IR 05000440/2016008

Reactive Inspection Report 05000440/2016008

ML16147A437
Person / Time
Site:	Perry
Issue date:	05/25/2016
From:	Louden P Division Reactor Projects III
To:	Hamilton D FirstEnergy Nuclear Operating Co
References
IR 2016008
Download: ML16147A437 (48)

Text

UNITED STATES May 25, 2016

SUBJECT:

PERRY NUCLEAR POWER PLANTREACTIVE INSPECTION REPORT 05000440/2016008

Dear Mr. Hamilton:

On February 25, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed its initial assessment of events where two safety relief valves remained fully open after receiving a spurious initiation signal which occurred on February 8, 2016, and a loss of shut down cooling event while the reactor was shut down for corrective actions for the two safety relief valves remaining fully open, which occurred on February 11, 2016. Based on this initial assessment, the NRC sent a Special Inspection Team to your site on February 29, 2016.

The team presented the results of this inspection during an interim exit on March 28, 2016, and a final exit meeting on May 13, 2016, with you and other members of your staff. The results of this inspection are documented in the enclosed report. The basis for initiating the special inspection and the focus areas for review are detailed in the Special Inspection Charter (Attachment 4 of the Enclosure).

The enclosed report documents three findings of very low safety significance (Green). These findings involved a violation of NRC requirements. The NRC is treating these violations as Non-Cited Violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC, 20555-0001; with a copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region III; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC, 20555-0001; and the NRC Resident Inspector at the Perry Nuclear Power Plant.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region III; and the NRC Resident Inspector at the Perry Nuclear Power Plant. In accordance with Title 10 of the Code of Federal Regulations (CFR) 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRC's "Rules of Practice," a copy of this letter, its enclosures, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records System (PARS) component of NRC's Agencywide Document Access and Management System (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Patrick L. Louden, Director Division of Reactor Projects Docket No. 50-440 License No. NPF-58

Enclosures:

IR No. 05000440/2016008 w/Attachments:

1. Supplemental Information 2. List of Documents Reviewed 3. List of Acronyms Used 4. Special Inspection Charter 5. Event Timeline

REGION III==

Docket No: 50-440 License No: NPF-58 Report No: 05000440/2016008 Licensee: FirstEnergy Nuclear Operating Company (FENOC)

Facility: Perry Nuclear Power Plant Location: North Perry, Ohio Dates: February 29, 2016, through May 13, 2016 Inspectors: W. Schaup, Senior Resident Inspector, Clinton (Lead)

R. Baker, Operations Engineer I. Hafeez, Reactor Inspector J. Havertape, Reactor Engineer D. Szwarc, Senior Reactor Inspector Approved by: P. Louden, Director Division of Reactor Projects Enclosure

SUMMARY

Inspection Report No. 05000440/2016008; 02/29/2016 - 05/13/2016; Perry Nuclear Power

Plant; Special Inspection.

This report covers an 11-week period of inspection by the Clinton senior resident inspector and four regional inspectors. Based on the results of this inspection, two U.S. Nuclear Regulatory Commission (NRC) identified and one self-revealed finding of very-low safety significance (Green) were identified. The significance of most findings is indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609,

Significance Determination Process (SDP). Cross-cutting aspects were determined using IMC 0310, Aspects within the Cross Cutting Areas. Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy dated July 9, 2013. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 5, dated February 201

NRC-Identified

and Self-Revealed Findings

Cornerstone: Initiating Events

Green.

The inspectors identified a finding of very low safety significance and an associated non-cited violation (NCV) of Title 10 CFR Part 50, Appendix B, Criterion V,

Instructions, Procedures and Drawings, for the licensees failure to follow fleet procedure NOP-SS-3001, Procedure Review and Approval, and to ensure that a newly developed hardcard was properly reviewed and approved prior to implementation.

Specifically, the licensee characterized the hardcard development and implementation as only an administrative change, and was thereby exempted from the fleet procedure review process for new procedures. The licensee entered this finding into the corrective action program (CAP) as condition report (CR) 2016-03033 and planned to perform a causal review to ensure that actions taken in response to information provided in operations administrative instruction, OAI-1703, Hardcards, have received appropriate review under 10 CFR 50.59.

The inspectors determined that the failure to follow the licensees fleet and site-specific procedures to ensure that a newly developed hardcard was properly reviewed and approved prior to implementation was a performance deficiency. The performance deficiency was more than minor because, if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern. Specifically, by not performing review and approval activities in accordance with established procedures, the licensee might unintentionally challenge the operators by requiring equipment manipulation that impose unnecessary plant transients, which would result in unwarranted challenges to safety related equipment. Additionally, the performance deficiency was more than minor because it was associated with the procedure quality attribute of the Initiating Events cornerstone and adversely affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown, as well as power operations, and was therefore a finding. The finding was determined to be of very low safety significance because the finding did not cause a reactor trip and the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition. The inspectors determined this finding had a cross-cutting aspect of conservative bias in the human performance area where individuals use decision making-practices that emphasize prudent choices over those that are simply allowable and a proposed action is determined to be safe in order to proceed, rather than unsafe in order to stop.

Specifically, when the licensee determined to develop the hardcard procedure as an administrative change, the decision precluded the opportunity for the licensee to properly evaluate that the procedure actions did not adversely impact existing station procedures and equipment [IMC 0310, H.14]. (Section 4OA5.1.d(2))

Green.

A self-revealed finding and an associated NCV of Title 10 CFR Part 50,

Appendix B, Criterion V, Instructions, Procedures, and Drawings, was identified for the licensees failure to prescribe instructions appropriate to the circumstance into procedures for an activity affecting quality. Specifically, the licensee failed to incorporate instructions into procedures to fill and vent all portions of the reactor water level reference leg purge system. This issue has been entered the issue into the CAP as CR 2016-02716 to provide a process for the activities.

The failure to prescribe instructions appropriate to the circumstance into procedures for an activity affecting quality was a performance deficiency. The performance deficiency was more than minor because it was associated with the configuration control performance attribute of the Initiating Events cornerstone and adversely affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenged critical safety functions during shutdown as well as power operations and was therefore a finding. Specifically, gas left in the reactor water level instrument reference leg purge system during maintenance equipment alignment was known to have the potential to interfere with the proper operation of pressure and level indicators relied upon for safety functions, as documented in Generic Letter 93-03. The finding was determined to be of very low safety significance (Green) because the finding did not result in exceeding the reactor coolant system leak rate for a small loss of coolant accident (LOCA), cause a reactor trip, involve the complete or partial loss of a support system that contributes to the likelihood of, or caused, an initiating event and did not affect mitigation equipment. The inspectors determined this finding had a cross-cutting aspect of challenge the unknown in the human performance area where individuals stop when faced with uncertain conditions and risks are evaluated and managed before proceeding. Specifically, the technicians involved in the April 18, 2015, system recovery activities did not stop when faced with an uncertain condition, communicate with supervisors, nor consult system experts to resolve the condition prior to continuing work activities. Since this condition was not placed into the corrective action process at the time, no further consideration was given to venting the reference leg portion of the reactor water level reference leg purge system [IMC 0310, H.11]. (Section 4OA5.1.d(3))

Cornerstone: Mitigating Systems

Green.

The inspectors identified a finding of very low safety significance and an associated NCV of Title 10 CFR 50, Appendix B, Criterion VIII, Identification and Control of Materials, Parts, and Components, for the licensees failure to assure that identification of items was maintained by appropriate means, either on the item or on records traceable to the item, as required throughout fabrication, erection, installation, and use of the item. Specifically, the licensee failed to maintain traceability of safety related fuses installed in safety related systems. The licensee has entered this issue into the CAP as CR 2016-02048 and CR 2016-02258. Corrective actions being performed by the licensee include evaluating implementation of procedure NOP-WM-4300 for documenting use of parts in safety related systems and issuing work orders to determine where the potentially defective fuses were installed in the Division 2 and 3 safety related buses for replacement.

