by the end of the first day on site.

a. Inspection Scope

The inspectors reviewed available information and documentation on the event from July 17, 2017, through July 21, 2017, to determine whether the special inspection should be upgraded to an augmented inspection team response. This included a review of logs and condition reports as well as interviews with engineering and operations personnel.

b. Observations and Findings

The inspectors determined that a special inspection team provided adequate expertise necessary to review the event and an augmented inspection team was not warranted.

Additionally, no new information was identified that would lead to an increase in the risk significance documented in the initial Management Directive 8.3 evaluation.

No findings were identified.

3.2 Develop a chronology of the event and operator response.

a. Inspection Scope

The inspectors reviewed available information and documentation of the event to develop a chronology. This included a review of facility logs, event notifications, condition reports, and event recorders as well as interviews with engineering, operations, and regulatory assurance personnel. The inspectors also reviewed communications made by the facility to the NRC.

b. Observations and Findings

The inspectors developed the following chronology of events and operator responses, including significant equipment failures during the event:

July 17, 2017, 3:57 p.m. - Operators in the turbine building report that main transformer B isophase bus duct is glowing orange with electrical arcing observed.

July 17, 2017, 4:03 p.m. - The site fire brigade is dispatched to respond to the reported condition on main transformer B.

July 17, 2017, 4:06 p.m. - Control room operators perform a manual trip of the main turbine due to the condition reported on main transformer B. Initially, a reactor cutback is received as expected with the proper pattern of rod insertion observed.

However, soon after the manual turbine trip, a loss of offsite power to the 6.9 kV and the 4.16 kV electrical busses results in all reactor coolant pumps tripping, causing a reactor trip. Both emergency diesel generators A and B automatically start and provide electrical power to the safety-related electrical busses.

July 17, 2017, 4:07 p.m. - Control room operators enter Emergency Operating Procedure OP-902-000, Standard Post Trip Actions, Revision 16, to respond to the reactor trip. Additionally, the operators enter off-normal Procedure OP-901-513, Spent Fuel Pool Cooling Malfunction, Revision 21, due to the spent fuel pool cooling system securing following the loss of offsite power. The calculated spent fuel pool time to boil is 31 hours3.587963e-4 days <br />0.00861 hours <br />5.125661e-5 weeks <br />1.17955e-5 months <br /> in accordance with Procedure OP-901-513.

July 17, 2017, 4:17 p.m. - The licensee declares an Unusual Event in anticipation of the loss of offsite power for greater than 15 minutes, in accordance with Procedure EP-001-001, Recognition & Classification of Emergency Conditions, Revision 32.

July 17, 2017, 4:22 p.m. - The fire brigade leader reports that the fire on main transformer B isophase bus duct is extinguished.

July 17, 2017, 4:30 p.m. - Control room operators take manual control of the emergency feedwater system flow control valves to reduce flow to the steam generators due to potential overcooling concerns.

July 17, 2017, 4:37 p.m. - Control room operators enter Emergency Operating Procedure OP-902-003, Loss of Offsite Power/Loss of Forced Circulation, Revision 10, due to the event.

July 17, 2017, 4:58 p.m. - Operators in the turbine building report that fire main 20 (FPM-20) in the turbine building is ruptured.

July 17, 2017, 5:07 p.m. - The spent fuel pool low level alarm is received in the control room. Operators in the field verify locally that the spent fuel pool is at low level.

July 17, 2017, 5:19 p.m. - Operators in the turbine building report that the isolation valve associated with FPM-20 was closed locally and that the piping rupture is secured.

July 17, 2017, 5:29 p.m. - Operators in the turbine building report that the main feedwater pump B exhaust rupture disk is ruptured, resulting in a large steam leak in the turbine building.

July 17, 2017, 5:42 p.m. - Control room operators close instrument air valve IA-4442 to isolate an instrument air leak in the turbine building.

July 17, 2017, 6:31 p.m. - Operators verify proper operation of electrical equipment, and nonsafety-related electrical busses 1A and 2A are energized from offsite power in accordance with Procedure OP-902-009, Standard Appendices, Revision 317.

July 17, 2017, 6:44 p.m. - Safety-related electrical bus 3A is energized by offsite power via nonsafety-related electrical bus 2A, the normal electrical lineup.

July 17, 2017, 6:54 p.m. - Emergency diesel generator A is secured.

July 17, 2017, 7:44 p.m. - Operators verify proper operation of electrical equipment, and nonsafety-related electrical busses 1B and 2B are energized from offsite power in accordance with Procedure OP-902-009, Standard Appendices, Revision 317.

July 17, 2017, 7:56 p.m. - Control room operators start spent fuel pool cooling pump A and exit Procedure OP-901-513, Spent Fuel Cooling Malfunction. Spent fuel pool level is not restored.

July 17, 2017, 8:07 p.m. - Safety-related electrical bus 3B is energized by offsite power via nonsafety-related electrical bus 2B, the normal electrical lineup.

July 17, 2017, 8:15 p.m. - Emergency diesel generator B is secured.

July 17, 2017, 8:56 p.m. - The licensee secures from the Unusual Event declaration since offsite power was restored to the safety-related electrical busses.

July 18, 2017, 12:02 a.m. - Control room operators commence filling the spent fuel pool from the refueling water storage pool.

July 18, 2017, 1:28 a.m. - Control room operators secure emergency feedwater pumps A and B and restore the emergency feedwater system to its standby lineup due to the auxiliary feedwater system being placed in service.

July 18, 2017, 02:24 a.m. - Spent fuel pool level rises to above 43 feet 9 inches mean sea level and the spent fuel pool low level alarm clears.

July 18, 2017, 6:30 a.m. - Main feedwater pump B is isolated, securing the steam leak from the failed rupture disc.

Operator response is discussed in further detail in Section 3.3 of this report. Equipment failures are discussed in further detail in Sections 3.5 through 3.9 of this report.

No findings were identified.

3.3 Review and assess the adequacy of operator response to the event, including compliance with technical specifications, emergency action levels, and reporting requirements.

a. Inspection Scope

The inspectors reviewed technical specifications and bases, log entries, NRC notifications, condition reports, design calculations, off-normal and emergency operating procedures, and interviewed operations to assess the operator response to the event to review and assess operator response.

b. Observations and Findings

(1) Technical Specifications Technical Specification 3.9.11, Water Level - Spent Fuel Pool, requires at least 23 feet of water be maintained over the top of irradiated fuel assemblies seated in the storage racks of the spent fuel pool. The inspectors noted this requires spent fuel pool level to be maintained at approximately 42 feet 9 inches above mean sea level. Technical Specification 3.9.11 further requires that if this water level requirement is not met, that the water level be restored above the required level within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

Following the loss of offsite power to the 6.9 kV and the 4.16 kV electrical busses at 4:06 p.m. on July 17, 2017, water inventory from the spent fuel pool began leaking past the fuel pool purification pump discharge isolation valve FS-318 to the refueling water storage pool. At 5:07 p.m. the Fuel Pool Level Low annunciator alarmed in the control room, alerting operations personnel to the lowering spent fuel pool level. This alarm occurs when the level in the pool lowers to 43 feet 9 inches above mean sea level.

Spent fuel pool level lowered from approximately 44 feet mean sea level to 42 feet 3 inches mean sea level before a source of makeup inventory was established.

The inspectors also noted that control room operators entered off-normal Procedure OP-901-513, Spent Fuel Pool Cooling Malfunction, Revision 21, at 4:07 p.m. following the loss of offsite power event when the spent fuel pool cooling pumps became unavailable from the loss of power.

The Fuel Pool Level Low alarm that was received in the control room at 5:07 p.m.,

which is also an entry condition for Procedure OP-901-513. The procedure requires that, if the spent fuel pool level lowers below the low level alarm setpoint, makeup inventory to the spent fuel pool be established. The operators exited Procedure OP-901-513 at 7:56 p.m. when power was restored to cooling pump A and it was started to provide cooling to the spent fuel pool. Operators did not establish makeup inventory to the spent fuel pool until 12:02 a.m. on July 18, 2017.

