IR 05000445/2015007

IR 05000445/2015007 and 05000446/2015007), June 1, 2015 Through August 3, 2015, Comanche Peak, Units 1 and 2, NRC Component Design Bases

ML15245A507
Person / Time
Site:	Comanche Peak
Issue date:	09/02/2015
From:	Thomas Farnholtz Region 4 Engineering Branch 1
To:	Flores R Luminant Generation Co
R. Kopriva
References
IR 2015007
Download: ML15245A507 (54)

Text

tember 2, 2015

SUBJECT:

COMANCHE PEAK NUCLEAR POWER PLANT, UNITS 1 AND 2 - NRC COMPONENT DESIGN BASES INSPECTION (05000445/2015007 AND 05000446/2015007)

Dear Mr. Flores:

On July 2, 2015, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Comanche Peak Nuclear Power Plant, Units 1 and 2. The NRC inspectors discussed the preliminary results of this inspection with Mr. K. Peters, Site Vice President, and other members of the licensee staff. On August 3, 2015, the final inspection results were discussed with Mr. T. McCool, Vice President, Engineering and Support, and other members of your staff. The licensee acknowledged the issues presented. The inspectors documented the results of this inspection in the enclosed inspection report.

The NRC inspectors documented four findings of very low safety significance (Green) in this report. Three of these findings involved violations of NRC requirements; and one of these violations was determined to be a Severity Level IV under the traditional enforcement process.

The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the Comanche Peak Nuclear Power Plant.

If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the Comanche Peak Nuclear Power Plant. In accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRCs Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Thomas R. Farnholtz, Chief Engineering Branch 1 Division of Reactor Safety Docket Nos. 05000445 and 05000446 License Nos. NPF-87 and NPF-89 Enclosure: Inspection Report 05000445/2015007 and 05000446/2015007 w/Attachment:

1. Supplemental Information 2. Request for Information - Component Design Bases Inspection Electronic Distribution for Comanche Peak Nuclear Power Plant

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 05000445 and 05000446 License: NPF-87 and NPF-89 Report No.: 05000445/2015007and 05000446/2015007 Licensee: Luminant Generation Company LLC Facility: Comanche Peak Nuclear Power Plant, Units 1 and 2 Location: 6322 N. FM-56, Glen Rose, Texas Dates: June 1 through August 3, 2015 Team Leader: R. Kopriva, Senior Reactor Inspector, Engineering Branch 1 Inspectors: C. Smith, Reactor Inspector, Engineering Branch 1, Region IV J. Watkins, Reactor Inspector, Engineering Branch 2, Region IV A. Palmer, Senior Reactor Technology Instructor, Technical Training Center Accompanying C. Baron, Mechanical Contractor, Beckman and Associates Personnel: S. Kobylarz, Electrical Contractor, Beckman and Associates Approved By: Thomas R. Farnholtz Chief, Engineering Branch 1 Division of Reactor Safety-1- Enclosure

SUMMARY IR 05000445/2015007 and 05000446/2015007; 06/01/2015 - 07/03/2015; Comanche Peak Nuclear Power Plant; Component Design Basis Inspection.

The inspection activities described in this report were performed between June 1, 2015, and August 3, 2015, by three inspectors from the NRCs Region IV office, one instructor from the NRCs Technical Training Center, and two contractors. Four findings of very low safety significance (Green) are documented in this report. Three of these findings involved violations of NRC requirements; and one of these violations was determined to be Severity Level IV under the traditional enforcement process. The significance of inspection findings is indicated by their color (Green, White, Yellow, or Red), which is determined using Inspection Manual Chapter 0609, Significance Determination Process. Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, Aspects Within the Cross-Cutting Areas.

Violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process.

Cornerstone: Mitigating Systems

• Green. The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, which states, in part, Measures shall be established to assure that applicable regulatory requirements and the design basis, for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures, and instructions. The design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, prior to June 18, 2015, the licensee failed to check the adequacy of the design by performing an analysis or test that demonstrated that the Class 1E inverters would continue to operate reliably when subjected to the effects of electrical faults that could be postulated to occur at non-Class loads, due to a lack of seismic qualification of the loads, during and after a design basis loss-of-offsite power and seismic event. In response to this issue, the licensee performed an analysis of the condition and an operability determination, and concluded, upon their review of all non-1E loads connected to 1E inverters, that the load protective devices would actuate in time to prevent a loss of function to the 1E loads.

This finding was entered into the licensees corrective action program as Condition Report CR-2015-005530.

The team determined that the failure to evaluate the fault clearing capability of the Class 1E inverters was a performance deficiency. This finding was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to evaluate the fault clearing capability of the inverter during design basis loss of offsite power and seismic conditions which resulted in a reasonable doubt on the operability of the system. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance-2-

Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not result in the loss of operability or functionality, did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. The team determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance. (Section 1R21.2.7.b.1)

• Green. The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, which states, in part, Measures shall be established to assure that applicable regulatory requirements and the design basis, for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures, and instructions. Specifically, prior to June 30, 2015, the licensee did not correctly evaluate the inverter output loading by assuming an incorrectly low demand factor, and also did not correctly identify the inverter efficiency when determining the inverter input d-c power required from the Class 1E station battery. In response to this issue, the licensee performed an operability evaluation and reevaluated the battery inverter loads. The corrected inverter loads were compared with the inverter load performance test data. Based on Design Engineering bounding calculations, all of the safety-related battery inverters remained operable and capable of meeting the four hour mission time. This finding was entered into the licensees corrective action program as Condition Report CR-2015-005805.

The team determined that the failure to correctly evaluate the inverter input d-c power requirement was a performance deficiency. The finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to correctly evaluate the inverter input d-c power requirements that resulted in a condition where there was reasonable doubt on the operability of the system. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not result in the loss of operability or functionality, did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather.

The team determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

(Section 1R21.2.7.b.2)

• Green. The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, which states, in part, Activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in-3-

accordance with these instructions, procedures, or drawings. Instructions, procedures, or drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Operability Determination Procedure STI-422.01 Step 6.2 G, states in part, ODs should be documented in sufficient detail so the basis for the determination can be understood during subsequent reviews.justification for the basis of the operability should be documented. Specifically, on May 4, 2015, the licensee had performed an operability determination for tornado driven missiles impacting the diesel generator fuel oil vent piping. The licensee failed to follow the operability evaluation procedure in that they did not adequately justify the basis of the operability. The team identified that the licensee had not adequately justified the exclusion of horizontally generated missiles in their analysis. In response to this issue, the licensee re-performed the operability determination, using a revised analysis using the correct parameters for horizontal missiles generated by a tornado, and concluded that the diesel generators would still perform their safety function. This finding was entered into the licensees corrective action program as Condition Report CR 2015-005848.

The team determined that the licensees failure to follow procedure for performing an operability determination for the diesel generator fuel oil vent piping was a performance deficiency. This finding was more than minor because it was associated with the protection against external factors attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to adequately document the basis for operability of the diesel generator system because it excluded horizontal tornado missiles in the analysis. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. The team determined that this finding had a crosscutting aspect in the area of problem identification and resolution, because the organization failed to thoroughly evaluate issues to ensure that resolutions address causes and extent of conditions commensurate with their safety significance (P.2). (Section 1R21.2.11)

Severity Level IV/Green. The team identified a Severity Level IV, non-cited violation of 10 CFR 50.59, Changes, Test, and Experiments, which states in part, Section (c)(1), that a licensee may make changes in the facility as described in the Updated Safety Analysis Report without obtaining a license amendment pursuant to 10 CFR 50.90 only if: (i) a change to the technical specifications incorporated in the license is not required, and (ii) the change, test, or experiment does not meet any of the criteria in paragraph (c)(2). Section(c)(2), states in part, A licensee shall obtain a license amendment pursuant to Section 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would: (ii) Result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system,

-4-

or component (SSC) important to safety previously evaluated in the final safety analysis report. Specifically, on March 12, 2013, the licensee performed a 10 CFR 50.59 evaluation for the unprotected turbine driven auxiliary feedwater pump exhaust stack, and during the Applicability Determination phase, determined that exempting the exhaust stack from being protected was acceptable without NRC approval. The licensee failed to recognize that the proposed change would result in more than a minimal increase in the likelihood that the turbine driven auxiliary feedwater pumps steam exhaust piping would be susceptible to tornado driven missiles during a station black out, when the turbine driven auxiliary feedwater pump would be required to be operational. In response to this issue, the licensee has demonstrated that the auxiliary feedwater system is capable of safely shutting down the plant in the event of a tornado missile strike on the turbine driven auxiliary feedwater pumps steam exhaust piping and the single failure of an additional auxiliary feedwater pump. This finding was entered into the licensees corrective action program as Condition Report CR-2015-007625.