The inspectors determined that the failure to assure that identification of items was maintained by appropriate means, either on the item or on records traceable to the item, as required throughout fabrication, erection, installation, and use of the item was a performance deficiency. Specifically, the licensee failed to maintain traceability of safety related fuses installed in safety related systems. The performance deficiency was more than minor because, if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern. Specifically, identification and control measures are designed to prevent the use of incorrect or defective materials, parts or components which could render safety systems inoperable. Additionally, the performance deficiency was more than minor because it is associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences and was, therefore, a finding. The finding was determined to be of very low safety significance because the finding was not a deficiency affecting the design or qualification of a mitigating structure system or component, did not represent a loss of system safety function, did not represent an actual loss of function of a single train or two separate trains for greater than its allowed outage time, and did not represent an actual loss of safety function of one or more non-technical specifications trains of equipment during shutdown for equipment designated as high safety significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The inspectors determined this finding had a cross-cutting aspect of documentation in the human performance area where the organization creates and maintains complete, accurate and up-to-date documentation. Specifically, a review by the licensee of existing work orders that may have utilized the fuses did not clearly document if the fuses were installed, returned to the warehouse or scrapped [IMC 0310, H.7].

(Section 4OA5.1.d(4))

REPORT DETAILS

4OA5 Other Activities

.1 Special Inspection

a. Event Summaries On February 8, 2016, at 1500 eastern standard time (EST) while at full power, thirteen safety relief valves (SRVs) opened; eleven of them immediately closed and two remained open on the low-low set point function. The opening of the valves caused suppression pool temperature to increase. At 1503 EST, suppression pool temperature reached 95 degrees Fahrenheit (°F), and plant operators took action to manually scram the reactor in accordance with their training and plant procedures.

All control rods fully inserted and plant equipment functioned as expected. Immediately after the scram, the two remaining SRVs closed and reactor pressure was stabilized via the turbine bypass valves to the main condenser. Reactor water level was maintained using the normal feedwater system.

On February 11, 2016, at 1504 EST with the plant shut down as part of the forced shut down from the previous SRV lifting event, the Division 1 safety bus lost power.

Division 1 shut down cooling system was in service at that time. When the safety bus lost power, the division 1 shut down cooling pump A tripped on a loss of power. The Division 1 emergency diesel generator (EDG) started and loaded the safety bus as designed. The emergency service water (ESW) pump that supplies cooling water to the EDG is powered from the safety bus but did not start as required. With no cooling water being supplied to the EDG, operators took actions to manually secure the EDG to prevent damage.

The Division 2 shut down cooling system was operable during the event and was placed into service by plant operators and cooling was re-established at 1544 (EST). During this time reactor coolant temperature rose from 89°F to 115°F.

b. Inspection Scope

A Special Inspection was initiated following the NRCs review of the deterministic and conditional risk criteria specified in Management Directive 8.3, NRC Incident Investigation Program. The inspection was conducted in accordance with NRC inspection procedure (IP) 93812, Special Inspection. The Special Inspection Team (SIT) Charter, dated February 25, 2016, is included as Attachment 4. The team reviewed technical and design documents, drawings, operating procedures, off normal procedures, emergency procedures, work orders, corrective action documents, operator logs, vendor documents, and training documents. In addition, the team interviewed the control room operations staff and station personnel to independently assess the events and actions taken in response to the events. The team performed plant walkdowns of the affected systems and spent time at the site control room simulator where the actual events and some postulated events were recreated with licensed operators responding to the events.

A list of specific documents reviewed is provided in Attachment 2.

c. Inspection Documentation As detailed in the Special Inspection Charter (Attachment 4), the following items were reviewed and the associated results obtained.

(1) Identify a timeline for both the events. Include relevant and major plant conditions, system lineups and operator actions.

The team completed the timeline and the detailed sequence of events is provided in

===5.

(2) Review plant data and records to confirm the adequacy of the licensees assessment of===

the cause of the scram of the reactor and the loss of the Division 1 4.16 kV safety bus EH-11.

Scram of the reactor on February 8, 2016 The licensee completed a root cause analysis (RCA) on the manual reactor scram based on suppression pool temperature reaching 95°F from the SRVs opening. As part of the RCA, the licensee determined that the most likely cause for the SRVs opening was a pressure and level perturbation observed on reactor pressure vessel (RPV)instrumentation utilizing the B RPV reference leg. The pressure perturbation was most likely caused by a bubble of non-condensable gas that was between the reference leg fill panel and the reference leg. A restricting orifice is located downstream of the reference fill panel feeding the RPV reference leg. Pressure on the upstream side of the restricting orifice was at or near 1500 pounds per square inch (psi) and the downstream pressure was at or near 1025 psi. Flow through the line is typically at 0.08 gallon per minute (gpm). As the bubble of non-condensable gas pressed through the restricting orifice, it rapidly expanded into the lower pressure on the other side. The momentary flow increase in a low flow line would be seen as a pressure spike by RPV instrumentation utilizing the B RPV reference leg.

The resultant pressure increase from the gas bubble pressing through the restricting orifice was sufficient to provide pressure indication to the trip units that were part of the Division 2 logic sequence and provided an open signal to all SRVs. The SRVs responded to the pressure indication and, as designed, thirteen of the SRVs lifted.

Eleven immediately reseated in response to the short duration of the pressure perturbation. Two SRVs remained opened as designed as part of the low-low set function of the system.

The inspectors validated the licensees assessment by independently reviewing plant data gathered from the plant computer, operations logs, operating procedures, maintenance procedures and work orders and interviews with station personnel.

Based on the independent review of the event from plant data, plant records and plant documentation, the inspectors agreed with the licensee assessment that the likely cause of the gas bubble was improperly performed maintenance on the B RPV reference leg fill panel during the previous refueling outage. The maintenance activity resulted in gas remaining in the B RPV reference leg system. However, even after indications were noted that gas was in the system, inadequate actions were not taken to vent the system.

The inspectors determined that restoration actions by the licensee after the improperly performed maintenance activity failed to incorporate instructions into procedures to fill and vent all portions of the reactor water level reference leg purge system that later resulted in a reference leg perturbation. The details and enforcement of this issue are discussed in Section 4OA5.d(2) of this report.

The inspectors also agreed with the licensees likely cause of the event being a pressure perturbation induced by gas in the B RPV reference leg. Plant data and documentation reviewed by the inspectors was consistent with the event. The pressure perturbation was supported by either plant trace data records, where available, showing instrumentation response of the pressure perturbation or the actual activation of reactor protection logic, indicated in the control room, by all instrumentation supported by the B RPV reference leg.

Loss of the Division 1 safety bus on February 11, 2016 The licensee performed an equipment apparent cause evaluation on the loss of power to the Division 1 safety bus, which resulted in a loss of the shutdown cooling system. As part of the investigation into the event, the licensee utilized a failure modes analysis and simple troubleshooting methods to determine that the cause of the event was the failure of a potential transformer (PT) secondary fuse that supplied power to the under voltage and degraded voltage protection scheme for the safety bus. This same failure also prevented the ESW pump from starting because the ESW pump uses the same protection scheme for under voltage and degraded voltage conditions.

The fuse was determined to be suspect during simple troubleshooting when performing continuity checks in the safety bus. The licensee performed a failure analysis on the suspect fuse at First Entergys BETA Laboratory and discovered that the fuse internals were not correctly soldered on one end during manufacturing resulting in intermittent continuity. The licensee had a sample of similar fuses analyzed for comparison and all were found correctly assembled.

The inspectors independently reviewed the apparent cause evaluation, failure mode analysis, troubleshooting records, maintenance records, work orders, and fuse failure analysis report. The inspectors agreed with the licensees conclusion that the apparent cause of the loss of the Division 1 safety bus was the intermittent continuity of the PT secondary fuse.

(3) Review the circumstances of the safety relief valves opening. Evaluate the design of the SRV and the pressure sensing circuitry as designed in the single reference leg to verify whether the single-failure criterion for initiation of a safety system is met. Verify that inadvertent actuation of all 19 SRVs was analyzed for acceptable safety consequences.