During their response to the event, the licensee did not recognize that the spent fuel pool water level requirement of Technical Specification 3.9.11 was not met. However, the required action of Technical Specification 3.9.11 to restore water inventory to the required level was met within its allowed outage time. The inspectors determined that the Technical Specification 3.9.11 water level requirement was not met from approximately 9:08 p.m. on July 17, 2017, until approximately 12:25 a.m. on July 18, 2017. The licensee entered this condition into their corrective action program as Condition Report CR-WF3-2017-06539.

The inspectors concluded that the control room operators did not recognize that the separate spent fuel pool low level entry condition was met but not addressed when they exited Procedure OP-901-531 at 7:56 p.m. after cooling flow was restored. The licensee entered this condition into their corrective action program as Condition Report CR-WF3-2017-06617. The inspectors documented a finding related to this issue in Section 3.11 of this report.

(2) Emergency Action Levels At 4:06 p.m. on July 17, 2017, the site experienced a loss of offsite power to the 6.9 kV and the 4.16 kV electrical busses due to the failure of the fast bus transfer circuitry. At 4:17 p.m., the shift manager declared an Unusual Event due to the loss of offsite power in accordance with Procedure EP-001-001, Recognition & Classification of Emergency Conditions, Revision 32. Specifically, the Unusual Event was declared because initiating condition SU1, the loss of all offsite ac power to safety busses for greater than 15 minutes, was anticipated to be met. The shift manager secured from the Unusual Event at 8:56 p.m. after offsite power was restored to the safety busses.

The inspectors determined this declaration was appropriate and did not identify any emergency plan declarations or action levels that were not entered when required.

No findings were identified.

(3) Reporting Requirements The inspectors reviewed NUREG-1022, Event Reporting Guidelines, 10 CFR 50.72 and 50.73, Revision 3, and the emergency notifications that the licensee reported to the NRC as required by 10 CFR 50.72 following the reactor trip on July 17, 2017. The inspectors also reviewed the circumstances surrounding the updated event report submitted at 9:03 p.m. notifying the NRC that the Unusual Event was terminated due to the restoration of offsite power.

No findings were identified.

3.4 Review the current status of the licensees root cause determination effort to determine whether it is being conducted at a level of detail commensurate with the event, including review of relevant plant-specific and industry (foreign and domestic) operating experience.

a. Inspection Scope

The failure of the fast bus transfer was entered into the licensee corrective action program as Condition Report CR-WF3-2017-05842. The licensee classified the condition report as a Category A, which requires a root cause evaluation. The inspectors interviewed personnel assigned to perform the evaluation and available documentation.

b. Observations and Findings

The inspectors determined that the licensees root cause evaluation was being conducted at a level of detail commensurate with the safety significance of the problem.

The licensee found that the direct cause of the failure of the installed Struthers-Dunn timing relays in the fast bus transfer circuit was an induced voltage transient caused by a separate relay (152X) in the circuit. The de-energization of the 152X relay produced a large change in voltage that, because surge suppression was not utilized, caused the Struthers-Dunn timing relays to instantaneously time out and open their contacts, which prevented the fast bus transfer. The Struthers-Dunn relays were installed during the licensees April 2017 refueling outage. Prior to their installation, Allen Bradley timing relays were used which contained integrated surge suppression. The surge suppression allowed the Allen Bradley timing relays to mitigate the voltage transient produced by the 152X relay, which permitted the fast bus transfer to operate successfully.

The licensee considered the root cause of the fast bus transfer failure to be a deficient design change modification implemented on the fast bus transfer circuitry to replace the Allen Bradley timing relays with Struthers-Dunn timing relays. That design change did not consider surge suppression as a critical relay characteristic.

The inspectors determined through interviews that the licensees cause evaluation appropriately reviewed plant-specific, domestic, and foreign industry operating experience, such as the 2015 partial loss of offsite power event at Waterford and a similar loss of offsite power event at Catawba Nuclear Station. The inspectors confirmed that the operating experience search considered events broadly impacting dc relays rather than only those specific to fast bus transfers or loss of offsite power events.

No findings were identified.

3.5 Review the circumstances associated with the failure of the fast bus transfer circuit for potential common failure modes and generic safety concerns.

a. Inspection Scope

The inspectors reviewed condition reports, logs, design calculations, and drawings to review all of the circumstances associated with the fast bus transfer failure. The inspectors also interviewed station engineering personnel and reviewed the status of the licensees apparent cause analysis, maintenance program, and industry guidance to assess potential common mode failures and generic safety concerns.

b. Observations and Findings

Both trains of the fast bus transfer system failed from a common failure mode. The de-energization of a separate dc relay in the fast bus transfer circuit, the 152X relay, induced a large voltage transient that affected the performance of the Struthers-Dunn timing relays and caused them to instantly change states, preventing the fast bus transfer from occurring.

Induced voltage surges are a known and understood occurrence; however, the inspectors found that the licensee did not consider this effect during the design change to replace the Allen Bradley timing relays with Struthers-Dunn timing relays within the fast bus transfer circuit. Additional details concerning this design change are provided in Section 3.6 of this report. The inspectors determined that the Struthers-Dunn timing relays are not used in other applications in the plant.

The inspectors noted that Allen Bradley, the manufacturer of the 152X relay, previously issued a technical bulletin regarding relays of the same design as the 152X relay. The technical bulletin identified that these relays can produce an induced voltage surge effect of up to 1000 Vdc when de-energizing. In other similar applications at the site, the licensee eliminated the effect of this surge by installing a suppression diode across the relay coils to eliminate the induced voltage.

The inspectors concluded that the issue did have potential generic implications. The issue was communicated to the Operating Experience Branch in the NRCs Division of Inspection and Regional Support to consider if any generic communications are warranted.

No findings were identified.

3.6 Review and assess the modification conducted under Engineering Change (EC) 63801 to replace the original Allen Bradley relays in the bus transfer circuit.

a. Inspection Scope

The inspectors reviewed EC 63801, Fast Bus Transfer Supervisory Circuit Indication/Relay Modification RF21 Modification - A Relays, and EC 64757, Fast Bus Transfer Supervisory Circuit Indication/Relay Modification RF21 Modification - B Relays, to assess the modification to replace the original Allen Bradley relays. The inspectors also reviewed licensee design change procedures, vendor technical manuals and technical bulletins, generic industry guidance, design calculations and drawings, and NRC generic communications and interviewed licensee personnel.

b. Observations and Findings

On July 18, 2016, the licensee approved EC 63801 and EC 64757 to replace the Allen Bradley 700RTC timing relays with Struthers-Dunn Type 237 timing relays. The replacement relays were installed in April 2017 during the licensees planned refueling outage that ended on June 2, 2017.

On July 17, 2017, following a manual trip of the main turbine due to an electrical fault related to a main transformer B isophase bus, the fast transfer of offsite electrical power from the unit auxiliary transformers to the startup transformers did not occur as designed. Per licensee Technical Specification 3.8.1.1, two physically independent offsite power circuits capable of supplying power to the onsite electrical distribution system are required to be operable for power operations.

The basis for Technical Specification 3.8.1.1 and Section 8.2 of the licensees Updated Final Safety Analysis Report require that the fast bus transfer system be operable for the offsite power circuits to be operable and to meet the requirements of General Design Criterion 17 of 10 CFR Part 50, Appendix A.

The inspectors determined that the licensees design change and associated design change procedures to replace Allen Bradley timing relays with Struthers-Dunn timing relays were inadequate. The licensee did not consider the effects of the induced voltage surge occurring in the circuit on the Struthers-Dunn timing relays compared to the Allen Bradley timing relays that were replaced.