The team determined that the licensees failure to implement the requirements of 10 CFR 50.59 and adequately evaluate changes to determine if prior NRC approval is required was a performance deficiency. Because this performance deficiency had the potential to impact the NRCs ability to perform its regulatory function, the team evaluated the performance deficiency using traditional enforcement. In accordance with Section 2.1.3.E.6 of the NRC Enforcement Manual, the team evaluated this finding using the significance determination process to assess its significance. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. In accordance with Section 6.1.d.2 of the NRC Enforcement Policy, the team characterized this performance deficiency as a Severity Level IV violation. The team determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance. (Section 1R21.2.16)

1. REACTOR SAFETY Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity This inspection of component design bases verifies that plant components are maintained within their design basis. Additionally, this inspection provides monitoring of the capability of the selected components and operator actions to perform their design basis functions. As plants age, modifications may alter or disable important design features making the design bases difficult to determine or obsolete. The plant risk assessment model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems and Barrier Integrity cornerstones for which there are no indicators to measure performance.

-5-

1R21 Component Design Basis Inspection (71111.21)

.1 Overall Scope To assess the ability of the Comanche Peak Nuclear Power Plant, Units 1 and 2, equipment and operators to perform their required safety functions, the team inspected risk significant components and the licensees responses to industry operating experience. The team selected risk significant components for review using information contained in the Comanche Peak Nuclear Power Plant, probabilistic risk assessments and the U. S. Nuclear Regulatory Commissions (NRC) standardized plant analysis risk model. In general, the selection process focused on components that had a risk achievement worth factor greater than 1.3 or a risk reduction worth factor greater than 1.005. The items selected included components in both safety-related and nonsafety-related systems including pumps, circuit breakers, heat exchangers, transformers, and valves. The team selected the risk significant operating experience to be inspected based on its collective past experience.

To verify that the selected components would function as required, the team reviewed design basis assumptions, calculations, and procedures. In some instances, the team performed calculations to independently verify the licensees conclusions. The team also verified that the condition of the components was consistent with the design basis and that the tested capabilities met the required criteria.

The team reviewed maintenance work records, corrective action documents, and industry operating experience records to verify that licensee personnel considered degraded conditions and their impact on the components. For selected components, the team observed operators during simulator scenarios, as well as during simulated actions in the plant.

The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design basis have been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions because of modifications, and margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as failed performance test results; significant corrective actions; repeated maintenance; Title 10 CFR 50.65(a)1 status; operable, but degraded, conditions; NRC resident inspectors input of problem equipment; system health reports; industry operating experience; and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in-depth margins.

The inspection procedure requires a review of 15 to 25 total samples that include risk-significant and low design margin components, components that affect the large-early-release-frequency (LERF), and operating experience issues. The sample selection for this inspection was 17 components, 1 components that affect LERF, and 4 operating experience items. The selected components and associated operating experience items supported risk significant functions including the following:

-6-

a. Electrical power to mitigation systems: The team selected several components in the electrical power distribution systems to verify operability to supply alternating current (ac)

and direct current (dc) power to risk significant and safety-related loads in support of safety system operation in response to initiating events such as loss of offsite power, station blackout, and a loss-of-coolant accident with offsite power available. As such the team selected:

• Unit 1 and 2 Reactor Water Storage Pressure Transmitters for Level Indication

• Unit 1 and 2 Class 1E Molded Case Circuit Breakers

• Unit 2 Safety-Related Battery Charger BC2ED1-1 (DCP-BCH-2ED1-1)

• Unit 1 Safety-Related 125 VDC Station Batteries BT1ED1 and BT1ED2

• Unit 1 Safety Injection Pump 12 Motor

• Unit 2 Offsite Power CRB-2EA2-1 (ACP-CRB-1EA21)

• Unit 1 118V AC Class 1E Uninterruptible Power Supply Static Inverter IV2PC2

• Unit 1 480V Switchgear 1EB4

• Unit 1 480V MCC 1EB4-1

• Unit 1 Diesel Generator 1EG2 Starting Circuitry b. Components that affect LERF: The team reviewed components required to perform functions that mitigate or prevent an unmonitored release of radiation. The team selected the following components:

• Unit 1 Safety Injection Pump SIP-02 and SI Pump piggyback valve 8804B.

[Pump Mechanical Seals and Valve Packing (LERF)]

c. Mitigating systems needed to attain safe shutdown: The team reviewed components required to perform the safe shutdown of the plant. As such the team selected:

• Unit 1 Emergency Diesel Generator fuel oil system (including tanks, transfer pumps, and valves)

• Unit 1 Replacement Steam Generators

• Unit 2 Service Water Train B Pump (MDP P02) and associated Service Water System Vacuum Breaker

• Service Water Pond (Ultimate Heat Sink)

• Unit 2 - Turbine Driven Auxiliary Feedwater Pump

• Main Steam isolation Valve Solenoid Valves-7-

.2 Results of Detailed Reviews for Components

.2.1 Unit 1 and 2 Reactor Water Storage Tank Pressure Transmitters for Level Indication a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Unit 1 Reactor Water Storage Tank pressure transmitters for level transmitters. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function.

Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

• Sizing calculations, setpoint calculations, elevation offset calculations, design specifications, installation drawings, modifications and upgrades made to the pressure transmitters.

• Vendor manual, procedures for preventive maintenance, procedures for calibrations, inspection, and testing to compare maintenance practices against industry and vendor guidance.

b. Findings No findings were identified.

.2.2 Unit 1 Class 1E Molded Case Circuit Breakers a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Unit 1 Unit 1 Class 1E Molded Case Circuit Breakers. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Maintenance and testing activities performed on the breakers in accordance with industry standards

• Mechanical condition of breaker operating mechanisms

• Condition reports-8-

• Plan to replace breakers due to mechanical operator problems caused by aging b. Findings No findings were identified.

.2.3 Unit 2 Safety-Related Battery Charger BC2ED1-1 (DCP-BCH-2ED1-1)

a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Unit 2 Safety-Related Battery Charger BC2ED1-1 (DCP-BCH-2ED1-1). The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function.

Specifically, the team reviewed:

• Short circuit calculations

• Sizing calculations

• Voltage drop calculations

• Design specifications

• Installation drawings

• Modifications made to the battery chargers

• Maintenance activities performed on the battery chargers

• Electrolytic capacitor replacement program

• The material condition of the battery chargers to ensure the battery charger design criteria and maintenance requirements are met b. Findings No findings were identified.

.2.4 Unit 1 Safety-Related 125 Vdc Batteries BT1ED1 and BT1ED2 a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations,

-9-

maintenance and test procedures, and condition reports associated with 125 Vdc Batteries BT1ED1 and BT1ED2. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

• Calculations for electrical distribution, system load flow/voltage drop to verify that bus capacity and voltages remained within minimum acceptable limits.

• Sizing calculations to verify input assumptions, design loading, and environmental parameters are appropriate and that the battery cell is sized to perform the battery design basis function.

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

• Battery testing methodology was conducted to verify the batteries are being tested to ensure that design requirements are being met.

• Seismic tests and analysis, battery vendor manual, maintenance activities performed on the batteries.

b. Findings No findings were identified.

.2.5 Unit 1 Safety Injection Pump 12 Motor a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Unit 1 Safety Injection Pump 12 Motor. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Pump maximum brake horsepower requirement to confirm motor rating.

• Adequacy of motor starting and running during degraded voltage conditions.

• Motor breaker overcurrent relay settings for adequacy of margin during design basis conditions, motor and feeder protection, and breaker coordination.

• Protective relay calibration test results to confirm proper operation.

- 10 -

b. Findings No findings were identified.