Include a review of relevant portions of the Updated Final Safety Analysis Report that discuss inadvertent opening of a safety relief valve. Evaluate the design of the pressure relief valve circuitry and verify that the operation of the SRVs is consistent with the design.

As defined in Title 10 CFR Part 50, Appendix A, a single failure means an occurrence which results in the loss of capability of a component to perform its intended safety functions. Multiple failures resulting from a single occurrence are considered to be a single failure. Fluid and electric systems are considered to be designed against an assumed single failure if neither

(1) a single failure of any active component (assuming passive components function properly) nor

(2) a single failure of a passive component (assuming active components function properly), results in a loss of the capability of the system to perform its safety functions.

The inspectors determined that the occurrence of entrained gases in the B RPV reference leg that affected both pressure instruments that utilize the reference leg did not prevent the fulfillment of the safety function of the SRVs. The SRVs have a safety function to open to prevent over pressurization of the RPV. The SRVs did open during the pressure perturbation; therefore, this would not be considered a single failure resulting in the loss of safety function of the SRVs.

The inspectors noted that the current design is a single point venerability. The licensee agreed with this position and entered the issue into the corrective action program (CAP)as condition report (CR) 2016-2976.

The inspectors reviewed the Perry Updated Safety Analysis Report (USAR) to determine if the inadvertent actuation of all 19 SRVs had been analyzed for acceptable safety consequences. The USAR only provided an analysis for the inadvertent actuation of a single SRV that remained open. The licensee ran the postulated event in the site control room simulator and the reactor operators utilizing station procedures were able to safely shut down the reactor. Additionally, the licensee performed a heat load calculation for all 19 SRVs opening to determine the effect on suppression pool temperature and determined the maximum temperature that would occur was bounded by the containment load analysis in the USAR and would not adversely affect containment.

The inspectors concluded that even though the specific postulated event was not analyzed in the USAR, acceptable safety consequences would be achieved based upon the licensee demonstrating that the plant could be safely shut down if such an event occurred and other postulated events credited in the USFAR were bounding for the postulated event.

To evaluate the design of the SRV relief logic, the inspectors reviewed plant design documentation for both the mechanical safety function of the SRV as well as the operation of the Low Low Set (LLS) relief valve circuitry logic associated with the SRVs.

The response of the SRVs to the momentary high reactor pressure perturbation was as designed. The high initial pressure actuated the Division 2 LLS master trip channels that reset the opening and closing solenoid set points for the six SRVs associated with the automatic depressurization system (ADS). The low subsequent pressure immediately closed all but the two lowest LLS set point SRVs that now remained open as the perturbation cleared (duration ~ 0.09 seconds) and reactor pressure remained stable at approximately 1010 psig. Once reactor pressure lowered following taking the unit off line, the remaining two SRVs closed and remained shut as designed.

Additionally, the inspectors observed the licensees recreation of this event in the site control room simulator to validate that the operation of the SRV relief logic response to simulator modeling of the actual plant conditions was consistent with actual plant data collected during the event. The inspectors determined that the observed response of the SRVs was consistent with design requirements. The inspectors found no issues during their review.

(4) Review and evaluate the suppression pool temperature response following the opening of the two safety relief valves. Following the opening of the two safety relief valves, suppression pool temperature increased to 95 degrees Fahrenheit. As required per licensee procedure, the operators manually scrammed the reactor at that temperature.

At the time of the event, the plant was operating at rated power in Mode 1, with an average suppression pool temperature (SPT) of 79°F. At 1500 EST, February 8, 2016, a momentary spurious high reactor pressure signal was sensed by the Division 2 SRV relief logic, resulting in multiple SRVs inadvertently opening. Two of the SRVs (1B21F0051C and 1B21F0051D) remained open, causing the average SPT to rise.

At 1503 EST, with the two SRVs still open, the operators inserted a manual reactor scram when the average SPT reached 95°F. Following insertion of the manual scram, all control rods fully inserted, and as actual RPV pressure lowered below the set points for the LLS relief logic for closing the valves, both open SRVs closed as designed.

The licensee entered emergency operating procedure EOP-02, Primary Containment Control, Revision 3, due to SPT being greater than 95°F, and continued with actions to mitigate the event and shut down the plant.

Based on the independent review of available plant data, trace recordings showing instrumentation responses, and design documentation, the inspectors agreed with the licensees assessment that the likely cause for the inadvertent opening of the SRVs was the result of a momentary pressure perturbation sensed by the Division 2 SRV LLS actuation logic.

To evaluate the SPT response during the event, the inspectors observed the licensees recreation of this event in the plant simulator. The inspectors evaluated the simulator modeling of the actual plant conditions and a different operating crews response to the event. The scenario was constructed to prevent the actual closure of the two open SRVs until a manual reactor scram was inserted from the crew response. The licensees business practice PYBP-POS-0030, Transient Strategies and Mitigating Actions, provided a thumb rule for estimating the plant impact from open SRVs at power. The thumb rule stated that the approximate suppression pool heat up rate was 3°F per minute per open SRV.

The inspectors review of the plant data showed that the actual SPT rise during the event, with two SRVs open, was approximately 16°F in 3 minutes, or 5.3°F per minute.

When the conditions were recreated in the plant simulator, the observed SPT heat up rate was slower, approximately 3.7°F per minute. The crews response to the recreated event differed from the actual event response in only one aspect. The simulator crew was able to attempt to close the open SRVs using the associated control switches on the Division 2 ADS relay panel back panel, 1H13-P631, due to the longer time delay before reaching an average SPT of 95°F. Since the scenario was conditioned not to allow the open SRVs to close until after insertion of the manual scram, the simulator crew response was not significantly different from the actual event response. The inspectors determined that the actual plant SPT response met design expectations and the slower simulator model response was adequately addressed during operator training and did not negatively impact the licensees response to the event. The licensee initiated CR 2016-03016 and a simulator work request to address the simulator fidelity issue.

Additionally, the inspectors assessed actions taken by the licensee to mitigate the inadvertent opening of two SRVs while at power by independently reviewing plant computer data, operations logs, and interviewing with the crew personnel who were on watch in the control room during the event. The inspectors also reviewed operation department off normal and emergency procedures relevant to mitigating the event.

The inspectors noted that the operating crew entered off normal instructions (ONIs) for the inadvertent opening of the SRVs and unplanned changes in reactor power. The operators were performing the actions to attempt to close the open SRVs in parallel with attempting to lower power to 96 percent. However, prior to being able to lower power to 96 percent and without an attempt to close the SRVs, the crew inserted a manual reactor scram as directed by the Margins and Limits hardcard posted in the control room when the average SPT reached 95°F.

Following the reactor scram and subsequent RPV pressure transient, the SRVs closed.

The crew then entered procedure EOP-02, Primary Containment Control and stabilized the plant. The licensee subsequently performed a controlled plant cooldown to Mode 4 per plant procedures.

For this specific event response, the procedural action directed by the Margins and Limits hardcard did not permit sufficient time for the operating crew to attempt nor complete the immediate actions of the ONI mitigating strategy to close the open SRVs prior to taking the unit off line. Although the operating crew was already implementing the mitigating actions for SPT greater than 95°F but less than 110°F (as discussed in the EOP-2 bases document), the crew did not enter EOP-02 until after the manual scram was inserted. The implementation of the actions in the Margins and Limits hardcard, as originally written, required the operators to prematurely take the unit off line prior to attempting the approved ONI actions to terminate the event. This also precluded the crew from entering EOP-02 and implementing the basis of the EOP-02 actions to enter EOP-01, RPV Control, prior to inserting a reactor scram. The details and enforcement associated with this issue are discussed in Section 4OA5.1.d(3) of this report.

(5) Review the licensees evaluation of the failure of the safety relief valve 41C to receive an open signal during the B reference leg upset condition.