Additionally, the licensee did not identify surge suppression as a critical characteristic of the timing relays as part of the modification. The Allen Bradley timing relays provided integrated surge suppression whereas the Struthers-Dunn timing relays did not. The lack of surge suppression for the replacement Struthers-Dunn timing relays prevented the fast bus transfer feature from performing its design function.

Due to the inadequate design change, the inspectors determined that the licensee did not maintain an operable offsite power system as required by Technical Specification 3.8.1.1.

The licensee entered this condition into their corrective action program as Condition Report CR-WF3-2017-05842. The inspectors documented a finding related to this issue in Section 3.11 of this report.

3.7 Review the licensees test program for periodic monitoring and maintenance of the fast bus transfer circuitry, including adequacy of original design implementation and the scope, periodicity, and results of past inspections.

a. Inspection Scope

The inspectors reviewed licensee maintenance procedures and records, vendor technical manuals and bulletins, and generic industry guidance to assess the licensees periodic testing and maintenance of the fast bus transfer circuitry. The inspectors also conducted interviews of licensee engineering and maintenance personnel.

b. Observations and Findings

The inspectors determined that the original design and periodic monitoring of the fast bus transfer circuit was inadequate. The inspectors concluded that the induced voltage surge transient that resulted in the instantaneous state-change of the Struthers-Dunn timing relays also affected the previously installed Allen Bradley timing relays, but was never considered during the design or testing of the fast bus transfer circuit. Due to the integrated surge suppression feature of the Allen Bradley timing relays, the induced voltage surge transient resulted in delayed operation of the previously installed Allen Bradley timing relays rather than the instantaneous state-change of the Struthers-Dunn timing relays.

Prior to July 17, 2017, the licensee bench tested the timing relays associated with the fast bus transfer circuit but never performed in-field timing tests. The licensees program credited the transfer of power from the unit auxiliary transformers to the startup transformers when going into refueling outages as a functional test of the relays, which tested the functional operation of the relays but not the timing. Because of the typically short time frame of fast bus transfers, the timeout function of the relays was not challenged by the licensees periodic operational test.

The inspectors determined that the failure to consider the induced voltage surge transient in the original design and testing of the fast bus failure circuit prior to the installation of the Struthers-Dunn timing relays as a violation of Technical Specification 6.8.1.a and the associated commitment to follow Regulatory Guide 1.33 recommendation 9.a to perform maintenance that could affect the performance of safety-related equipment with procedures that are appropriate to the circumstances. The inspectors determined the violation to be minor because there were no conditions when the fast bus transfer would have occurred slowly enough such that an inappropriately long timing of the relays could adversely affect the performance of mitigating system equipment. The licensee entered this condition into their corrective action program as Condition Report CR-WF3-2017-06750.

No findings were identified.

3.8 Review the additional equipment failures that occurred during the event to determine whether these failures increased the risk of the event and to assess whether licensee practices should have prevented these failures from occurring.

a. Inspection Scope

The inspectors reviewed logs, condition reports, design drawing and calculations, procedures, and interviewed personnel regarding equipment failures leading up to and following the July 17, 2017, event. The inspectors identified the following equipment failures that had the potential to increase the risk of the event.

b. Observations and Findings

(1) Isophase Bus Fault On July 17, 2017, the licensee tripped the main turbine to address reports of electrical arcing associated with the isophase buses leading to main transformer B. The licensee determined an apparent cause of the event to be loose bolted connections associated with the laminated flex links resulting in high electrical currents and the eventual failure of the isophase bus duct.

In their review, the inspectors found that the licensee did not perform adequate preventive maintenance consistent with site requirements to identify the loosening connections prior to failure.

The licensee entered this condition into their corrective action program as Condition Report CR-WF3-2017-05844. The inspectors documented a finding related to this issue in Section 3.11 of this report.

(2) Emergency Feedwater Flow Control During Refueling Outage 21 in April 2017, the licensee implemented a design change to the emergency feedwater system to address an issue where feedwater flow could become unstable and oscillate while in automatic control. Per the design change, the system would automatically operate in a level control mode rather than the previous flow control mode to provide emergency feedwater to the steam generators.

The July 17, 2017, event caused the main feedwater pumps to trip which resulted in lowering level in the steam generators. At 55 percent wide-range level in the steam generators, the emergency feedwater system automatically actuated as designed to provide feedwater to the steam generators. Per Procedure OP-902-000, Standard Post Trip Actions, Revision 16, operators were to maintain reactor coolant system cold leg temperature between 550 and 530 degrees Fahrenheit. While responding to the reactor trip in accordance with Procedure OP-902-000, cold leg temperatures fell below the 530 degrees Fahrenheit temperature limit. Control room operators took manual control of the emergency feedwater system to reduce feedwater flow to address potential overcooling concerns. Cold leg temperature reached a minimum of 516 degrees Fahrenheit before recovering to within the band given by the procedure.

Operators anticipated reactor coolant system cold leg temperatures reducing below the limit in Procedure OP-902-000 based on experience in the simulator and took manual control of the flow control valves within 1 minute of reactor coolant system cold leg temperature dropping below 530 degrees Fahrenheit. The inspectors noted that Procedure OP-902-000 ultimately directed operations personnel to Procedure OP-902-003, Loss of Offsite Power/Loss of Forced Circulation, Revision 10, to address the reactor trip. Procedure OP-902-003 does not set a lower limit on cold leg temperature. The inspectors determined the operator actions to take manual control of the emergency feedwater system were appropriate.

This issue was entered into the licensees corrective action program as Condition Report CR-WF3-2017-06067.

No findings were identified.

(3) Spent Fuel Pool Loss of Inventory During the event, the refueling water storage tank purification pump tripped. With the refueling water storage tank purification pump tripped, the spent fuel pool began leaking through the fuel pool purification pump discharge isolation valve (FS-318) to the refueling water storage pool.

The inspectors reviewed the licensees preventive maintenance strategy for valve FS-318 and its treatment under the licensees maintenance rule program. Valve FS-318 impacts the maintenance rule function to maintain an adequate water level in the spent fuel pool to keep dose rates at an acceptable level. The inspectors determined that the valve was treated as a run-to-failure valve in the licensees preventive maintenance program. The inspectors noted that because the valve was associated with a maintenance rule function, the designation as a run-to-failure valve was inappropriate.

The inspectors also noted that the licensee had not evaluated leakage through valve FS-318 as a potential maintenance rule functional failure despite being subject to the maintenance rule functional failure criteria.

The licensees evaluation identified four other valves that were inappropriately classified as run-to-failure components that required a preventive maintenance strategy to be developed, and the licensee three additional valves for which a different preventive maintenance strategy was needed. The valves are now subject to periodic diaphragm replacement. The licensee is also evaluating past failures of the spent fuel pool cooling and purification system valves to determine the appropriate treatment under the maintenance rule program.

The licensee entered this condition into their corrective action program as Condition Report CR-WF3-2017-06542. The inspectors documented a finding related to this issue in Section 3.11 of this report.

(4) Main Feed Pump B Rupture Disk Failure During the July 17, 2017, event, operations personnel identified that the rupture disc from the exhaust of main feedwater pump B to the main condenser had ruptured. The licensees evaluation showed that the loss of cooling and vacuum to the main condenser from the loss of offsite power caused pressure in the main condenser to rise to within the setpoint tolerance for the rupture disc. The licensee performed extent of condition walkdowns of the condenser and other associated rupture discs to verify that there were no additional impacts to plant equipment due to the elevated pressures and temperatures reached following the reactor trip.

The licensee determined that the rupture disc had been in service since initial plant operations. The inspectors reviewed the vendor documents and preventive maintenance basis documents and did not identify any applicable preventive maintenance tasks or replacement frequency for the rupture disc.

No findings were identified.