.2.6 Unit 2 Offsite Power CRB-2EA2-1 (ACP-CRB-1EA21)

a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Unit 2 Offsite Power CRB-2EA2-1 (ACP-CRB-1EA21). The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Loss of Offsite Power (LOOP) scenarios which involved failures of the switchyard breaker to one of the ESF buses

• Shutting the respective Diesel Generator breaker to re-power the bus

• Powering the loads on the Engineered Safety Features bus, but also powering the downstream side of the offsite transformer

• The licensees evaluation of all the risk significant activities associated with the loss of offsite power

• The licensees corrective action program Condition Report CR- 2015-005034, which provided clarification of use of the Unit 2 Offsite Power CRB-2EA2-1 (ACP-CRB-1EA21) during a loss of offsite power b. Findings No findings were identified.

2.7 Unit 1 118V AC Class 1E Uninterruptible Power Supply Static Inverter IV2PC2 a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Unit 1 118V AC Class 1E Uninterruptible Power Supply Static Inverter IV2PC2. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function.

Specifically, the team reviewed:

- 11 -

• Inverter fault current clearing capability for postulated faults of non-Class 1E circuits during design basis conditions.

• Load study for adequacy of inverter and system cable sizing.

• Periodic testing to confirm inverter system design features and rated output capability.

• Inverter d-c input power requirements for design basis load conditions.

• Manufacturer recommended preventive maintenance performed during periodic maintenance activities.

b. Findings (1) Failure to evaluate inverter fault interrupting capability during design basis loss of offsite power and seismic conditions Introduction. The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to evaluate whether the Class 1E inverters were capable of interrupting faults in non-Class 1E circuits, when the inverter AC bypass source was not available, while supplying sufficient power to reliably operate the safety-related loads on the power system. Specifically, the licensee failed to perform an analysis or test that demonstrated that the Class 1E inverters would continue to operate reliably when subjected to the effects of electrical faults that could be postulated to occur at non-Class loads, due to a lack of seismic qualification of the loads, during and after a design basis loss of offsite power and seismic event.

Description. The team found that the essential inverters, in each of the four (4) safety-related instrumentation power channels, provided an uninterruptible 120 Vac power supply to safety-related plant protection system equipment and other safety-related Class 1E systems and equipment in the power channel through a Class 1E breaker distribution panel. In addition, the inverter backed Class 1E breaker distribution panel provided power to non-Class 1E system equipment through two (2) non-Class 1E fuses provided in series to the non-Class 1E equipment. The team found the inverter itself was not capable of interrupting faults on its output in all cases, and therefore relied on an automatic transfer to an alternate a-c bypass source designed and sized to provide sufficient current to operate the breakers and fuses that protect circuits from faulted conditions. However, during a design basis loss of offsite power event, the bypass source would not be available during the time period when the loss of offsite power occurred and before the diesel generator was supplying standby power to the Class 1E electric power system.

The team was concerned that if the bypass a-c source was not available, such as during a loss of offsite power condition when the diesel generator has not yet provided power to the inverter bypass a-c source, the inverter could go into a current limiting condition when providing current to a postulated faulted non-Class 1E circuit. The current limiting condition is an inherent protection feature of the inverter, whereby the voltage output of

- 12 -

the inverter collapses as a result of a current overload condition that is above the inverter rated output capability. The team requested the licensees fault current and coordination study for the condition when only the inverter is available to supply the necessary fault current for the protective devices to operate and found that the licensees staff had not evaluated this condition.

The licensee initiated Condition Report CR-2015-005530 to evaluate the condition. The licensee performed an operability evaluation that determined for the worse case circuit that the non-Class 1E fuses, that were provided for electrical isolation to satisfy Regulatory Guide 1.75 separation requirements, would operate sufficiently fast during a postulated non-Class 1E circuit fault condition to protect the inverter from entering current limiting conditions that would adversely affect the inverter output voltage. The team concluded that the licensees immediate operability evaluation did provide adequate assurance that the Class 1E equipment on the inverter power system would continue to operate reliably during the postulated non-Class 1E circuit fault clearing event.

Analysis. The team determined that the failure to evaluate the fault clearing capability of the Class 1E inverters was a performance deficiency. This finding was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to evaluate the fault clearing capability of the inverter during design basis loss of offsite power and seismic conditions which resulted in a reasonable doubt on the operability of the system. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not result in the loss of operability or functionality, did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. The team determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement. The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, which states, in part, Measures shall be established to assure that applicable regulatory requirements and the design basis, for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures, and instructions. The design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, prior to June 18, 2015, the licensee failed to verify or check the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, the licensee failed to verify or check the adequacy of the design by performing an

- 13 -

analysis or test that demonstrated that the Class 1E inverters would continue to operate reliably when subjected to the effects of electrical faults that could be postulated to occur at non-Class loads, due to a lack of seismic qualification of the loads, during and after a design basis loss-of-offsite power and seismic event. In response to this issue, the licensee performed an analysis of the condition and an operability determination, and concluded, upon their review of all non-1E loads connected to 1E inverters, that the load protective devices would actuate in time to prevent a loss of function to the 1E loads.

This finding was entered into the licensees corrective action program as Condition Report CR 2015-005530. Because this finding was of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000445/2015007-01, Failure to Evaluate Inverter Fault Interrupting Capability During Design Basis Loss of Offsite Power and Seismic Conditions.

(2) Failure to validate inverter output demand factor and to use the correct value of inverter efficiency when determining inverter input d-c power requirements Introduction. The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the failure to correctly evaluate the input d-c power required from the station battery during design basis conditions. Specifically, the licensee did not correctly evaluate the inverter output loading by assuming and failing to validate an 80 percent demand factor that was applied to the calculated load.

The licensee also did not correctly identify the inverter efficiency, when determining the inverter input d-c power required from the Class 1E station battery, by non-conservatively considering the inverter efficiency at full load (100 percent loaded)

conditions when the inverter was approximately 70 percent loaded.

Description. The team found on review of the licensees bus based calculation for the d-c bus that provides input power to the inverter, that the inverter output load was incorrectly determined by assuming a demand factor of 0.8. Since the load circuits powered by the uninterruptible power supplied by the inverter are all normally energized, the team was concerned that most inverter loads operate at closer to a 1.0 demand condition than a 0.8 demand condition. The team found during discussion with the licensee that the inverter demand was a calculation assumption that the licensee had not verified and validated for correctness. The team also found the inverter efficiency chosen was for inverter full load (100 percent load) conditions. On review of inverter test data, the team found that the use of full load efficiency was non-conservative (overestimated), because the inverter is operated at much less than full load during design basis accident conditions (at approximately 70 percent inverter output loading)

which results in a lower efficiency than at full load. Both of these errors contributed to underestimating the d-c power required by the inverter during battery system minimum voltage conditions.

The licensee initiated Condition Report CR-2015-005805 to evaluate the condition. The licensee performed an immediate operability determination that considered the worst case inverter loading at a 1.0 power factor condition, which is a bounding case, and applied the inverter efficiency applicable for the design basis load condition. The licensees analysis to support the operability determination considered a conservative

- 14 -

d-c power requirement for the inverter for the design basis 105 volts d-c minimum battery voltage condition, that was higher than previously evaluated and which would result in a reduction in the available margin to the inverter minimum input d-c voltage of 100 volts. The team found the licensees evaluation that supported the immediate operability determination confirmed with a high level of confidence that adequate d-c voltage was available at the inverter input, when considering the higher inverter d-c input load current, and confirmed the Class 1E station battery remained adequately sized for the increased inverter input d-c power requirement.

Analysis. The team determined that the failure to correctly evaluate the inverter input d-c power requirement was a performance deficiency. The finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to correctly evaluate the inverter input d-c power requirements that resulted in a condition where there was reasonable doubt on the operability of the system. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not result in the loss of operability or functionality, did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather.