The licensee performed troubleshooting that checked the SRV logic Initiation and computer points associated with SRV 41C. A signal was simulated into both trip units for the valve to verify the required relays actuated to energize the B coils for SRV 41C and 41G. The same relays closed a set of contacts that energized a third relay that provided a signal to the plant computer point. The troubleshooting verified all the circuitry functioned properly.

Review of the plant data collected during the actual event sampling at a rate of 10 milliseconds indicated that the initiation signal for the B coil for SRV 41G was present at 11 and 29 milliseconds, which were extremely short durations. The relays had a pick up time requirement of less than or equal to 30 milliseconds and a drop out time less than or equal to 25 milliseconds.

The licensee determined that based upon the pressure perturbation on the B RPV reference leg being an extremely short duration and the tolerances of the pickup and drop out relay operating times coupled with the computer sampling rate, it is suspected that if the perturbation had been slightly longer the computer point signal would have been observed.

The inspectors independently reviewed the licensee evaluation, troubleshooting documentation, applicable drawings and schematics and conducted interviews with station personnel and agreed with the licensees assessment of why SRV 41C did not have indication of an open signal.

(6) Review the licensees evaluation of the intermittent continuity on a control power fuse for A phase. Evaluate whether the licensees maintenance and testing program contributed to the installation of the faulty control power fuse and/or to the continued use of the defective fuse. Verify the design of the PT for the under voltage signal. Verify the adequacy of the design of the PT and fuse(s) considering its ability to cause a loss of both the plants offsite Division 1 alternate current (AC) source and its onsite Division 1 AC sources.

The licensees evaluation of the intermittent continuity for the control power fuse for the A phase is discussed in detail in Section 4OA5.c(2) of this report.

The inspectors reviewed the applicable maintenance and testing programs associated with the fuse that failed in the Division 1 safety bus and determined that neither program contributed to installing or continued use of a defective fuse in the Division 1 safety bus.

To verify the adequacy of the design of the PT and fuses for under voltage protection, the inspectors reviewed electrical drawings, schematics and design basis documents to verify compliance with applicable NRC requirements and industry standards.

The inspectors review of the design for the under voltage protection scheme for the Division 1 safety bus identified that the failure of the single secondary PT fuse was the cause for the safety bus to separate (spuriously) from offsite power even though there were no deficient conditions with the offsite power voltage. Specifically, the licensees design utilized a single voltage sensor that was shared between two relays in the under voltage trip logic. As a consequence of a shared voltage sensor between the under voltage relays, the overall under voltage protection did not constitute a coincidence logic as relative to the regulatory requirements contained in Branch Technical Position BTP PSB-1, Adequacy of Station Electric Distribution System Voltages, Revision 0, dated July 1981 (Appendix A to Standard Review Plan Chapter 8). This document provided guidance on technical requirements of the degraded voltage scheme, which the licensee committed to in USAR Section 8.3.1.1.2.9.a.2. A single malfunction in the voltage sensing circuit resulted in a trip of the offsite power source and precluded the onsite power source from performing its safety related function. The details and enforcement of this issue are discussed in Section 4OA5.d(2) of this report.

It should be noted that this condition exists on all three safety related buses.

(7) Based upon the licensees initial inability to locate where the other 15 AMP, Ferraz Shawmut fuses purchased from the vendor were installed in the plant, evaluate the licensees ability to verify plant configuration against their own standards and regulatory requirements. Evaluate the licensees plans to address plant configuration control and/or extent of condition.

After the team arrived on site, an inspection of the licensees programs for the control of purchased material, equipment, and services and identification and control of materials, parts, and components as prescribed in Title 10 CFR Part 50, Appendix B, began specific to the safety related fuses. Since the fuses were obtained from a vendor with an Appendix B quality assurance program, the inspection focused of those aspects associated with obtaining safety related parts from such vendors.

The inspectors reviewed the licensees program for the control of purchased material, equipment, and services by reviewing the applicable program implementing procedures.

Then, specific to the safety related fuses, the inspectors reviewed applicable purchase orders, quality control receiving inspection reports, the vendors dedication plans, the vendors certificate of conformance, and the vendor testing reports. From this review, the inspectors determined the licensee was in compliance with the requirements of Title 10 CFR Part 50, Appendix B with respect to how the safety related fuses were procured.

The inspectors reviewed the licensees program for identification and control of materials, parts, and components by reviewing the applicable program implementing procedures. Then, specific to the safety related fuses, the inspectors reviewed the applicable warehouse control documentation and work orders that utilized the safety related fuses. The inspectors determined that the licensee failed to maintain traceability of safety related fuses installed in safety related systems. The details and enforcement of this issue are discussed in Section 4OA5.1.d(4) of this report.

(8) Review the operators performance following the loss of shutdown cooling, including the subsequent restoration of shutdown cooling. Include an evaluation of the impact of any impediments encountered due to equipment reliability issues. Additionally, validate the temperature trend and heat up rate reported by the licensee.

The detailed sequence of events is provided in Attachment 5 of this report. At the time of the event at 1505 EST, February 11, 2016, the plant was in a forced outage and in cold shutdown (Mode 4) with residual heat removal (RHR) A (Division 1) operating in shutdown cooling mode. ESW pump A was operating to provide cooling for RHR A.

A loss of shutdown cooling occurred when the plant lost offsite power to the Division 1 4160 V safety related bus, EH11, which resulted in a loss of power to the RHR A and ESW A pumps. The loss of offsite power caused the Division 1 EDG to start to restore power to the safety bus. However, ESW pump A did not re-start to provide cooling water for the Division 1 EDG and operators manually shut down the EDG to prevent damage.

With the sustained loss of power to the Division 1 4160 V safety bus, the control room operators decided to shift shutdown cooling to the Division 2 RHR system rather than attempting restoration of Division 1 RHR system.

The inspectors validated the licensees assessment and actions taken to restore shutdown cooling by independently reviewing plant data gathered from the plant computer, operations logs, and interviews with station personnel who were on shift and on watch in the control room during the event. The inspectors also reviewed procedures relevant to the shutdown cooling system operation and maintenance procedures applicable to activities performed during the forced outage.

Due to maintenance activities being performed to verify that the RPV instrumentation reference leg purge panel lines were properly filled and vented prior to startup, the Division 1 shutdown cooling common suction isolation valve (1E12F0008) was de-energized open. This valve would have to be shut to support operation of the Division 2 RHR system for shutdown cooling. Operators were dispatched to shut the valve using the local hand-wheel since control power was not available with the loss of the Division 1 safety bus. The additional operator action to manually shut the valve did not adversely impact placing the Division 2 RHR system into service and the licensee was able to restore shutdown cooling using Division 2 equipment in 42 minutes, which was within the time to boil calculations.

The inspectors performed an independent calculation of the time remaining to boil following the loss of shutdown cooling, based on plant data retained for the event to validate the time available for the operators to complete restoration of shutdown cooling. The calculated time to boil was 115 minutes with an average reactor coolant system (RCS) heat up rate of 40.8°F per hour, which was consistent with the licensees assessment of the heat up during the event.

(9) Relative to the loss of the Division 1 4.16kV safety bus, determine if the licensee performed an adequate extent-of-condition evaluation to assess if the contributing cause to the continuity of the control power fuses have the potential to affect other safety related structures, system and components.

The licensee performed an apparent cause evaluation and a failure analysis of the failed fuse and determined that the reason for the failure was a manufacturing defect. The licensee also determined that there were twenty-two such fuses received from a vendor under the same batch number and some of these fuses were potentially installed in safety related systems, including all three safety buses. The licensee developed a work order to replace the fuses in the three secondary PT circuits for the Division 1 safety bus. Additionally, the licensee concluded that the Division 2 and 3 safety related bus fuses would not be immediately replaced based on the low probability of failure, the overall good performance of these type of fuses over the life of the plant, and the risk to the inservice B train of shutdown cooling.

The licensees extent of condition evaluation focused primarily on the failed fuse batch but did examine other fuses of similar characteristics for manufacturing defects.