(5) Fire Protection Piping Rupture During the July 17, 2017, event, at 4:58 p.m., operators discovered a rupture in fire protection main 20 (FPM-20) piping. The isolation valve associated with FPM-20 actuated to fill the piping, which led operations personnel to discover the rupture in the normally-dry piping. The licensee determined that the isolation valve associated with FPM-20 opened due to the high temperature environmental conditions resulting from the failure of the main feed pump B rupture disk. The licensee manually isolated the fire protection main and terminated the rupture at 5:19 p.m.

The licensee determined the rupture of FPM-20 was due to corrosion from standing water in the piping left from a previous actuation. FPM-20 and the piping associated with the rupture is not required per the licensees technical requirements manual and is not credited in the licensees fire probabilistic risk assessment (PRA). However, there is normally-dry piping in other plant location exposed to a similar environment as FPM-20 that is subject to the licensees technical requirements manual and is credited in the licensees fire PRA. The licensee identified the fire piping subject to the technical requirements manual and credited in the licensees fire PRA which could be subject to the same failure and developed actions to check the extent of condition for potential corrosion in the similar normally-dry fire protection piping. The licensee plans to inspect the low points in all of the subject piping for corrosion via ultrasonic testing where feasible or internal visual inspection using a boroscope.

The licensee entered this condition into the corrective action program as Condition Report CR-WF3-2017-05836.

No findings were identified.

(6) Instrument Air Leak During the event, an instrument air leak was discovered on the shell drain tank 2B outlet reverse current valve (FHD-236B). Operators shut the instrument air isolation valve (IA-4442) for valve FHD-236B to isolate the leak. The inspectors determined that this leak did not significantly impact the licensees response to the event. Although operations personnel took action to isolate the leak, the leak was not of sufficient magnitude to reduce the capabilities of the instrument air system. The inspectors reviewed the maintenance strategies and vendor documents for both valves FHD-236B and IA-4442 and did not identify deficiencies in the licensees preventive maintenance for the components.

No findings were identified.

3.9 Review and assess the licensees prompt and long-term corrective actions. Assess compliance of repair activities and post-maintenance testing with industry standards and guidance.

a. Inspection Scope

The inspectors reviewed licensee interim corrective actions, vendor technical manuals and technical bulletins, and generic industry guidance, and interviewed licensee personnel. The inspectors also performed field walk-downs and reviewed design information.

b. Observations and Findings

For the fast bus transfer failure, the prompt corrective action taken by the licensee was to replace the Struthers-Dunn timing relays in the fast bus transfer system with Allen Bradley timing relays of the design used prior to their replacement, which included surge suppression. The licensee also installed a suppression diode across the 152X relay that was the source of the voltage transient to eliminate the induced voltage surge transient.

The licensee performed in-place timing tests to assure that the relays were actuating as designed.

The licensee intends to change the periodic testing of the fast bus transfer circuit to no longer take credit for the operational transfers done as part of shutdown for refueling outages as a functional test. As part of the repair activities following the event, the licensee developed a maintenance procedure for performing in-place timing tests of the timing relays used in the circuit, which served as the post maintenance test. A similar test will be used to periodically test the system. In their review, the inspectors did not identify noncompliances with industry standards or guidance.

For the isophase bus fault, the prompt corrective action taken by the licensee was to perform testing of all of the isophase buses and bus enclosures and to check the tightness of all bolted connections. The licensee also eliminated a procedural note that maintenance personnel used to forgo checking bolt tightness in the future. Additionally, the licensee intends to develop new periodic maintenance requirements to perform thermography of all of the isophase buses and bus enclosures.

No findings were identified.

3.10 Review and assess the corrective actions for any past similar failures at the site, such as the partial loss of offsite power event in 2015. Include vendor recommended actions to prevent such failures.

a. Inspection Scope

The inspectors reviewed condition reports, cause evaluations, corrective actions, and applicable vendor recommendations associated with the 2015 partial loss of offsite power at the site and failures of isophase bus bolted connections. The inspectors did not identify any other substantially similar failures at the site.

b. Observations and Findings

The inspectors determined that the 2015 failure was caused by premature degradation of the Allen Bradley timing relays used in the circuit at the time. In response, the licensee developed a 3-year replacement frequency rather than the industry-recommended generic 18-year replacement frequency for relays in similar applications.

The inspectors determined that the 2015 failure was different in nature than the cause of the July 17, 2017, event.

Additionally, in 1995 the site experienced a loss of offsite power caused by a switchgear fire resulting from an improper fast bus transfer with out of phase switching between the unit auxiliary transformer to the startup transformer. This failure was the basis for the modification that installed the timing relays in the fast bus transfer system. The inspectors did not consider it a similar failure because the fast bus transfer circuitry had a significantly different design at the time of the event.

No findings were identified.

3.11 Collect data necessary to support completion of the significance determination process for any associated findings.

a. Inspection Scope

The findings developed by the inspectors in the preceding sections are documented below. This involved interviews and reviewing licensee condition reports, logs, corrective actions, design drawings, design calculations, vendor manuals, vendor technical bulletins, industry guidance, and operating experience.

b. Observations and Findings

(1) Failure to Implement Off-normal Procedure for Low Spent Fuel Pool Inventory

Introduction.

The inspectors identified a Green, non-cited violation of Technical Specification 6.8.1.a associated with the licensees failure to implement procedures for abnormal, off-normal, or alarm conditions. Specifically, on July 17, 2017, the licensee exited off-normal Procedure OP-901-513, Spent Fuel Pool Cooling Malfunction, Revision 21, without performing the required actions to address the conditions that required entry into that procedure.

Description.

On July 17, 2017, control room operators entered off-normal Procedure OP-901-513, Spent Fuel Pool Cooling Malfunction, Revision 21, at 4:07 p.m. after the spent fuel pool cooling pumps became unavailable following the loss of power. Operators exited Procedure OP-901-513 at 7:56 p.m. when power was restored to spent fuel pool cooling pump A and it was restarted to provide cooling to the spent fuel pool.

Procedure OP-901-513 requires that makeup to the spent fuel pool be established when the spent fuel pool level lowers to 43 feet 9 inches above mean sea level and the Fuel Pool Level Low alarm is received. This alarm was received in the control room at 5:07 p.m. and operators verified the spent fuel pool low level condition locally.

Technical Specification 3.9.11, Water Level - Spent Fuel Pool, requires the licensee to maintain greater than 23 feet of water above irradiated fuel assemblies in the spent fuel pool. This requirement is also given in Section 9.1.3.1 of the licensees Updated Final Safety Analysis Report and the related design basis calculations. To meet the Technical Specification 3.9.11 requirement, water level must be maintained above approximately 42 feet 9 inches mean sea level.

Prior to re-establishing inventory to the pool, spent fuel pool water level dropped as low as approximately 42 feet 3 inches above mean sea level, which is 6 inches lower than the technical specification requirement. The operators did not recognize this condition and did not take action as directed by Technical Specification 3.9.11; however, the inspectors determined that the operators nonetheless restored the water level in the spent fuel pool to above the required level within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> as required by Technical Specification 3.9.11.

The inspectors also noted that Step 25 of Emergency Operating Procedure OP-902-003, Loss of Offsite Power/Loss of Forced Circulation Recovery, Revision 10, used for the July 17, 2017, loss of offsite power event directs operators, in part, to monitor the level in the spent fuel pool. The step specifically directs operators to refer to Procedure OP-901-513 for spent fuel pool alarms or abnormal conditions.

The inspectors concluded that the control room operators did not recognize that the low level condition had not been addressed after cooling to the spent fuel pool was established. The cooling pumps do not provide makeup capability to the spent fuel pool to restore level as required by Procedure OP-901-531. Operators did not take action to establish makeup to the spent fuel pool until approximately 12:02 a.m. when power was restored to the refueling water storage pool purification pump and it was started to restore spent fuel pool inventory.