The team determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement. The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, which states, in part, Measures shall be established to assure that applicable regulatory requirements and the design basis, for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, prior to June 30, 2015, the licensee failed to correctly translate design basis information into specifications, drawings, procedures, and instructions. Specifically, the licensee did not correctly evaluate the inverter output loading by assuming an incorrectly low demand factor, and also did not correctly identify the inverter efficiency when determining the inverter input d-c power required from the Class 1E station battery. In response to this issue, the licensee performed an operability evaluation and reevaluated the battery inverter loads. The corrected inverter loads were compared with the inverter load performance test data. Based on Design Engineering bounding calculations, all of the safety-related battery inverters remained operable and capable of meeting the four hour mission time. This finding was entered into the licensees corrective action program as Condition Report CR 2015-005805. Because this finding was of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000445/2015007-02, Failure to Validate Inverter Output Demand Factor and to Use the Correct Value of Inverter Efficiency When Determining Inverter Input D-C Power Requirements.

- 15 -

.2.8 Unit 1 480V Switchgear 1EB4 a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Unit 1 480V Switchgear 1EB4. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Switchgear and breaker ratings for adequacy for calculated maximum design basis load and short circuit current.

• Periodic testing to confirm proper operation of transformer auxiliary devices.

• Manufacturer recommended preventive maintenance performed during periodic maintenance activities.

• Breaker overcurrent relay settings for adequacy of margin during design basis conditions, bus and transformer protection, and breaker coordination.

• Protective relay calibration test results to confirm proper operation for bus and transformer protection.

b. Findings No findings were identified.

.2.9 Unit 1 480V MCC 1EB4-1 a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Unit 1 480V MCC 1EB4-1. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Motor control center bus and breaker ratings for adequacy for calculated maximum design basis load and short circuit current

• Manufacturer recommended preventive maintenance performed during periodic maintenance activities

- 16 -

• Motor control center incoming feeder breaker overcurrent relay settings for adequacy of margin during design basis conditions and breaker coordination

• Protective relay calibration test results to confirm proper operation for bus protection b. Findings No findings were identified.

.2.10 Unit 1 Diesel Generator 1EG2 Starting Circuitry a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Unit 1 Diesel Generator 1EG2 Starting Circuitry. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Control circuit schematic diagrams to identify required components and functional requirements

• Vendor data for field flash, diesel generator circuit breaker closure and starting air solenoid voltage requirements to confirm adequacy for design basis minimum voltage conditions b. Findings No findings were identified.

.2.11 Unit 1 Diesel Generator fuel oil system (including tanks, transfer pumps, and valves).

a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Unit 1 Diesel Generator fuel oil system. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation

- 17 -

• Calculations for the fuel oil transfer pumps to verify the pumps were capable of transferring diesel fuel under all conditions

• Calculations for the diesel fuel storage tank and day tanks to verify the sizing was adequate to supply fuel to the diesel system for 7 days, and that they were designed to prevent excessive cycling of the transfer pumps

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance

• Calculations to verify the diesel building structure was adequate to meet the design code b. Findings Introduction. The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the licensees failure to follow procedures for performing an operability determination. The procedure requires adequate documentation for the basis of operability. Contrary to this requirement, the licensee did not document an adequate engineering basis for operability when evaluating tornado missile protection for the diesel generator fuel vents.

Specifically, the basis for operability excluded non-vertical tornado missiles without adequate engineering justification or documentation.

Description. In a self-assessment performed prior to the inspection, the licensee identified that the diesel generator fuel tank ventilation piping was not protected from tornado missiles. The ventilation piping on the diesel fuel day tank extends through the roof of the diesel building approximately 8 inches and has a cast iron flame arrestor bolted to the top. A potential missile strike from a tornado may crimp the exposed portions of the vent system, which could affect the operability of the diesel generators.

As a result, the licensee generated CR 2015-004077 and performed an operability determination.

The operability determination concluded that the non-safety-related diesel fuel oil tank vent piping would not be affected by tornado missiles because the diesel building roof configuration would only permit a vertical missile to strike the vent and horizontal or lateral missiles were unable to damage the vents. The licensees basis for excluding horizontal or lateral missiles in the operability determination was a perimeter wall that extends 4 feet above the roof of the EDG building. The team challenged the evaluation after observing that the perimeter wall has an opening in the wall for rain runoff. This opening is approximately 6 foot wide, which would provide an open missile path to the vent piping. The team verified the final safety analysis report and design basis documents stated that tornado missiles are capable of striking a target in any direction.

In addition, the team reviewed Calculation 0218-CS-0346, which was an additional input to the operability assessment. The calculation incorrectly concluded that the vent piping on the roof was adequately protected from tornado missiles.

- 18 -

The team challenged the technical basis documented in the operability evaluation (tornado missiles coming from any direction other than vertical are not credible) based on their observations. As a result, the licensee performed an additional calculation that concluded that the diesel tank oil vent piping was vulnerable to tornado missiles coming from all directions and evaluated the potential effects of the missile impacts. The calculation analyzed missile impacts of the vent piping coming from all directions (including horizontal tornado missiles) and concluded the vent piping would shear or tear, but still provide a vent path. The licensee updated the operability determination to reflect the new information from the calculation.

Analysis. The team determined that the licensees failure to follow procedure for performing an operability determination for the diesel generator fuel oil vent piping was a performance deficiency. This finding was more than minor because it was associated with the protection against external factors attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to adequately document the basis for operability of the diesel generator system because it excluded horizontal tornado missiles in the analysis. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. The team determined that this finding had a crosscutting aspect in the area of problem identification and resolution, because the organization failed to thoroughly evaluate issues to ensure that resolutions address causes and extent of conditions commensurate with their safety significance (P.2).

Enforcement. The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, which states, in part, Activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Instructions, procedures, or drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Operability Determination Procedure STI-422.01 Step 6.2 G, states in part, ODs should be documented in sufficient detail so the basis for the determination can be understood during subsequent reviewsjustification for the basis of the operability should be documented. Contrary to the above, on May 4, 2015, the licensee failed to adequately justify the design basis analysis used for the operability determination. Specifically, the licensee had performed an operability determination for tornado driven missiles impacting the diesel generator fuel oil vent piping. The licensee failed to follow the operability evaluation procedure in that they did not adequately justify the basis of the operability. The team identified that the licensee had not adequately justified the exclusion of horizontally generated missiles in their analysis. In response to this issue,

- 19 -

the licensee re-performed the operability determination, using a revised analysis using the correct parameters for horizontal missiles generated by a tornado, and concluded that the diesel generators would still perform their safety function. This finding was entered into the licensees corrective action program as Condition Report CR 2015-005848. Because this finding was of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000445/2015007-03 and 05000446/2015007-03 Failure to Follow Operability Determination Procedure for Tornado Missile Impact of Diesel Vents.

.2.12 Unit 1 Replacement Steam Generators a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Unit 1 Replacement steam generators. The team also conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation

• Pipe stress calculations for the reactor coolant system connected to the replacement steam generators, to verify the design met all the required codes and standards within acceptable limits

• Structural calculations to verify the replacement steam generators would remain functional after a design basis accident

• Design changes for the modified auxiliary feedwater system, main feedwater system, and main steam system supports b. Findings No findings were identified.

.2.13 Unit 1 Safety Injection Pump SIP-02 and SI Pump piggyback valve 8804B a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Unit 1 -

Safety Injection Pump SIP-02 and Safety Injection Pump piggyback valve 8804B. The team also performed walkdowns and conducted interviews with system engineering

- 20 -

personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation

• Analysis of potential common mode passive failures to verify the capability of the emergency core cooling system to mitigate design basis accidents

• Calculations of pump flow and net positive suction head capacity to verify the capability of the pump to provide required flow to mitigate design basis accidents

• Surveillance test procedures and recent results to verify the actual capability of the pump

• Calculations of motor-operated valve 8804 thrust and torque, pressure locking and thermal binding, and differential pressure to verify the capability of the valve to operate under design basis accident conditions

• Interlock testing procedures for motor-operated valve 8804 control circuits to verify the circuits were fully tested

• Emergency operating procedures associated with safety injection pump operation to verify the capability of the pump to provide required flow to mitigate design basis accidents

• Reviewed licensees monitoring of external emergency core cooling system leakage that would bypass the containment under post-accident conditions (Question 15 includes Procedures ETP-203A/B and ETP-204A/B as well as recent results)

• The team reviewed the licensees list of condition reports and corrective maintenance activities associated with both the safety injection pump and the piggy back valve with respect to emergency core cooling system leakage that would bypass the containment under post-accident conditions b. Findings No findings were identified.