However, the extent of condition evaluation did not evaluate other recent fuses failures in similar circuitry to identify the potential effect to other safety related structures, systems, or components.

The inspectors requested documentation on recent fuse failures including maintenance procedures, work orders, logs and condition reports for evaluation. Additionally, the inspectors requested drawings and schematics of selected safety related systems to review for potential vulnerabilities.

During this review, the inspectors examined CR 2016-02060. This CR documented that while operations attempted to restore the Unit 1 Division 1 normal charge to service on February 12, 2016, following the loss of the Division 1 safety bus event, the output voltage for the charger was low (123 VDC). Attempts to adjust the charger up to the normal float range were unsuccessful (did not generate more than 127.8 VDC output).

To allow troubleshooting on the Unit 1 Division 1 normal charger, the licensee restored the Unit 2 Division 1 normal charger. The troubleshooting discovered three failed fuses that were associated with the output of the primary power transformer which isolated the AC and direct current circuits and changed the input voltage to the required level. The fuses protected the circuit from a high overload condition. The licensee was performing a causal evaluation and developing corrective actions to address the issue. The inspection team lead discussed this issue with the senior resident inspector and the issue was turned over the resident staff for follow up inspection.

The inspectors had no additional issues with the licensees extent of condition evaluation to assess if the contributing cause to the continuity of the control power fuses had the potential to affect other safety-related structures, system and components.

(10) Review status and performance of the licensees safety related battery charger, prior to, during and following the loss of Division 1 4.16kV safety bus. Include the licensee actions of declaring the station battery chargers operable. During the loss of Division 1 4.16kV safety bus, Division 2 battery charger was out of service due to planned maintenance. For some time following the event, both safety related Division 1 and Division 2 batteries were discharging.

After the team arrived on site, the inspectors began review of the performance and status related to the station safety related battery chargers during the loss of the Division 1 safety bus. It was discovered that the Division 2 battery charger was in service prior to, during, and after the Division 1 safety bus loss event. This was verified through interviews and review of plant records including the operations log.

The Division 2 battery charger was switched from the normal charger to the swing charger earlier in the day to support a ground detection effort but had no effect on the operability of the Division 2 batteries.

The inspectors determined that during the time the Division 1 safety bus lost power, the Division 1 normal and swing chargers had no power and therefore not capable of charging the Division 1 batteries. Since the batteries were not charging, they began to discharge to power required instrumentation and equipment. Station operators recognized the batteries were discharging and lined up the Unit 2 Division 1 batteries in accordance with approved procedures to extend the time the instrumentation and equipment could be powered by batteries.

The inspectors determined there were no issues with respect to the Division 1 and 2 batteries and chargers during the loss of the Division 1 safety bus event.

d. Findings

(1) Coincidence Logic to Preclude Spurious Trips of the Offsite Power Source

Introduction.

The inspectors identified an unresolved item (URI) concerning the installed designed of the safety-related 4-kilovolt under voltage protection scheme.

Description.

On February 11, 2016, while the plant was shut down, a fuse failure in a bus voltage detection scheme resulted in the actuation of associated under voltage relays and a trip of the safety related EH11 bus. With the under voltage condition locked in, the Division 1 safety-related equipment remained unavailable when the Division 1 EDG started and powered up the EH11 bus. As a consequence of the under voltage scheme, the ESW pump for the EDG was not available to provide cooling water and the EDG was manually shut down by operators to prevent damage to the diesel engine.

By letter dated June 3, 1977, Statement of Staff Positions Relative to Emergency Power Systems for Operating Reactors (Agencywide Document Access and Management System (ADAMS) Accession No. 8111230342), the NRC requested all licensees, including Perry Nuclear Power Station, to assess the susceptibility of Class 1E electrical equipment to sustained degraded voltage conditions from offsite power sources and to the interaction between the offsite and onsite emergency power systems. In this same letter, the NRC requested that licensees compare the current design of the emergency power systems at plant facilities with the NRC staff positions and that licensees propose plant modifications, as necessary, to meet the NRC staff positions, or provide a detailed analysis which shows that the facility design has equivalent capabilities and protective features. The NRC staff subsequently issued BTP PSB-1, Adequacy of Station Electric Distribution System Voltages, Revision 0, dated July 1981 (Appendix A to Standard Review Plan Chapter 8), which provided additional guidance on technical requirements of the degraded voltage scheme.

The NRC staff in addressing Perrys design for conformance with BTP PSB-1, stated in Section 8.2.4.1 of the Safety Evaluation Report (SER) for Perry (ADAMS Accession No.

8211120305 dated May 31, 1982) that the applicant states in the FSAR that degraded voltage conditions for the Class 1E power system are detected by an under voltage protection system on each division The system includes specific coincident logic for each bus. The staff also stated that the applicant has committed to provide the final design of the first and second level under voltage protection of the safety equipment in conformance with the staff position, before plant startup. Therefore, the staff finds this to be acceptable pending confirmation of the set point values and analysis. The staff identified this item as Confirmatory Issue

(34) in the Section 1.0 of the SER. In Section 8.2.5 of this SER the staff also stated that on the basis of this review, the staff concludes that the offsite power system for Perry meets the requirements of GDC 17 and 18 and is, therefore, acceptable.

By letters dated June 8, 1982, and August 26, 1982, (ADAMS Accession No.

8206170298 and 820310416) the licensee provided details of the degraded voltage relay scheme to be utilized at Perry. In the August 26, 1982, letter, the licensee provided details associated with set point for the first level of under voltage protection.

Specifically the licensee stated that the first level of voltage protection had been changed to trip at 75 percent of motor rated voltage instead of 86 percent and the three second fixed time delay would still remain in effect. The licensee also stated the diesel generator start signal after the 15 second time delay for the second level of under voltage had been eliminated. The licensee attached sketches to clarify the logic for a typical bus under voltage protection scheme. However, the licensee did not provide a detailed description of how the attached sketch satisfied the requirements of BTP PSB-1. The August 1982 letter again states that the final design and set points will be established after a review of onsite preoperational test results. In a Supplemental Safety Evaluation Report (SSER 2) (ADAMS Accession No. 8301280169 dated January 13, 1983), the NRC staff acknowledged that based on information provided in the August 26, 1982 letter, the relays in the loss of power protection relays were arranged on a two-out-of-two coincident logic to initiate a timer with a 3-sec time delay.

The SSER also acknowledged that in the degraded grid voltage protection, the relays were arranged in a two-out-of-two coincident logic to initiate two separate time-delay relays. The staff stated that the applicants final design of the first and second level under voltage protection of safety equipment was acceptable; thus Confirmatory Issue

(34) listed in Section 1.10 of the SER, was satisfactorily resolved.

The licensee revised the USAR to document conformance with BTP PSB-1 and the requirements of Institute of Electrical and Electronics Engineers (IEEE) Std. 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations. Specifically, USAR Section 8.3.1.1.2.9.2 states that under voltage protection shall include coincidence logic on a per bus basis to preclude spurious trips of the offsite power source. This is in conformance with staff guidance stating that improper voltage protection logic can itself cause adverse effects on the Class 1E systems and equipment such as spurious load shedding of Class 1E loads from the standby diesel generators and spurious separation of Class 1E systems from offsite power.

The inspection team noted that the licensees installed design utilizes a single voltage sensor that is shared between two relays in the under voltage trip logic. As a consequence of a shared voltage sensor between both under voltage relays, the overall under voltage protection did not constitute a coincidence logic as stated in BTP PSB-1.

A single malfunction in the voltage sensing circuit resulted in a trip of the offsite power source and precluded the onsite power source from performing its safety related functions. As evidence by the February 11, 2016, event, a secondary potential transformer fuse failure caused the EH11 bus to separate from offsite power (even though there were no deficiencies in offsite power voltage) and resulted in shutdown of the division 1 EDG bus due to ESW being unavailable. The inspectors believe that this design is deficient in that there is no coincident logic to ensure that spurious trips are precluded as delineated in BTP PSB-1 Section B.1.c.