Analysis.

The inspectors determined the failure to take actions to restore spent fuel pool level in accordance with Procedure OP-901-513 when required by plant conditions was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it adversely affected the human performance attribute of the Barrier Integrity Cornerstone and its objective to provide reasonable assurance that physical design barriers protect the public from radionuclide releases caused by accidents or events. Specifically, inappropriately implementing Procedure OP-901-513 reduced the licensees ability to promptly correct the low water level in the spent fuel pool to assure that sufficient water depth was available to protect the public from radionuclide release in the event of the rupture of an irradiated fuel assembly stored in the spent fuel pool consistent with the licensees safety analysis.

The inspectors screened the finding in accordance with Inspection Manual Chapter (IMC) 0609, Significance Determination Process. The inspectors determined that IMC 0609, Appendix G, Shutdown Operations Significance Determination Process, did not apply because although the performance deficiency occurred during shutdown, the licensee had not met the entry conditions for residual heat removal and residual heat removal cooling was not initiated. IMC 0609, Attachment 4, Table 3, SDP Appendix Router, directed the inspectors to IMC 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. IMC 0609, Appendix A, Exhibit 3, Barrier Integrity Screening Questions, directed the inspectors to use IMC 0609, Appendix M, Significance Determination Process Using Qualitative Criteria, because the finding resulted in a loss of spent fuel pool water inventory decreasing below the minimum analyzed level limit specified in the site-specific licensing basis.

The regional senior reactor analyst determined that the minimum analyzed spent fuel pool level limit was based on the minimum level for a fuel handling accident. The licensee was not moving fuel during the exposure period of the performance deficiency.

Therefore, the analyst determined using qualitative methods that the change in risk from the performance deficiency was of very low safety significance (Green).

The finding had a challenge the unknown cross-cutting aspect in the human performance area because individuals did not stop when faced with uncertain conditions and risks were not evaluated and managed before proceeding. Specifically, operators did not challenge the decision to exit Procedure OP-901-513 without taking actions to address the low level condition in the spent fuel pool despite the low level alarm and low level being verified locally by field operators. Further, operators did not evaluate or manage the risk associated with allowing the loss of pool inventory to continue unaddressed [H.11].

Enforcement.

Technical Specification 6.8.1.a, requires, in part, that procedures be established, implemented, and maintained covering, the applicable procedures recommended in Appendix A of Regulatory Guide 1.33, Revision 2. Regulatory Guide 1.33, Quality Assurance Program Requirements, Revision 2, Appendix A, Section 5, requires, in part, that procedures be established for abnormal, off-normal, or alarm conditions. The licensee established off-normal Procedure OP-901-513, Spent Fuel Pool Cooling Malfunction, Revision 21, to meet the Regulatory Guide 1.33 requirement. Step E2.1 of Procedure OP-901-521 requires, in part, that action be taken to restore water inventory when spent fuel pool level is less than the low level alarm setpoint.

Contrary to the above, on July 17, 2017, the licensee did not take action to restore water inventory when spent fuel pool level was less than the low level alarm setpoint as required by licensee off-normal Procedure OP-901-513. Specifically, the low level alarm setpoint was reached at 5:07 p.m. on July 17, 2017, and the licensee exited Procedure OP-901-513 at 7:56 p.m. without restoring water inventory in the spent fuel pool. As a result, the licensee allowed the water inventory to drop below the safety analysis limit of 23 feet of water above the irradiated fuel assemblies in the pool. The licensee entered this condition into their corrective action program as Condition Reports CR-WF3-2017-06617 and CR-WF3-2017-06542. The licensee restored water to above the required level and took corrective action to complete a performance review to identify areas for additional operator training.

Because this violation was of very low safety significance and the licensee entered the issue into their corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy:

NCV 05000382/2017011-01, Failure to Implement Off-normal Procedure for Low Spent Fuel Pool Inventory.

(2) Failure to Implement an Adequate Design Change for the Fast Bus Transfer System

Introduction.

The inspectors reviewed a self-revealed, Green noncited violation of Technical Specification 3.0.1 involving the failure to maintain at least two physically independent circuits between the offsite transmission network and the onsite Class 1E distribution system operable in Modes 1 through 4 as required by Technical Specification 3.8.1.1, A.C. Sources. Specifically, the licensee implemented an inadequate design change that prevented the fast bus transfer between the unit auxiliary transformers and the startup transformers from occurring. As a result, following a manual trip of the main generator on July 17, 2017, the fast bus transfer failed and a loss of offsite power to the 6.9 kV and the 4.16 kV electrical busses.

Description.

In April 2017, during a scheduled refueling outage, the licensee performed a design change to the fast bus transfer system using Engineering Change (EC) 63801, Fast Bus Transfer Supervisory Circuit Indication/Relay Modification RF21 Modification -

A Relays, and EC 64757, Fast Bus Transfer Supervisory Circuit Indication/Relay Modification RF21 Modification - B Relays, to replace the Allen Bradley 700RTC timing relays with Struthers-Dunn Type 237 timing relays. On May 27, 2017, the plant entered Mode 4 and Technical Specification 3.8.1.1, A.C. Sources, which required that the sites onsite and offsite ac power system be operable.

On July 17, 2017, at 4:06 p.m., the fast transfer of offsite electrical power from the unit auxiliary transformers to the startup transformers did not occur as designed following a manual trip of the main turbine due to an electrical fault related to a main transformer B isophase bus, resulting in the failure to maintain offsite electrical power to the onsite power distribution system and leading to an automatic reactor trip. In response to the loss of power, the licensees emergency diesel generators started and loaded the onsite safety-related loads as designed. The licensee restored offsite power to the train A safety-related electrical busses at 6:44 p.m. and to the train B safety-related electrical busses at 8:07 p.m.

The licensees failure analysis revealed that the Struthers-Dunn Type 237 timing relays installed in the fast bus transfer system had timed out instantaneously following the turbine trip rather than after their calibrated time delay settings. This instantaneous timeout prevented the fast bus transfer system from successfully transferring the source of onsite electrical power from the unit auxiliary transformers to the startup transformers.

Further testing revealed that a separate relay, 152X, in the fast bus transfer system circuit, generated an induced voltage surge of approximately 805 volts which caused the Struthers-Dunn Type 237 timing relays to instantaneously timeout. Consequently, the fast bus transfer system had been inoperable when the licensees outage ended on June 2, 2017, and after full power was achieved on June 13, 2017.

The licensee found that the previously installed Allen Bradley 700RTC timing relays included a surge suppression feature that allowed the previously installed relays to mitigate the effect of the induced voltage surge. This capability was not part of the Struthers-Dunn Type 237 timing relays installed during the previous outage to replace the Allen Bradley 700RTC timing relays.

To correct the condition, the licensee replaced the Struthers-Dunn Type 237 timing relays with Allen Bradley 700RTC timing relays in the fast bus transfer system. The licensee also installed a surge suppression diode across the 152X relay coil to eliminate the induced voltage surge. Additionally, the licensee performed timing tests on the installed relays to verify the timing of the relays occurred as expected per their design.

The inspectors determined that Procedure EN-DC-115, Engineering Change Process, Revision 18, used to develop and implement Engineering Changes 63801 and 64757, did not provide adequate guidance for considering induced voltage surges or surge suppression as a critical characteristics for timing relays. Further, the inspectors noted that other licensee procedures did include considerations for induced voltage transients.

Specifically, Procedure EN-IC-S-004-Multi, EMI/RFI Design Considerations, Revision 1, Step 5.5.8, includes recommendations to consider induced voltages from coils and the use of surge suppression as factors in the design and replacement of electrical equipment. However, Procedure EN-DC-115 did not reference any other site procedures for additional guidance. Because of this, induced voltage surges were not considered during the design change and the absence of surge suppression for Struthers-Dunn Type 237 was not identified as a critical characteristic to evaluate when replacing the Allen Bradley 700RTC relays.