.2.14 Unit 2 Service Water Train B Pump (MDP P02) and associated Service Water System Vacuum Breaker a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations,

- 21 -

maintenance and test procedures, and condition reports associated with the Unit 2 Service Water Train B Pump (MDP P02) and associated Service Water System Vacuum Breaker. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation

• Calculations of pump flow, submergence, and net positive suction head capacity to verify the capability of the pump to provide required flow to mitigate design basis accidents

• Surveillance test procedures and recent results to verify the actual capability of the pump

• Design Change Package that added duel strainers upstream of service water loads to verify the loads will receive adequate flow under accident conditions

• Design Change Package that replaced service water system vacuum breakers to verify the function of the vacuum breakers to prevent water-hammer damage due to system transients

• Potential flooding and/or water spray resulting from failure of a service water system vacuum breaker to close when required b. Findings No findings were identified.

.2.15 Service Water Pond (Ultimate Heat Sink)

a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Service Water Pond (Ultimate Heat Sink). The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Maintenance history and corrective action program reports to verify the monitoring of potential degradation

• Surveillance test procedures and recent results to verify the actual capability of the ultimate heat sink

- 22 -

• Surveillance inspection procedures and recent results to verify the actual amount of silting in the pond

• Maximum temperature limits to verify the capability of the service water system under the most limiting conditions

• Minimum and maximum water level limits to verify the capability of the service water system under the most limiting conditions and to ensure internal flooding analyses are bounding b. Findings No findings were identified.

.2.16 Unit 2 Turbine Driven Auxiliary Feedwater Pump a. Inspection Scope The team reviewed the final safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the Unit 2 Turbine Driven Auxiliary Feedwater Pump. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation

• Calculations of pump flow and net positive suction head capacity to verify the capability of the pump to provide required flow to mitigate design basis accidents

• Surveillance test procedures and recent results to verify the actual capability of the pump

• Updated safety analysis report change to address the potential effect of tornado missiles on the Turbine Driven Auxiliary Feedwater Pump steam exhaust stack

• Calculation of maximum pump discharge pressure associated with the Turbine Driven Auxiliary Feedwater Pump operating at maximum speed to verify the system piping and valves are not overpressurized b. Findings Introduction. The team identified a Severity Level lV, non-cited violation of 10 CFR 50.59, Changes, Test, and Experiments, and associated Green finding, associated with the licensees failure to adequately evaluate changes to determine if prior NRC approval is required.

- 23 -

Description. The team reviewed the stations corrective actions taken to address NCVs05000445/2012003-01; 05000446/2012003-02, Failure to Analyze Tornado Missile Strike on Turbine Driven Auxiliary Feedwater Exhaust Pipe, which was documented in Condition Report CR-2012-006134. The team noted that the stations corrective actions included performing an analysis, CS-CA-0000-5493, Turbine Driven Auxiliary Feedwater Pump Exhaust Stack Tornado Missile Evaluation, to verify that the exhaust pipe would not be completely crimped by final safety analysis report design basis tornado missiles (potentially resulting in a steam environment inside the building),

and to update the final safety analysis report with the results of the analysis. The team noted that the licensee had performed their evaluation and based on these results issued Licensing Document Change Request SA-2013-004, FSAR 3.5.1.4 Update for safety-related SSC impacted by tornado-generated missiles. On March 12, 2013, this licensing document change request was issued to revise Final Safety Analysis Report, Section 3.5.1.4.

The team reviewed Calculation CS-CA-0000-5493, and noted that Calculation CS-CA-0000-5493 did not evaluate all tornado missile trajectories, and that a vertical missile impact was discounted, and that the impact analysis was only done for one design basis tornado missile. As such, the team determined that this analysis did not demonstrate that the exhaust stack would be functional following a tornado event. The team also reviewed Licensing Document Change Request SA-2013-004, and noted that the licensee had characterized this change as an administrative change and determined that it screened out by an applicability determination. The team noted that the change contained the following statements:

• The turbine driven auxiliary feedwater pump is required to be operational for response to an occurrence of a station blackout (i.e., station blackout = loss of offsite power + loss of on-site AC power). As identified in Final Safety Analysis Report 15.2.5.1, the turbine exhausts the secondary steam to the atmosphere.

The occurrence of a tornado missile striking the exhaust pipe of the auxiliary feedwater pump turbine with a large missile concurrent with station blackout is considered highly improbable based on the location of the exhaust pipe relative to the elevations of source missiles

• The auxiliary feedwater system is designed with sufficient redundancy and diversity to ensure the plant can be safely shutdown and maintained in a safe condition. The motor driven pumps and the turbine driven auxiliary feedwater pump provide the required redundancy for design basis accidents such as a main feedwater line break or diversity for events such as station blackout. The auxiliary feedwater pump turbine exhaust pipe is designed to withstand the effects of a design basis tornado wind load The team questioned the licensees conclusion because this change appeared to; represent a departure from the General Design Criteria GDC-2, change a commitment to Regulatory Guide 1.117, and change a design function described in the final safety analysis report associated with the turbine driven auxiliary feedwater pump. The team noted that the stations final safety analysis report contained the following information:

- 24 -

• Final Safety Analysis Report, Appendix 1A(B), identifies that the station is committed to Regulatory Guide 1.117, Tornado Design Classification, and states, in part, structures, systems, and components are designed to withstand the effects of a design basis tornado, including tornado missiles, in conformance with Revision 1 (4/78) of this regulatory guide.

• Final Safety Analysis Report, Chapter 3, o Section 3.1.1.2 identifies the stations compliance with General Design Criteria GDC-2, and requires that the systems and components needed for accident mitigation remain fully functional before, during, and after a tornado event o Section 3.2.1.1.2 identifies the auxiliary feedwater system as a Class I system o Section 3.3.2 states in part, because of the potential switchyard damage, a trip of the turbine-generators and loss of offsite power are assumed to result from the design basis tornado o Table 3.5-8 identifies that vertical missiles are part of the current licensing basis

• Final Safety Analysis Report, Chapter 10, Section 10.4.9.3 states, in part, that in the event of a loss of offsite power, the backup turbine driven auxiliary feedwater pump operates.

The team informed the licensee of their concern. In response to the teams concern, the licensee initiated Condition Report CR-2015-005838. The licensee subsequently revisited the original 10 CFR 50.59 review performed for LDCR SA-2013-004, and concluded that the process should have taken them to a 10 CFR 50.59 screening, not terminating at an applicability determination. The licensees conclusion was that a 10 CFR 50.59 evaluation was not required. The inspectors reviewed the 10 CFR 50.59 screen and determined that the licensees conclusion was incorrect.

Specifically, the inspectors determined that the response to question Number 1 [Does the proposed activity involve a change to a system, structure, or component (SSC) that adversely affects an FSAR described design function?] should have been yes because the design function of the specific component, the turbine driven auxiliary feedwater pump, would be adversely affected by the postulated tornado missile. In addition, the team determined that a tornado missile strike on the exhaust piping would result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the final safety analysis report. This determination was based on the guidance of NEI 96-07, Revision 1, Section 4.3.2 (Does the Activity Result in More Than a Minimal Increase in the Likelihood of Occurrence of a Malfunction of an SSC Important to Safety?).

Section 4.3.2 of NEI 96-07 states, in part, that changes in design requirements for earthquakes, tornados, and other natural phenomena should be treated as potentially

- 25 -

affecting the likelihood of malfunction. Section 4.3.2 also states, Although this criterion allows minimal increases, licensees must still meet applicable regulatory requirements and other acceptance criteria to which they are committed (such as contained in regulatory guides and nationally recognized industry consensus standards, e.g., the ASME B&PV Code and IEEE standards). Further, departures from the design, fabrication, construction, testing, and performance standards outlined in the General Design Criteria (Appendix A to Part 50) are not compatible with a no more than minimal increase standard. Further, Section 4.3.2 includes examples of cases that would require prior NRC approval. The team determined this condition was similar to Example 6 (The change would reduce system/equipment redundancy, diversity, separation, or independence).