The licensee agrees that the issue relative to the failure of a single fuse resulting in actuation of both relays, satisfying the under voltage protection scheme logic, represented a design vulnerability. However, the licensee contended that this original design had been maintained, and was approved by the NRC during the initial licensing. Specifically, the licensee concluded, in a white paper addressing the SIT concerns, that The current design of the potential transformers fusing and the under voltage relays for the division 1 4160 V ESF bus is reflective of the original design and licensing basis. The NRC Staff reviewers clearly used PSB-1 in their review of the PNPP licensing and design bases. They were aided by the schematics contained in the following letter [First Energy Nuclear Operating Company (FENOC) letter docket Nos.

(50-440; 50-441), dated August 26, 1982]. They recognized and approved of the relays arrangement in a two-out-of-two coincident logic. (This is identified on the second schematic - reference Sheet 2 of 2 on lines 19 and 21, which address the time delay relays.) This design is reflective of PNPP's current design and is consistent with the original PNPP licensing basis. Additionally, the NRC stated in the SER that Perry meets the requirements of GDC 17 and 18.

This issue is considered an unresolved item (URI 05000440/201608-01) pending receipt of clarification of the design basis with respect to 4 Kilovolt safety bus under voltage protection scheme. (URI 05000440/2016008-01: Coincidence Logic to Preclude Spurious Trips of the Offsite Power Source)

(2) Failure to Provide Instructions to Completely Vent Reference Legs

Introduction.

A green finding and an associated non-cited violation (NCV) of Title 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, was self-revealed when the licensee failed to prescribe instructions appropriate to the circumstance into procedures for an activity affecting quality. Specifically, the licensee failed to incorporate instructions into procedures to fill and vent all portions of the reactor water level reference leg purge system.

Description.

On April 14, 2015, instrumentation and control technicians were performing surveillance instruction SVI-B21-T2223, Reactor Pressure Vessel level Instrument Check Valve Operability Test for 1H51-P1432 B and D, on the reactor water level reference leg purge system. As part of the surveillance, a nitrogen test rig was used to test operability of the check valves on the B and D reference leg purge panels. During performance of the surveillance, the control room received numerous unexpected annunciators and a reactor protection system half scram on low reactor water level.

Actual reactor water level was greater than 22 feet above the reactor flange when the unexpected annunciators and half scram signal were received.

The licensee determined the cause of the unexpected annunciators and half scram signal was a pressure perturbation on the instrumentation in the reference legs that was induced after the B and D reference leg purge panels were lined up to the respective reference legs without venting the panel. This put the system in an abnormal lineup, which was contrary to the procedural guidance. The licensee documented the issue in the CAP as CR 2015-05243.

As part of their corrective actions, the licensee determined that the panels would have to be filled and vented before returning the panels to service. On April 18, 2015, operators performed instrumentation maintenance instruction IMI-E2-55, -56, -57, and -58, Reference Leg Purge Panel Operation, Revision 6, to fill and vent purge panels A, B, C, and D, respectively. The inspectors noted that the procedures did not include measures to fill and vent the reference leg portion or the detectors in the reference leg portion of the system. Since there was indication of adverse interaction between the purge panels and reference leg, as evidenced by the half scram received during the surveillance, the reference leg portion and the detectors in the reference leg portion of the system should have been filled and vented.

Additionally, the inspectors noted that technicians documented in the procedure that gas was removed from all three legs of the B reference leg purge panel during the performance of IMI-E2-56. Contrary to guidance in maintenance administrative instruction MAI-0504, Plant Instrument Calibration and Maintenance, Steps 4.1.5.2 and Step 4.1.5.4, technicians did not write a condition report following the discovery of gas in the B purge panel and did not communicate with supervisors nor consult with system experts. The licensee supervision that reviewed the completed work order also did not question the documentation of gas removal from the system, which was an unexpected condition that needed to be resolved prior to continuing work activities.

Since the condition was not placed into the corrective action process at the time, no further consideration was given to venting the remaining portions of the reactor water level reference leg purge system.

On February 8, 2016, a pressure perturbation occurred affecting the instrumentation connected to the B reactor water level reference leg. The perturbation caused pressure and level indicators connected to the B reference leg to read alternatingly high and low for a period of approximately 90 milliseconds. As a result, a half scram signal for low reactor water level was received; a half group one isolation signal for high reactor water level was received; and an open signal was received by 18 of 19 SRVs due to high indicated pressure. A total of 13 SRVs actually opened and 11 of those then immediately closed.

The inspectors determined that a likely cause of the perturbation on the B reactor water level reference leg was air or gas introduction into the reactor water level reference leg purge system based on operational experience documented in Generic Letter 93-03.

As part of the corrective actions from the pressure perturbation on February 8, 2016, the A, B, C, and D purge panels and the B reference leg were filled and vented in accordance with instrument maintenance instructions. During these evolutions, three one-inch slugs of gas were found in the B purge panel and gas was vented from two pressure transmitters in the B reference leg.

Additionally, the licensee identified that there currently were no operating process existed to startup, secure, or fill and vent the reference leg purge system. The licensee documented this issue in CR 2016-02716 and assigned resolution of the issue in CR 2016-01866.

Analysis.

The failure to prescribe instructions appropriate to the circumstance into procedures for an activity affecting quality was a performance deficiency. Specifically, the licensee failed to incorporate instructions into procedures to fill and vent all portions of the reactor water level reference leg purge system. The performance deficiency was more than minor in accordance with IMC 0612, "Power Reactor Inspection Reports,"

Appendix B, "Issue Screening," dated September 7, 2012, because it was associated with the configuration control performance attribute of the Initiating Events cornerstone and adversely affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations and was therefore a finding. Specifically, gas left in the reactor water level instrument reference leg purge system during maintenance equipment alignment was known to have the potential to interfere with the proper operation of pressure and level indicators relied upon for safety functions, as documented in Generic Letter 93-03. Using IMC 0609, Attachment 4, Initial Characterization of Findings, and Appendix A, The Significance Determination Process for Findings at Power, issued June 19, 2012, the finding was screened against the Initiating Events cornerstone and determined to be of very low safety significance (Green) because the finding did not result in exceeding the RCS leak rate for a small loss of coolant accident (LOCA), cause a reactor trip, involve the complete or partial loss of a support system that contributes to the likelihood of, or caused, an initiating event and did not affect mitigation equipment.

The inspectors determined this finding had a cross-cutting aspect of challenge the unknown in the human performance area where individuals stop when faced with uncertain conditions and risks are evaluated and managed before proceeding.

Specifically, the technicians involved in the April 18, 2015, system recovery activities did not stop when faced with an uncertain condition, communicate with supervisors, or consult system experts to resolve the condition prior to continuing work activities. Since this condition was not placed into the corrective action process at the time, no further consideration was given to venting the reference leg portion of the reactor water level reference leg purge system [IMC 0310, H.11].

Enforcement.

Title 10 of the CFR, Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. The licensee established instrument maintenance instruction IMI-E2-56, B Reference Leg Purge Panel Operation, Revision 6 for filling and venting the B reactor water level reference leg purge system, an activity affecting quality.

Contrary to the above, on April 18, 2015, technicians failed to have a procedure for filling and venting the B reactor water level reference leg purge system appropriate to the circumstances. Specifically, the procedure used by the technicians, IMI-E2-56, did not include measures to fill and vent all portions of the B reference leg purge system. The licensee had identified that there currently were no operating process to startup, secure, or fill and vent the reference leg purge system and entered the issue into the CAP for resolution. Because this violation is of very low safety significance and was entered into the licensees CAP as CR 2016-01866, this violation is being treated as an NCV consistent with Section 2.3.2 of the NRC Enforcement Policy.

(NCV 05000440/2016008-02: Failure to Provide Instructions to Completely Vent Reference Legs)

(3) Hardcard Development Failed to Follow Procedure Review and Approval Process

Introduction.