In June 2017 the licensee implemented Industry Procedure IP-ENG-001, Standard Design Process, Revision 0, for design changes. This procedure replaced EN-DC-115.

The inspectors found that Procedure IP-ENG-001 and its references included significantly more guidance for design considerations, including critical characteristics, than Procedure EN-DC-115.

Analysis.

The inspectors determined that the implementation of an inadequate design change that rendered the fast bus transfer system inoperable was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it adversely affected the design control attribute of the Initiating Events Cornerstone and its objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations.

Specifically, the licensees inadequate plant modification resulted in the licensees inability to maintain offsite power to the 6.9 kV and the 4.16 kV electrical busses following a trip of the main generator.

The inspectors screened the finding in accordance with IMC 0609, Significance Determination Process. The inspectors determined that IMC 0609, Appendix G, Shutdown Operations Significance Determination Process, did not apply because, although the performance deficiency occurred during shutdown, the licensee had not met the entry conditions for residual heat removal and residual heat removal cooling was not initiated. IMC 0609, Attachment 4, Table 3, SDP Appendix Router, directed the inspectors to IMC 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. IMC 0609, Appendix A, Exhibit 1, Initiating Events Screening Questions, required a detailed risk evaluation because the finding involved the complete loss of a support system that caused an initiating event and affected mitigation equipment.

The senior risk analyst used the site specific SPAR model, Version 8.50 to perform this assessment. The analyst set basic events ACP-ABT-FC-TRA, Failure of Fast Bus Transfer for Train A, and ACP-ABT-FC-TRB, Failure of Fast Bus Transfer for Train B to the House Event TRUE indicating that a complete failure to fast transfer would occur each time the main generator tripped. Because offsite power was always available in the switchyard, the analyst determined that applying a condition specific 2-hour nonrecovery value for offsite power was appropriate. The analyst reviewed the detailed human reliability analysis performed by the licensee and concurred that the best available information suggested a nonrecovery value of 7.0E-3, which represents the operator failure to energize the plant busses from offsite power. The analyst also determined that any loss of offsite power initiator would not be affected by the performance deficiency. Therefore, LOOP initiating events were not quantified.

The dominant core damage sequences included common cause failures of the emergency feedwater pumps and condensate storage pool failures following recovery of offsite power. These were dominant because Waterford 3 does not have the capability to feed and bleed, and the loss of offsite power is modeled as a complete failure of the condensate and feedwater system. The analyst determined that credit should be given for recovery of the condensate system with reactor depressurization and/or recovery of the main feedwater system. Following discussions with Idaho National Laboratory modelers and data analysts, they revised the model and provided a limited-use-only version for this significance determination.

The resulting case core damage frequency was 2.31E-5/year. Subtracting this from a baseline of 7.14E-6/year provided a difference of 1.60E-5/year. The plant configuration caused by the subject performance deficiency affected plant safety for 45 days from June 2, 2017 when house loads were transferred to the auxiliary transformers until July 17, 2017 when the fast transfer failed to occur following a manual trip of the main turbine. The incremental conditional core damage probability over this exposure period was calculated to be 1.97E-6. The dominant core damage sequences involved various transient initiators, the failure to fast transfer, failure of the emergency diesel generators, and failure of the turbine-driven EFW pump upon battery depletion.

The licensees probabilistic risk analysis provided credit for the use of the installed FLEX diesel generator to provide power to a vital battery and continued dc power to the turbine-driven EFW pump. Reviewing Engineering Report Number: PSA-WF3-06-01, WF3 PRA Internal Events Interim Update to Incorporate FLEX and the licensees flex implementation procedures, the analyst determined that these licensee actions could prevent battery depletion and extend the function of the turbine-driven EFW pump.

Therefore, the analyst determined that credit should be given for use of FLEX equipment to prevent battery depletion during a station blackout. Using SPAR-H methodologies, the analyst developed human reliability analysis failure probabilities for the following functions:

• Operators Fail to Shed dc Loads following a Station Blackout

• Operators Fail to Set up, Start and Align the FLEX Diesel Generator

• Operators Fail to Establish Vital Battery Charging via FLEX Diesel Generator A fault-tree analysis of the failure of these functions to provide dc power beyond normal battery depletion was performed. The resulting system failure probability was approximately 1.0E-1 per demand. The analyst applied this recovery factor to all cut sets where the turbine-driven emergency feedwater pump was operating and the SPAR indicated that the sequence proceeded to core damage upon battery depletion. The resulting incremental conditional core damage frequency was 4.5E-7.

In accordance with NRC IMC 0609, Appendix A, Section 6.0, Detailed Risk Evaluation, the analyst evaluated the finding for external event risk contribution because the internal events detailed risk evaluation results were greater than 1.0E-7. The analyst noted that the vast majority of external initiators result directly in a loss of offsite power. These dominate initiators would not be affected by the subject performance deficiency because offsite power would not be available for a fast transfer. Therefore, the analyst screened out seismic, high winds, external fires, external floods and other initiators, because the vast majority would not be affected by the performance deficiency. The remaining accident initiators included internal fires and internal floods.

The analyst reviewed the Waterford 3 Individual Plant Examination for External Events (IPEEE), Supplement 4, dated July, 1995. The fire areas that affected the diesel generators or the turbine-driven EFW pump directly would not result in a direct trip of the reactor. The analyst noted that should a plant shutdown be initiated because of a fire and/or fire damage, operators would manually transfer house loads to offsite power.

Therefore, the fast transfer circuitry would not be challenged. Fires in the main control room or cable spreading room could result in both loss of mitigating systems and an automatic generator trip. However, the analyst determined, qualitatively, that the probability of a fire affecting both station blackout equipment and resulting in a transient was low enough that it would not greatly affect the risk increase from the performance deficiency. The analyst determined that the frequency of fires that only resulted in a plant transient were significantly lower than the 1.0 transients per year frequency that dominated the results of the internal events evaluation. As a result of this review, internal fire initiators were screened from further evaluation.

The analyst reviewed the Probabilistic Risk Assessment, Individual Plant Examination for the Waterford 3 Nuclear Power Plant, dated August, 1992. The only flooding scenario that was not screened was a turbine-generator building flood. This flood had an initiation frequency of 3.05E-3/year which is much lower than the initiating event frequency for the dominant sequences in the internal events evaluation. This scenario did not affect station blackout equipment. Therefore, the analyst determined, qualitatively, that this scenario is not a dominant risk contributor affected by the subject performance deficiency.

The analyst also discussed flood scenarios that affected the diesel generators and the turbine-driven EFW pump with the licensee analyst. These components were important because they would prevent and/or mitigate a station blackout and dominated the risk in the internal events results. The analyst determined that flooding of the turbine-driven EFW pump and the surrounding area would not cause a generator trip. The analyst also determined that flooding of a diesel generator room would not cause a generator trip.

The only scenario that would cause a generator trip would require a large, unisolated break in a diesel generator room that continued unabated for an extended period. This postulated scenario would be extremely rare. As a result, the analyst determined, qualitatively that internal flooding would not result in a significant change in risk from the subject performance deficiency. Therefore, the analyst screened internal flooding from further evaluation.

Given that external initiators were screened as not significant to the evaluation of the subject performance deficiency, the total incremental conditional core damage frequency is approximated by the internal events result of 4.5E-7. Therefore, this finding is of very low safety significance (Green).

In accordance with NRC IMC 0609, Appendix H, Containment Integrity Significance Determination Process, issued May 6, 2004, a large early release frequency screening was conducted because the change in core damage frequency was greater than 1.0E-7.

Using the large early release frequency screening criteria, the analyst assessed whether any of the core damage sequences affected by the finding were potential large early release frequency contributors.