Analysis. The team determined that the licensees failure to implement the requirements of 10 CFR 50.59 and adequately evaluate changes to determine if prior NRC approval is required was a performance deficiency. Because this performance deficiency had the potential to impact the NRCs ability to perform its regulatory function, the team evaluated the performance deficiency using traditional enforcement. In accordance with Section 2.1.3.E.6 of the NRC Enforcement Manual, the team evaluated this finding using the significance determination process to assess its significance. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. In accordance with Section 6.1.d.2 of the NRC Enforcement Policy, the team characterized this performance deficiency as a Severity Level IV violation. The team determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement. The team identified a Severity Level IV, non-cited violation of 10 CFR 50.59, Changes, Test, and Experiments, which states in part, Section (c)(1),

that a licensee may make changes in the facility as described in the Updated Safety Analysis Report without obtaining a license amendment pursuant to 10 CFR 50.90 only if: (i) a change to the technical specifications incorporated in the license is not required, and (ii) the change, test, or experiment does not meet any of the criteria in paragraph (c)(2). Section(c)(2), states in part, A licensee shall obtain a license amendment pursuant to Section 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would: (ii) Result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component (SSC) important to safety previously evaluated in the final safety analysis report. Contrary to the above, on March 12, 2013, the licensee failed to obtain a license amendment pursuant to Section 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would: (ii) Result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component (SSC) important to safety previously evaluated in the final safety analysis report. Specifically, the licensee performed a 10 CFR 50.59 evaluation for the

- 26 -

unprotected turbine driven auxiliary feedwater pump exhaust stack, and during the Applicability Determination phase, determined that exempting the exhaust stack from being protected was acceptable without NRC approval. The licensee failed to recognize that the proposed change would result in more than a minimal increase in the likelihood that the turbine driven auxiliary feedwater pumps steam exhaust piping would be susceptible to a tornado driven missiles during a station black out, when the turbine driven auxiliary feedwater pump would be required to be operational. In response to this issue, the licensee has demonstrated that the auxiliary feedwater system is capable of safely shutting down the plant in the event of a tornado missile strike on the turbine driven auxiliary feedwater pumps steam exhaust piping and the single failure of an additional auxiliary feedwater pump. This finding was entered into the licensees corrective action program as Condition Report CR-2015-007625. Because the licensee was able to ensure that compliance had been restored in a reasonable amount of time, and the finding was not repetitive or willful, this Severity Level IV violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy: NCV 05000445/2015007-04, Failure to Evaluate Changes to Ensure They Did Not Require Prior NRC Approval.

2.17 Main Steam Isolation Valve Solenoid Valves a. Inspection Scope The team performed a limited review of non-safety-related solenoid valves associated with the Main Steam Isolation Valves. Specifically, the team reviewed:

• Environmental Qualification of non-safety-related solenoid valves is maintained to verify that their failure would not result in inadvertent opening of Main Steam Isolation Valves under accident conditions

• Emergency Operating Procedures steps to maintain power to non-safety-related station batteries to verify that non-safety-related solenoid valves would remain energized under accident conditions to prevent inadvertent opening of Main Steam Isolation Valves b. Findings No findings were identified.

.3 Results of Reviews for Operating Experience

.3.1 Inspection of NRC Information Notice 2012-17, Inappropriate use of certified material test report yield stress and age-hardened concrete compressive strength in design calculations

- 27 -

a. Inspection Scope The team reviewed the licensees evaluation of NRC Information Notice 2012-17, Inappropriate use of certified material test report yield stress and age-hardened concrete compressive strength in design calculations, to verify that the licensee had performed an applicability review and took corrective actions, if appropriate, to address the concerns described in the information notice. This information notice discusses the use of certified material test reports in lieu of minimum specified strengths, and higher concrete compressive strengths in lieu of design compressive strengths in design calculations. The team reviewed calculations, design basis documents, and procedures and did not find any instances where higher than design specified values were used.

b. Findings No findings were identified.

.3.2 Inspection of NRC Information Notice 2005-30, Safe Shutdown Potentially Challenged by Unanalyzed Internal Flooding Events and Inadequate Design a. Inspection Scope The team reviewed the licensees evaluation of NRC Information Notice 2005-30, Safe Shutdown Potentially Challenged by Unanalyzed Internal Flooding Events and Inadequate Design, to verify that the licensee had performed an applicability review and took corrective actions, if appropriate, to address the concerns described in the information notice. This Information notice discusses the potential for an internal flood, originating in the turbine building, affecting safety-related systems located in adjacent plant areas. Floods of this type have the potential to make multiple trains of equipment and support equipment inoperable, significantly increasing plant risk.

b. Findings No findings were identified.

.3.3 Inspection of NRC Information Notice 2010-23, Malfunctions of Emergency Diesel Generator Speed Switch Circuits a. Inspection Scope The team reviewed the licensees evaluation of Information Notice 2010-23, Malfunctions of Emergency Diesel Generator Speed Switch Circuits, to verify that the licensee had performed an applicability review and took corrective actions, if appropriate, to address the concerns described in the information notice.

This information notice discusses examples of malfunctions of emergency diesel generator speed switch circuits. The team verified that the licensees review adequately addressed the issues in the information notice.

- 28 -

b. Findings No findings were identified.

.3.4 Inspection of NRC Information Notice 1992-29, Potential Breaker Miscoordination Caused by Instantaneous Trip Circuitry a. Inspection Scope The team reviewed the licensees evaluation of Information Notice 1992-29, Potential Breaker Miscoordination Caused by Instantaneous Trip Circuitry, to verify that the licensee had performed a review and took corrective actions, if appropriate, to address the concerns described in the information notice. This information notice discusses potential breaker miscoordination involving instantaneous trip circuitry installed by the manufacturer in certain solid state trip units. The team verified that the licensees review adequately addressed the issues in the information notice.

b. Findings No findings were identified.

.4 Results of Reviews for Operator Actions a. Inspection Scope The team selected risk-significant components and operator actions for review using information contained in the licensees probabilistic risk assessment. This included components and operator actions that had a risk achievement worth factor greater than two or Birnbaum value greater than 1E-6.

For the review of operator actions, the team observed operators during simulator scenarios associated with the selected components as well as observing simulated actions in the plant.

The selected timed operator actions were:

Scenario 1: The scenario was designed to evaluate five timed operator actions.

• The first timed action was to initiate volume control task makeup in response to a VCT low level alarm within two minutes (TSA-2.5)

• The second timed action was to trip reactor coolant pumps when small break loss of coolant accident criteria are met within five minutes (TSA-2.11)

• The third timed action was to transfer to cold leg recirculation within five minutes and 55 seconds (TSA2.7)

- 29 -

• The fourth timed action was to transfer containment spray system to recirculation mode within one minute and ten seconds (TSA-2.8)

• The fifth timed action was to detect and isolate leaks in the emergency core cooling system flow path within 30 minutes (TSA-2.3)

The scenario started with the volume control tank at 48 percent level, makeup in manual, and power at 100 percent equilibrium middle of life. After turnover the first event is that letdown fails closed and the auto makeup alarm is failed off. The crew then initiated manual makeup to the volume control tank using Procedures ABN-105 and ALM-0061.

The second event was a small break loss of coolant accident, with a pipe break size of four inches that would result in an 11,500 gallons per minute leak which would result in a reactor trip and safety injection within a few minutes. The crew would mitigate the loss of coolant accident using Emergency Operating Procedures EOP-0.0, Reactor Trip and Safety Injection and EOP-1.0, Loss of Reactor or Secondary Coolant.

After immediate actions the crew would trip reactor coolant pumps per the foldout page criteria. When the refueling water storage tank reaches 33 percent auto recirculation would transfer and the crew would transition to Procedure EOS-1.3, Transfer ECCS to cold leg recirculation. When the crew transitions back to Emergency Operating Procedure EOP-1.0, the final event was inserted. The final event was a passive 50 gallons per minute leak at Valve 2-8835, SI Pump to Cold Leg Injection valve.

The crew would be required to detect and isolate leaks in the emergency core cooling system Flow Path within 30 minutes. The scenario was validated with a crew of licensed operator and ran for validation on two crews of licensed operators. In-plant job performance measure number 1: This job performance measure was designed for a plant operator to perform the field actions for providing alternate Auxiliary Feedwater supply.