The inspectors identified a finding of very low safety significance and an associated NCV of 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures and Drawings, for the licensees failure to follow fleet procedure NOP-SS-3001, Procedure Review and Approval, Revision 20, to ensure that a newly developed hardcard was properly reviewed and approved prior to implementation. Specifically, the licensee characterized the hardcard development and implementation as only an administrative change, and was thereby exempted from the fleet procedure review process for new procedures.

Description.

The inspectors performed an onsite review of the licensees event response to two safety relief valves inadvertently opening and remaining fully open with the plant operating at 100 percent reactor power. This event occurred on February 8, 2016. The inspectors identified that during the event response, the operating crew entered the off normal instruction ONI-B21-1, SRV Inadvertent Opening/Stuck Open, Revision 20, and was performing the required immediate actions to attempt to close the open SRVs. After approximately three minutes, the crew inserted a manual reactor scram when suppression pool average temperature reached 95°F, as directed by the Margins and Limits hardcard posted in the control room. Following the reactor scram and subsequent pressure transient, the SRVs closed and the crew entered procedure EOP-2, Primary Containment Control, and stabilized the plant.

The licensee subsequently performed a controlled plant cooldown to Mode 4 per plant procedures.

For this specific event response, the actions required by the hardcard did not permit sufficient time for the operating crew to attempt nor complete the immediate actions of the ONI mitigating strategy to close the open SRVs prior to taking the unit off line.

The operating crew was already implementing the mitigating actions of EOP-2 for suppression pool temperature greater than 95°F but less than 110°F as discussed in the EOP-2 bases document. However, the operating crew did not enter EOP-2 because the entry condition for EOP-2 is greater than 95°F for the suppression pool temperature.

The licensee entered EOP-2 after the manual scram was inserted at 95°F and average pool temperature continued to rise.

The specific EOP-2 bases document states, in a caution note at the beginning of Section 5.0, that Bases information SHALL NOT be used to direct plant operation.

Bases information is for reference use only. However, the EOP-2 bases document also states that the bases information provided the reasoning behind the actions taken during the performance of EOP-2. If the EOP-2 actions taken were not successful in mitigating the rise in suppression pool temperature, EOP-2 would direct the operator to enter EOP-1, RPV Control, BEFORE average suppression pool temperature reaches 110°F. At 110°F, a reactor scram is required by plant Technical Specifications.

Entering EOP-1 would ensure that, if possible, the reactor is scrammed before boron injection would be required and in anticipation of possible RPV depressurization in a subsequent EOP-2 step. The scram is effected indirectly, through entry of EOP-1, rather than through an explicit direction in EOP-2 to ensure that RPV water level, RPV pressure, and reactor power are properly coordinated following the scram.

The original Margins and Limits hardcard was developed as a corrective action from CR 2010-73493 to develop written guidance/strategy for response in a dynamic event to enhance crew performance. This included set points to take manual action prior to reaching automatic system initiation/actuation. Fleet procedure NOP-SS-3001, Procedure Review and Approval, Revision 20, was the implementing procedure for development of new procedures. As part of the development process prescribed by the fleet procedure, the licensee performed the required regulatory applicability determination (RAD) for the new procedure. The information provided in the RAD would be used to support the applicability of 10 CFR 50.59, and as necessary, the applicability of other regulatory requirements. During completion of the new hardcard RAD information, the licensee characterized the development of the new procedure as an administrative change, which precluded the applicability of 10 CFR 50.59 and any additional procedure change process activities associated with the 10 CFR 50.59 review process.

The implementation of the Margins and Limits hardcard as written, precluded entering EOP-2 and implementing the EOP-2 actions to enter EOP-1 prior to inserting a reactor scram. Additionally, in this specific instance where two SRVs opened and remained open at power due to an invalid actuation of the Low-Level-Set logic associated with the SRVs relief function, the hardcard required the operators to scram the reactor prior to performing the approved ONI actions to terminate the event.

The inspectors determined that the implementation of the hardcard was more significant than simply an administration change since the listed actions on the hardcard prescribed specific critical parameter set points and directed operators to take manual actions when those set points were reached. The 10 CFR 50.59 process would apply and further review to determine if the new procedure actions adversely affected any existing station procedures or equipment was required.

The licensee entered this issue into their CAP as CR 2016-03033, and planned to perform a causal review to ensure that actions taken in response to information provided in operations administrative instruction OAI-1703, Hardcards, have received appropriate review under 10 CFR 50.59. Separate CRs were also written to determine if the Margins and Limits hardcard actions should be repeated/incorporated into applicable off normal instructions (CR 2016-02723), and to review the information provided in plant administrative procedure PAP-0507, Perry Supplemental Procedure Requirements/Guidance, to determine if review requirements for operation administrative instructions should be revised (CR 2016-03309).

Analysis.

The inspectors determined that the failure to follow the licensees fleet procedure to ensure that a newly developed hardcard was properly reviewed and approved prior to implementation is a performance deficiency. Specifically, the licensee characterized the hardcard development and implementation as only an administrative change, and was thereby exempted from the fleet procedure review process for new procedures. The performance deficiency was more than minor in accordance with IMC 0612, "Power Reactor Inspection Reports," Appendix B, "Issue Screening," dated September 7, 2012, because, if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern. Specifically, by not performing review and approval activities in accordance with established procedures, the licensee may unintentionally challenge the operators by requiring equipment manipulation and by imposing unnecessary plant transients, which could result in unwarranted challenges to safety related equipment. Additionally, the performance deficiency was more than minor because it was associated with the procedure quality attribute of the Initiating Events cornerstone and adversely affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown, as well as power operations, and was therefore a finding. Using IMC 0609, 4, Initial Characterization of Findings, and Appendix A, The Significance Determination Process (SDP) for Findings at Power, issued June 19, 2012, the finding was screened against the Initiating Events cornerstone and determined to be of very low safety significance because the finding did not cause a reactor trip and the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition.

The inspectors determined this finding had a cross-cutting aspect of conservative bias in the area of human performance where individuals use decision making-practices that emphasized prudent choices over those that were simply allowable and a proposed action was determined to be safe in order to proceed, rather than unsafe in order to stop.

Specifically, when the licensee determined to develop the hardcard procedure as an administrative change, the decision precluded the opportunity for the licensee to properly evaluate that the procedure actions did not adversely impact existing station procedures and equipment [IMC 0310, H.14].

Enforcement.

Title 10 of the CFR, Part 50, Appendix B, Criterion V, Instructions, Procedures and Drawings, requires in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings of a type appropriate to the circumstances, and shall be accomplished in accordance with these instructions, procedures, or drawings. The licensee established fleet procedure NOP-SS-3001, Procedure Review and Approval, Revision 20, as the implementing activity for development of new procedures, an activity affecting quality.

Contrary to the above, around September 1, 2010, the licensee failed to comply with fleet procedure NOP-SS-3001, Procedure Review and Approval, when the Margins and Limits hardcard was initially developed and approved, and during the following four revisions, and ensure that the newly developed hardcard was properly reviewed and approved prior to implementation. Specifically, the licensee incorrectly characterized the hardcard development and implementation as only an administrative change, and thereby exempted the hardcard from the fleet review process for completing the required regulatory applicability determination. The licensee planned to perform a causal review to ensure that actions taken in response to information provided in operations administrative instruction OAI-17-03, Hardcards, have received appropriate review under 10 CFR 50.59. Because this finding was of very low safety significance and because the finding was entered into the licensee's CAP as CR 2016-03033, this violation is being treated as a NCV consistent with Section 2.3.2 of the NRC Enforcement Policy. (NCV 05000440/2016008-03: Hardcard Development Failed to Follow Procedure Change Process).

(4) Failure to Maintain Traceability of Safety Related Fuses

Introduction.

The inspectors identified a finding of very low safety significance and an associated NCV of 10 CFR 50, Appendix B, Criterion VIII, Identification and Control of Materials, Parts, and Components, for the licensees failure to assure that identification of items was maintained by appropriate means, either on the item or on records traceable to the item, as required throughout fabrication, erection, installation, and use of the item. Specifically, the licensee failed to maintain traceability of safety-related fuses installed in safety-related systems.