In accordance with Appendix H, the analyst determined that the subject performance deficiency represented a Type A finding, because the finding affected the plant core damage frequency. Table 5.1, Phase 1 Screening - Type A Findings at Full Power, indicates that, for large, dry containments like Waterfords, the only accident sequences significant to large early release frequency are intersystem loss of coolant accidents and steam generator tube ruptures. None of the dominant sequences developed during the internal events evaluation were related to either of these initiators. These initiators accounted for approximately 8.7E-8 of the conditional core damage probability, and much of that risk was baseline. Therefore, the analyst determined that the significance of this finding was considered to be core damage frequency-dominant, and the impact to large, early release frequency was negligible.

The inspectors determined that the finding did not have a cross-cutting aspect because it did not reflect current licensee performance. Specifically, the design change procedure used to implement the inadequate plant modification during the outage (Procedure EN-DC-115) was no longer in use at the site when the event occurred. The inspectors found that the plant procedure for design changes implemented at the site following the outage and in use at the time of the event, Procedure IP-ENG-001, contained significantly more guidance for design considerations, specifically for critical characteristics.

Enforcement.

Technical Specification 3.0.1 requires, in part, that compliance with the Limiting Conditions for Operation contained in the succeeding specifications is required during the operational modes or other conditions specified. Technical Specification 3.8.1.1 requires, in part, that in modes one through four, the licensee maintain at least two physically independent circuits between the offsite transmission network and the onsite Class 1E distribution system operable.

Contrary to the above, from June 2, 2017, until July 17, 2017, the licensee failed to comply with the limiting conditions for operation contained in Technical Specification 3.8.1.1 to maintain at least two physically independent circuits between the offsite transmission network and the onsite Class 1E distribution system operable during the operational modes one through four. Specifically, the licensee implemented a design change to the fast bus transfer system in April 2017 that rendered it incapable of performing the fast bus transfer function to maintain offsite power between the offsite transmission network and the onsite Class 1E distribution system. As a result, the ac electrical power circuit was inoperable from June 2, 2017, until its failure on July 17, 2017, when the plant was in mode one. The licensee entered this condition into their corrective action program as Condition Report CR-WF3-2017-05842. The corrective action taken to restore compliance was to install the previous style relays used prior to the design change and to install a suppression diode to eliminate the induced voltage surge transient.

Because this violation was of very low safety significance and the licensee entered the issue into their corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy:

NCV 05000382/2017011-02, Failure to Implement an Adequate Design Change for the Fast Bus Transfer System.

(3) Failure to Implement Procedures for Isophase Bus Maintenance

Introduction.

The inspectors reviewed a self-revealed finding that occurred because the licensee did not follow procedural guidance when performing periodic maintenance on the main transformer isophase buses. Specifically, the licensee did not implement portions of the procedure to check for tightness of the isophase bus bolted connections as required by Procedure ME-004-004, Isophase Bus Maintenance and Inspection, Revision 302.

Description.

On July 17, 2017, licensee personnel noticed the isophase bus duct to main transformer B glowing orange and electrically sparking. In response, operators tripped the main turbine and generator at 4:06 p.m. The licensees subsequent evaluation concluded that the electrical fault was caused by loose connections associated with the bolted connections for the laminated flexible links on the isophase bus ducting. The loose connections resulted in high resistance and eventual failure of the isophase bus duct.

The licensee implemented preventive maintenance for the isophase bus every 18 months during refueling outages using Procedure ME-004-004, Isophase Bus Maintenance and Inspection, Revision 302. Section 9.2 of Procedure ME-004-004 required that the licensee torque the bolted connections of the isophase bus to procedurally-required values. The procedure specifically stated that the torqueing of the bolts is a check to ensure that they are tightened to at least the procedurally required values. However, the procedure also allowed the licensee to forgo torqueing if determined applicable.

The inspectors determined that when performing Section 9.2 of Procedure ME-004-004, licensee maintenance personnel assumed that if the bolted connections were not loosened during the refueling outage preventive maintenance, then tightening of the connections per Procedure ME-004-004 was not required. Because other maintenance did not result in the intentional loosening of the connections, the torqueing required by Section 9.2 had not been performed for at least 10 years.

The inspectors further noted that Procedure EN-DC-335, PM Basis Template, Revision 8, Section 5, recommended that Electric Power Research Institute (EPRI)guidelines be considered in the development of preventive maintenance templates.

EPRI Report 112784, Isolated Phase Bus Maintenance Guide, gives guidelines for thermography infrared scanning as the best preventive maintenance technique to find issues related to isophase busses. The inspectors noted that Procedure ME-004-004 did not include thermography to check for hot spots resulting from loose connections.

The licensee entered the issue into their corrective action program as Condition Report CR-WF3-2017-05957. Following the July 17, 2017, failure, the licensee performed thermography and detected no other loose connections on the isophase busses or associated ducts. Additionally, the licensee removed the note from ME-004-004 that maintenance personnel used to forgo checking the connection tightness and is planning to implement a periodic maintenance task to perform thermography.

Analysis.

The inspectors determined the failure to implement the requirements of Procedure ME-004-004 was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it adversely affected the human performance attribute of the Initiating Events Cornerstone and its objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the failure to ensure the appropriate tightness of the isophase bus bolted connections led to an electrical fault that required a manual trip of the turbine and generator.

The inspectors screened the finding in accordance with IMC 0609, Significance Determination Process. Using IMC 0609, Appendix A, Exhibit 1, Initiating Events Screening Questions, the inspectors determined the finding to be of very low safety significance (Green) because the finding did not cause a reactor trip and the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition.

The finding had a conservative bias cross-cutting aspect in the human performance area because individuals did not use decision making practices that emphasized prudent choices over those that are simply allowable. Specifically, when faced with unclear procedural guidance, licensee personnel did not question the validity of their actions and accepted them as allowable [H.14].

Enforcement.

Enforcement action does not apply because the performance deficiency did not involve a violation of a regulatory requirement because the isophase bus ducting is not a safety-related structure, system, or component. The licensee entered this issue into their corrective action program as Condition Report CR-WF3-2017-05844. The licensees corrective actions included tightening the bolted connections associated with all of the main transformer isophase busses and revising ME-004-004 to remove the note allowing for the step to not be performed. Because this finding does not involve a violation of a regulatory requirement and was of very low safety significance (Green), it is being documented as a finding: FIN 05000382/2017011-03, Failure to Implement Procedures for Isophase Bus Maintenance.

(4) Failure to Demonstrate that the Performance of Fuel Pool Purification Valves is Effectively Controlled through Preventive Maintenance

Introduction.

The inspectors identified a Green, non-cited violation of 10 CFR 50.65, Section (a)(2), Requirements for Monitoring the Effectiveness of Maintenance of Nuclear Power Plants, because the licensee did not demonstrate that performance of components was being effectively controlled through appropriate preventive maintenance, and did not monitor the performance of the component against licensee-established goals to provide reasonable assurance that the component was capable of fulfilling its intended function. Specifically, the licensee failed to demonstrate that performance of the spent fuel pool cooling and purification valves were being effectively controlled through the performance of appropriate preventive maintenance and did not monitor their performance against established goals.

Description.

During the July 17, 2017, event, water inventory from the spent fuel pool began leaking past non-quality related purification pump discharge isolation valve FS-318 to the refueling water storage pool.

The inspectors found that the licensees maintenance rule program defines one functional failure criterion for the spent fuel pool cooling and purification system as any failure that could prevent maintaining an adequate water level in the spent fuel pool such that radiation levels in the fuel handling building do not exceed 2.5 mrem/hr. Although radiation levels during the event did not approach the 2.5 mrem/hr threshold, the inspectors noted that Section 9.1.3.1 of the licensees Updated Final Safety Analysis Report states that 23 feet of water must be maintained over the top of fuel stored in the storage racks to ensure doses remain below 2.5 mrem/hr.