In-plant job performance measure number 2: This job performance measure was designed for a plant operator to perform the field actions for providing alternate water supply to the condensate storage tank.

b. Findings No findings were identified.

4. OTHER ACTIVITIES Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity 4OA2 Problem Identification and Resolution (71152)

Component Design Basis Inspection Review The team reviewed various controlled documents (i.e., procedures, drawings, instructions, calculations, and licensee basis documents), which are discussed in previous sections of this report. The attributes of the licensees corrective action program, should include: the complete

- 30 -

and accurate identification of the problem; the timely correction, commensurate with the safety significance; the evaluation and disposition of performance issues, generic implications, common causes, contributing factors, root causes, extent of condition reviews, previous occurrences reviews, and the classification, prioritization, focus, and timeliness of corrective actions.

During the inspection, the team identified a single occurrence of an incorrect operability evaluation and inadequate 10 CFR 50.59 review. The remainder of the condition reports and other documents reviewed by the team during the inspection did not reflect any concerns with the licensees corrective action program.

4OA6 Meetings, Including Exit Exit Meeting Summary On July 2, 2015, the inspectors presented the preliminary results to Mr. K. Peters, Site Vice President, and other members of the licensee staff. On August 3, 2015, the final inspection results were discussed with Mr. T. McCool, Vice President, Engineering and Support, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

- 31 -

SUPPLEMENTAL INFORMATION KEY POINTS OF CONTACT Licensee Personnel I. Ahmad, Electrical Analyst, Design Engineering D. Ambrose, Manager, Engineering Technical Support G. Baah, System Engineer J. Bain, Electrical/Program Reliability Mgr.

C. Biggs, Engineer, Design Engineering K. Blackwell, Design Engineer B. Clark, Operations T. Ervin-Walker, Regulatory Affairs D. Farnsworth, Performance Improvement Director C. Feist, Design Engineer T. Gibbs, Manager, ECP Safeteam R. Gilada, Design Engineer D. Goodwin, Director, Work Management S. Harvey, Outage Manager T. Hope, Regulatory Affairs Manager N. Jones, System Engineer A. Kalia, System Engineer K. Kettering, Supervisor, Corrective Action Program K. Kirwin, Nuclear Oversight R. Kissinger, Design Engineer D. Klooster, Manager, Design Engineering Analysis K. Langdon, Design Engineer N. Larson, PRA Senior Engineer E. Lessmann, Engineering Smart Team Manager B. Luengas, PRA A. Martin, Design Engineer A. Marzloff, Shift Operations Manager T. McCool, Vice President, Engineering and Support G. Merka, Regulatory Affairs S. Miller, Boric Acid Engineer L. Neuburger, Design Engineer M. Osterman, Design Engineer K. Peters, Site Vice President D. Pingda, Manager, MTZ S. Porter, System Engineer A. Saunders, Engineer, Design Engineering J. Seawright, Regulatory Affairs S. Sewell, Director Organizational Effectiveness M. Shirey, Reliability Engineer M. Stakes, Maintenance Director B. St. Louis, Training Director J. Taylor, Director, Site Engineering T. Terryah, Acting Manager, Plant Reliability B. Thompson, Manager, Engineering Smart Team D. Tirsun, Westinghouse Fellow Engineer T. Tran, System Engineer A1-1 Attachment 1

K. Vehstedt, Design Engineer L. Wandall, Design Engineer D. White, Environmental Qualifications Engineer M. Whitson, System Engineer G. Williams, System Engineer L. Windham, Manager, Corrective Action Programs H. Winn, Director, RTE NRC personnel J. Josey, Senior Resident Inspector J. Kramer, Senior Resident Inspector G. Replogle, Senior Reactor Analyst R. Deese, Senior Reactor Analyst LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED Opened and Closed 05000445/2015007-01 NCV Failure to Evaluate Inverter Fault Interrupting Capability During Design Basis Loss of Offsite Power and Seismic Conditions.

(Section 1R21.2.7.b.1)05000445/2015007-02 NCV Failure to Validate Inverter Output Demand Factor and to use the Correct Value of Inverter Efficiency when Determining Inverter Input D-C Power Requirements. (Section 1R21.2.7.b.2)

05000445/2015007-03: NCV Failure to Follow Operability Determination Procedure for 05000446/2015007-03 Tornado Missile Impact of Diesel Vents. (Section 1R21.2.11)05000445/2015007-04 NCV Failure to Evaluate Changes to Ensure They Did Not Require Prior NRC Approval. (Section 1R21.2.16)

LIST OF DOCUMENTS REVIEWED Calculations Number Title Revision 16345-ME(B)-088 Station Service Water System Steady State Hydraulic 8 Calculations 16345-ME(B)-275 SW Pump Flow at SSI W.S. Elevation 789.7 0 16345-ME(B)-323 Head loss Between RWST and SI and RHR Pumps and 0 Comparison of Available and Required NPSH 16345-ME(B)-362 NPSHA at the SI Pumps During Reactor Hot Leg Recirculation 3 16345-ME(B)-372 Service Water Pumps NPSH and Submergence 1 16345-ME(B)-385 NPSHA to Safety Injection and Charging Pumps During Reactor 0 Cold Leg Recirculation A1-2

Calculations Number Title Revision 1-FC-57-1 Refueling Water Storage Tank Level 9 3-D-2-027 Temperature Transient Study for Station Blackout 0 3-D-2-029 Revised Battery Room Temperature Transients 1 3-D-2-030 Temperature Transient Study for Station Blackout - Auxiliary 0 Feedwater Pump Room AF-1-010A Pipe Stress Calculation for Auxiliary Feedwater Piping in Auxiliary 3 Building CS-CA-0000-5493 TDAFWP Exhaust Stack Tornado Missile Evaluation 0 EE-1E-1EB4 480V AC Switchgear CP1-EPSWEB-04 (1EB4) Bus Based 2 Calculation EE-1E-1EB4-1 480 VAC Motor Control Center CP1-EPMCEB-04 (1EB4-1) Bus 5 Based Calculation EE-1E-2ED2 125 VDC Switchboard CP2-EPSWED-02 (2ED2) Bus Based 4 Calculation EE-1E-2PC2 Panel Loading, Cable and Breaker Sizing for 118 VAC Power 1 Distribution Panel CP2-ECDPPC-02, 2PC2 EE-1E-BT1ED1 125V DC Battery and Charger Sizing Calculation CP1-EPBTED- 6 01, CP1-EPBCED-01, CP1-EPBCED-03 EE-CA-0008-265 Protective Relay Settings for 6.9 KV Safeguards Buses 4 EE-SC-U1-1E Unit 1 and Unit 2 Class 1E System Short Circuit Study with Unit 1 4 Preferred Source Lineup EE-VP-U1-EE Unit 1 Class 1E System Voltage Study 3 MEB-022 System Portion Design Pressures for the Auxiliary Feed System 5 MEB-054 Auxiliary Feedwater Pumps NPSH 3 MEB-095 Containment Spray System Recirculation Mode and Mini Flow 1 Recirculation Mode Flow Balance MEB-241 Auxiliary Feedwater Pumps Technical Specification Limits 4 MEB-389 RWST Setpoints, Volume Requirements, and Time Depletion 12 Analysis ME-CA-0000-1093 MOV 1-8804B Thrust/Torque 7 ME-CA-0000-3264 Safe Shutdown Impoundment Hydrothermal Analysis 3 ME-CA-0000-3339 Flow of SW into AF System with backflow to Idle SW Train 0 ME-CA-0000-5487 Turbine Driven Auxiliary Feedwater Pump Design Performance 2 Limit for Inservice Testing A1-3

Calculations Number Title Revision ME-CA-0206-3147 Auxiliary Feedwater Flow Distribution Evaluation on Turbine 0 Driven Overspeed ME-CA-0232-5012 Containment Spray Flowrate for RWST Draindown 2 ME-CA-0232-5046 Containment Spray NPSHA Curves 0 ME-CA-0400-3218 Service Water Cross-Connect Operability 0 SI-CA-0000-0663 Auxiliary Building Flooding Analysis 2 SI-CA-0000-0747 Turbine Building Flood Analysis 0 TNE-EE-0008-169 Coordination Study - 480V Class 1E Unitized MCC Buses 3 TNE-EE-CA-008- Coordination Study - 480V Class 1E Switchgear Buses 4 163 Condition Reports (CRs)