Description.

On February 11, 2016 with the plant shutdown, the Division 1, 4.16 kV safety bus EH-11 lost power. The Division 1 shutdown cooling system was in service at that time and the Division 1 shutdown cooling pump A tripped on a loss of power. The Division 1 EDG started and loaded on safety bus EH-11 as designed. However, the ESW pump A, which supplied cooling water to the EDG, did not start. Due to the absence of cooling water to the EDG, operators took manual action to secure the Division 1 EDG.

The licensee performed an investigation to determine why the Division 1 safety bus lost power. The licensee determined that intermittent continuity on the A phase secondary PT fuse, which was part of the voltage sensing circuitry for the safety bus, was the cause for the safety bus normal supply breaker opening and removing power to the safety bus.

Further investigation of the failed fuse revealed that the intermittent continuity was a result of a manufacturing defect where the fuse was not properly soldered at one end.

The same voltage sensing circuitry is used by the starting circuitry for the A ESW pump. As a result, the A ESW pump could not start and the EDG was unable to perform its safety function.

The inspectors asked the licensee what other safety related components had fuses similar to the failed fuse potentially installed in them. The licensee determined that the fuse that had failed was one of 22 fuses procured from a vendor in a single batch. The licensee was able to find 8 of the fuses from the batch, including the failed fuse, either in the warehouse or in the electrical maintenance shops. The remaining 14 fuses could not be positively located. The licensee reviewed procedure NOP-WM-4300, Order Execute Process, Revision 12, and existing work orders that may have utilized the fuses and determined that workers did not clearly document if the fuses were installed, returned to the warehouse or scrapped. The licensee also determined that safety related components that could have potentially defective fuses installed included the Division 2 and 3 safety-related buses. The licensee documented the issue in the CAP as CR 2016-02048 and CR 2016-02258.

Corrective actions being performed by the licensee include evaluating implementation of procedure NOP-WM-4300 for documenting use of parts in safety related systems and issuing work orders to determine where the potentially defective fuses are installed in the Division 2 and 3 safety related buses and replace them.

Analysis.

The inspectors determined that the failure to ensure that identification of items was maintained by appropriate means, either on the item or on records traceable to the item, as required throughout fabrication, erection, installation, and use of the item was a performance deficiency. Specifically, the licensee failed to maintain traceability of safety related fuses installed in safety-related systems. The performance deficiency was more than minor in accordance with IMC 0612, "Power Reactor Inspection Reports,"

Appendix B, "Issue Screening," dated September 7, 2012, because, if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern.

Specifically, identification and control measures were designed to prevent the use of incorrect or defective materials, parts or components which could render safety systems inoperable. Additionally, the performance deficiency was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences and was, therefore, a finding. Using IMC 0609, 4, Initial Characterization of Findings, and Appendix A, The Significance Determination Process for Findings at Power, dated June 19, 2012, the finding was screened against the Mitigating Systems cornerstone and determined to be of very low safety significance because the finding was not a deficiency affecting the design or qualification of mitigating structure, system or component, did not represent a loss of system safety function, did not represent an actual loss of function of a single train or two separate trains for greater than its allowed outage time, and did not represent an actual loss of safety function of one or more non-technical specification trains of equipment during shutdown for equipment designated as high safety significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The inspectors determined this finding affected the cross-cutting area of human performance in the aspect of documentation where the organization creates and maintains complete, accurate and up-to-date documentation. Specifically, a review by the licensee of existing work orders that may have utilized the fuses did not clearly document if the fuses were installed, returned to the warehouse or scrapped

[IMC 0310, H.7].

Enforcement.

Title 10 of the CFR, Part 50, Appendix B, Criterion VIII, Identification and Control of Materials, Parts, and Components, states that measures shall be established for the identification and control of materials, parts, and components, including partially fabricated assemblies. These measures shall assure that identification of the item is maintained by heat number, part number, serial number, or other appropriate means, either on the item or on records traceable to the item, as required throughout fabrication, erection, installation, and use of the item.

Contrary to the above, on February 23, 2016, the licensee did not ensure the measures established by the licensee for identification of items was maintained by heat number, part number, serial number, or other appropriate means, either on the item or on records traceable to the item, as required throughout fabrication, erection, installation, and use of the item. Specifically, safety related fuses installed in safety related equipment were not identifiable either on the fuses or on traceable records to the fuses as required during the installation and use of the fuses. Corrective actions being performed by the licensee include evaluating implementation of procedure NOP-WM-4300 for documenting use of parts in safety related systems and issuing work orders to determine where the potentially defective fuses were installed in the Division 2 and 3 safety related buses to replace them. Because this violation was of very low safety significance and was entered into the licensees CAP as CR 2016-02048 and CR 2016-02258, this violation was being treated as an NCV consistent with Section 2.3.2 of the NRC Enforcement Policy. (NCV 05000440/2016008-04: Failure to Maintain Traceability of Safety Related Fuses).

4OA6 Management Meetings

Exit Meeting Summary

The lead inspector conducted the following meetings with the licensee. The licensee acknowledged the issues presented. The inspectors confirmed that none of the potential report input discussed was considered proprietary.

• On March 28, 2016, the inspection results were presented to Mr. D. Hamilton and other members of the licensee staff in an interim exit.

• On May 13, 2016, the inspection results were presented to Mr. F. Payne and other members of the licensee staff in an exit.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

D. Hamilton, Site Vice President

F. Payne, Plant General Manager

S. Benedict, Operations Superintendent

T. Veitch, Chemistry Manager

C. Elliot, Radiation Protection Manager

J. Tuffs, Outage Management Manager

B. Baumgardner, Special Projects Manager

J. Pry, Work Management Manager

T. Brown, Performance Improvement Director

N. Conicella, Regulatory Compliance Manager

R. Strohl, Training Manager

R. OConnor, Emergency Planning Manager

D. Reeves, Site Engineering Director

D. Culler, Supervisor Mechanical Design

K. Nelson, Plant and Equipment Manager

P. Boissoneault, Program and Technical Services Manager

M. DeStefano, Fleet Oversite Manager

J. Archer, Supervisor Security Support

L. Zerr, Regulatory Compliance Supervisor

D. Lockwood, Regulatory Compliance Engineer

J. Severino, Regulatory Compliance Engineer

T. Kledzik, Regulatory Compliance Engineer

R. Briggs, Supervisor Design Engineering Electrical

M. McFarland, Superintendent Operations Training

P. Roney, Supervisor Nuclear Support Systems Engineering

B. Coad, Engineering Programs

B. Sutter, Superintendent Electrical Maintenance

T. Henderson, Fleet Licensing

S. Richardson, manager Supply Chain

D. Jenkins, First Energy Legal Department

U.S. Nuclear Regulatory Commission

B. Dickson, Division of Reactor Projects, Branch 5, Chief

L. Kozak, Division of Reactor Projects, Senior Reactor Analyst

W. Schaup, Division of Reactor Projects, Senior Resident Inspector, Clinton Power Station

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000440/2016008-01 URI Coincidence Logic to Preclude Spurious Trips of the Offsite Power Source (Section 4OA5.d.(1))

05000440/2016008-02 NCV Failure to Provide Instructions to Completely Vent Reference Legs (Section 4OA5.d.(2))

05000440/2016008-03 NCV Hardcard Development Failed to Follow Procedure Change Process (Section 4OA5.d.(3))

05000440/2016008-03 NCV Failure to Maintain Traceability of Safety Related Fuses (Section 4OA5.d.(4))

Closed

05000440/2016008-02 NCV Failure to Provide Instructions to Completely Vent Reference Legs (Section 4OA5.d.(2))

05000440/2016008-03 NCV Hardcard Development Failed to Follow Procedure Change Process (Section 4OA5.d.(3))

05000440/2016008-04 NCV Failure to Maintain Traceability of Safety Related Fuses (Section 4OA5.d.(4))

Discussed

None