Due to the leak through valve FS-318, spent fuel pool level lowered from approximately 44 feet to 42 feet 3 inches before a source of makeup inventory was established. This equates to a drop from 24 feet 3 inches of water above active fuel to 22 feet 6 inches of water above active fuel, 6 inches less than the maintenance rule functional failure criterion required to ensure that radiation levels in the fuel handling building do not exceed 2.5 mrem/hr. The inspectors noted that leakage could have reduced inventory to as low as 20 feet 9 inches above the top of fuel stored in the storage racks absent operator actions.

The inspectors found a previous failure of valve FS-318 documented in Condition Report CR-WF3-2016-07084, initiated on November 11, 2016, which identified that the valve was visibly leaking by its seat. The inspectors found that no maintenance rule failure evaluation was performed for the condition. Upon further questioning, the inspectors found that the licensee had not evaluated any failures of spent fuel pool purification valves in the system against their functional failure criteria per 10 CFR 50.65, Section (a)(2). Although valve FS-318 and other portions of the spent fuel pool cooling and purification system are not quality-related components, the system itself is scoped into the licensees maintenance rule program.

The inspectors determined that valve FS-318 was designated as a run-to-failure valve in the licensees preventive maintenance program. Because it was classified as run-to-failure, the valve did not have any specific preventive maintenance strategy developed or implemented. The inspectors found that other valves in the system whose failure could result in a loss of inventory from the spent fuel pool were also categorized as run-to-failure valves, and that their failures were not evaluated against the functional failure criteria established by the licensee for the spent fuel pool cooling and purification system. The inspectors reviewed the licensees preventive maintenance classification Procedure EN-DC-153, Preventative Maintenance Component Classification, Revision 14. Using Attachment 9.3, Component Classification Questionnaire, the inspectors determined that valve FS-318 should not have been classified as a run-to-failure component because it was associated with a maintenance rule function and its failure would lead to a potential loss of the spent fuel pool level safety function. The inspectors noted that classification as anything other than run-to-failure would require the licensee to establish a preventive maintenance strategy for the valve.

The inspectors concluded the licensee could not demonstrate that the performance or condition of the spent fuel pool cooling and purification system was being effectively controlled through the performance of appropriate preventive maintenance given that failures of purification valves were not being evaluated against the maintenance rule system performance criteria established by the licensee. The licensee subsequently reviewed the maintenance strategy associated with valve FS-318 and developed new preventive maintenance requirements. The licensee also identified four other valves that were inappropriately classified as run-to-failure components that required a preventive maintenance strategy be developed, and three additional valves for which a different preventive maintenance strategy was needed. The preventative maintenance strategy for the valves was updated and includes diaphragm replacement every six years. The licensee implemented corrective actions to perform maintenance rule functional failure evaluations for previous failures of the spent fuel pool purification valves to determine the appropriateness of the preventive maintenance for valves in the system and the need to monitor performance per Section (a)(1) of the maintenance rule.

Analysis.

The inspectors determined the failure to demonstrate component performance through effective preventive maintenance was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it adversely affected the structures, systems, and components performance attribute of the Barrier Integrity Cornerstone and its objective to provide reasonable assurance that physical design barriers protect the public from radionuclide releases caused by accidents or events. Specifically, failure to demonstrate that the performance of spent fuel pool cooling and purification valves was being effectively controlled through preventive maintenance resulted in reduced reliability.

The inspectors screened the finding in accordance with IMC 0609, Significance Determination Process. The inspectors determined that IMC 0609, Appendix G, Shutdown Operations Significance Determination Process, did not apply because, although the performance deficiency occurred during shutdown, the licensee had not met the entry conditions for residual heat removal and residual heat removal cooling was not initiated. IMC 0609, Attachment 4, Table 3, SDP Appendix Router, directed the inspectors to IMC 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. IMC 0609, Appendix A, Exhibit 3, Barrier Integrity Screening Questions, directed the inspectors to use IMC 0609, Appendix M, Significance Determination Process Using Qualitative Criteria, because the finding resulted in spent fuel pool water inventory decreasing below the minimum analyzed level limit specified in the site-specific licensing basis.

The regional senior reactor analyst determined that the minimum analyzed spent fuel pool level limit was based on the minimum level for a fuel handling accident. The licensee was not moving fuel during the exposure period of the performance deficiency.

Therefore, the analyst determined using qualitative methods that the change in risk from the performance deficiency was of very low safety significance (Green).

The finding had an evaluation cross-cutting aspect in the problem identification and resolution area because the organization did not thoroughly evaluate issues to ensure that resolutions address causes and extent of condition commensurate with their safety significance. Specifically, the evaluations associated with prior failures of the spent fuel pool cooling and purification valves never thoroughly evaluated the issues or questioned the established maintenance of the valves that caused repeated leaks from the spent fuel pool [P.2].

Enforcement.

As required by 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Section (a)(1), holders of an operating license shall monitor the performance or condition of structures, systems, or components (SSCs) within the scope of the rule as defined by 10 CFR 50.65(b), against licensee established goals, in a manner sufficient to provide reasonable assurance that such SSCs are capable of fulfilling their intended functions.

As required by 10 CFR 50.65, Section (a)(2), monitoring as specified in 10 CFR 50.65(a)(1) is not required where it has been demonstrated that the performance or condition of an SSC is being effectively controlled through the performance of appropriate preventive maintenance such that the SSC remains capable of performing its intended function.

Contrary to the above, prior to September 1, 2017, the licensee failed to demonstrate that the performance of an SSC was being effectively controlled through the performance of appropriate preventive maintenance such that it remained capable of performing its intended function, and did not appropriately monitor the component performance against licensee-established goals. Specifically, the licensee did not evaluate failures of multiple spent fuel pool cooling and purification valves and could not demonstrate that the performance or condition of these SSCs was being effectively controlled through the performance of appropriate preventive maintenance and did not perform the goal setting and monitoring that was required. The licensee evaluated the system for past functional failures and performance criteria exceedance and determined that goal setting, corrective actions, and monitoring under 10 CFR 50.65(a)(1) was required.

The licensee entered this issue into their corrective action program as Condition Reports CR-WF3-2017-06542 and CR-WF3-2017-08891. Planned corrective actions include evaluating functional failures of the cooling and purification system valves against the established maintenance rule functional failure criteria and establishing new preventive maintenance strategies for the valves. Because the licensee has entered the issue into their corrective action program and the finding was of very low safety significance, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000382/2017011-04, Failure to Demonstrate that the Performance of Fuel Pool Purification Valves is Effectively Controlled through Preventive Maintenance.

4.0 Meetings, Including Exit

Exit Meeting Summary

On November 9, 2017, the inspectors presented the inspection results to Mr. John Dinelli, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

L. Bergeron, Operations Manager

W. Day, Senior Engineer

A. Griffin, Engineering Supervisor

J. Jarrell, Regulatory Assurance Manager

K. LaBauve, Senior Engineer

P. Linger, Engineer

S. Meikeljohn, Licensing Specialist

P. Stanton, Design and Project Engineering Manager

C. Talazac, Engineering Supervisor

D. Viener, Engineering Supervisor

NRC Personnel

D. Loveless, Senior Reactor Analyst

F. Ramirez, Senior Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000382/2017011-01 NCV Failure to Implement Off-normal Procedure for Low Spent Fuel Pool Inventory (Section 3.11)

05000382/2017011-02 NCV Failure to Implement an Adequate Design Change for the Fast Bus Transfer System (Section 3.11)

05000382/2017011-03 FIN Failure to Implement Procedures for Isophase Bus Maintenance (Section 3.11)

05000382/2017011-04 NCV Failure to Demonstrate that the Performance of Fuel Pool Purification Valves is Effectively Controlled through Preventive Maintenance (Section 3.11)