CR-2005-003667 CR-2012-005337 CR-2012-006280 CR-2013-012051 CR-2011-005846 CR-2012-005341 CR-2012-009624 CR-2014-013504 CR-2011-009748 CR-2012-005343 CR-2012-009805 CR-2015-003321 CR-2011-013000 CR-2012-005815 CR-2013-002031 CR-2015-005073 CR-2012-005324 CR-2012-006134 CR-2013-011718 Condition Reports (CRs) Generated during the Inspection CR-2015-004981 CR-2015-005034 CR-2015-005368 CR-2015-005543 CR-2015-005004 CR-2015-005073 CR-2015-005398 CR-2015-005838 CR-2015-005022 CR-2015-005086 CR-2015-005482 CR-2015-005840 CR-2015-005027 CR-2015-005088 CR-2015-005518 CR-2015-005848 CR-2015-005033 CR-2015-005367 CR-2015-005530 CR-2015-005850 Drawings Number Title Revision/Date 212B7150 MCC 1EB4-1 Tag No. CP1-EPMCEB-04, Sh. 35 CP-3 1D99744 Motor Op Gate Valve 1 BRP-MS-2-SB- Main Steam Isometric CP-2 002, Sheet 1 A1-4

Drawings Number Title Revision/Date E1-0067 Unit 1 Diesel Generator 1EG2 Engine Start-Stop DC Control CP-26 Schematic Channel I M2-0202, Flow Diagram - Main Steam CP-2 Sheet 3 M1-0215 Flow Diagram Starting Air Piping, Sh. E CP-27 E1-0004 6.9 KV Auxiliaries One Line Diagram Safeguard Buses CP-31 E1-0005 480V Auxiliaries One Line Diagram Safeguard Buses CP-23 E1-0007 Safeguard and Auxiliary Building Safeguard 480V MCCs One CP-41 Line Diagram E2-0018 118V AC Instrument Bus Distribution One Line Diagram, CP-13 Sh. A M1-2261, I&C Diagram - Channel 8804 CP-2 Sheet 06A M1-2401, MOV 1-8804B CP-3 Sheet 76 Design Basis Documents Number Title Revision DBD-EE-043 Design Basis Document 118V AC Uninterruptible Power 14 Supply System DBD-026 Station Blackout 11 DBD-CS-018 Design Criteria for Pipe Stress and Pipe Supports 10 DBD-ME-007 Pipe Break Postulation and Effects 16 DBD-ME-028 Classification of Structures, Systems, and Components 24 DBD-ME-206 Auxiliary Feedwater System 35 DBD-ME-232 Containment Spray System 34 DBD-ME-233 Station Service Water System 33 DBD-ME-261 Safety Injection System 34 Design Change Packages Number Title Revision/Date DM No.96-011 Modification Record Package 2RF03 Inverter/Charger January 30, 1998 Upgrade A1-5

Design Change Packages Number Title Revision/Date FDA-2007- Replace Existing Unit-2 SSW Crosby Type Vacuum 2 000728-04 Breakers with a More Reliable Model FDA-2009- Redundant Simplex Basket Strainers for Unit 2 Train B 1 001570-06 SSW Supply to the SIP and CCP Lube Oil Coolers and CSP Bearing Coolers Miscellaneous Number Title Revision/Date Licensed Operator JPM Index June 1, 2015 Licensed Operator Simulator JPM Index June 1, 2015 ILO Plant JPM Index June 1, 2015 Turbine Building JPM Index June 1, 2015 Safeguards JPM Index June 1, 2015 Aux Building JPM Index June 1, 2015 Comanche Peak Shift Operations Reference Guide 2015-2016 Comanche Peak Safety Pocket Manual March 2013 Comanche Peak Standards & Expectations September 2013 Handbook 59SC-2007- 50.59 Screen: Replace Existing Unit-2 SSW Crosby March 8, 2011 000728-06 Type Vacuum Breakers with a More Reliable Model 59SC-2009- 50.59 Screen: Redundant Simplex Duplex Basket April 11, 2012 001570-07 Type Strainers on the Inlet of the CSP Bearing Coolers and the Lube Oil Coolers for the SI and CC Pumps A04202 JPM - Energize/Deenergize a non-Safeguards January 22, 2001 Battery Charger AO6415A Shift Auxiliary Feedwater Suction December 2, 2010 A1-6

Miscellaneous Number Title Revision/Date AO6433 (JPM) Isolate the MSIV air lines to prevent January 22, 2004 inadvertent opening of valves and close an MSIV (OWI-206 Attach. 8.E)

AO6435 Safeguards Locally Close an MSIV August 22, 2011 CPPA-23990 Memo: HELB Environmental Analysis October 15, 1982 EB-T-9854 Letter: Mitigation of HELB/MELB - Times for April 6, 1989 Operator Action ER-EA-008 Individual Plant Examination of External Events 0 ER-ME-102 Pressure Locking and Thermal Binding of Safety- 1 Related Power-Operated Gate Valves FSAR 6.3 Original FSAR; Emergency Core Cooling System 1988 OPD1.ADM.TCA Performance of Timed Operator Actions December 10, 2014 OPGD-11 Local Actions for Plant Events October 1, 2013 OPGD-3 Operations Standards and Expectations May-20-2015 R&R-PN-043 Equipment Response to Loss of Room Cooling July 5, 2011 RESAR-3 Westinghouse Reference Safety Analysis Report June, 1972 SA-2013-004 LDCR: Update Section 3.5.1.4 to Include the March 12, 2013 Identification and Description of the Tornado Missile Impact Analysis Results on the Auxiliary Feedwater Pump Turbine Exhaust Stack That Is Not Contained Within Reinforced Concrete Building or Structures SER 10.4.9 Original SER; Auxiliary Feedwater System NA SER 3.3.2 Original SER; Tornado Design Criteria NA SER 6.3 Original SER; Emergency Core Cooling System NA STI-214.01-1 TCA-1.10, Steam Generator Tube Rupture Close November 14, 2013 SG ARV Block Valve when the SG ARV is Failed Open (EOP-3.0 step 3)

A1-7

Miscellaneous Number Title Revision/Date TXX-89360 LETTER - Comanche Peak Steam Electric Station June 2, 1989 (CPSES) Docket Nos. 50-445 and 50-446 ASCO Solenoids for Main Steam Isolation Valves SDAR:

CP-89-013 Interim Report TXX-90013 LETTER - Comanche Peak Steam Electric Station February 7, 1990 (CPSES) Docket Nos. 50-445 and 50-446 ASCO Solenoids for Main Steam Isolation Valves SDAR:

CP-89-013 Final Report TXX-90135 LETTER - Comanche Peak Steam Electric Station April 10, 1990 (CPSES) Docket Nos. 50-445 and 50-446 ASCO Solenoids for Main Steam Isolation Valves WPT-13961 Letter: ECCS Pump Runout Margin Issues September 25, 1991 WPT-13963 Letter: SI Runout During Recirculation September 25, 1991 WTP-13885 Letter: SIS Motor Operated Valve Data September 11, 1991 Procedures Number Title Revision ABN-304 Main Condenser and Circulating Water System Malfunction 8 ABN-305 Auxiliary Feedwater System Malfunction 8 ABN-305 Auxiliary Feedwater System Malfunction, Attachment 4 8 ABN-501 Station Service Water System Malfunction 9 ABN-502 Component Cooling Water System Malfunctions 6 ABN-602 Response to a 6900/480V System Malfunction 8 ABN-907 Acts of Nature 15 ALM-0011A Alarm Procedure 1-ALB-1 10 ALM-0021A Alarm Procedure 1-ALB-2A 9 ALM-0091A Alarm Procedure 1-ALB-9A 9 A1-8

Procedures Number Title Revision ALM-0102A Alarm Procedure 1-ALB-10B 12 ALM-0102B Alarm Procedure 2-ALB-10B 6 ECA-0.0A Loss of All AC Power 8 ECA-0.0B Loss of All AC Power 8 EDMG A.4-5 Condensate Storage Tank Makeup 5 EOP 0.0 Reactor Trip or Safety Injection 8 EOP 1.0 Loss of Reactor or Secondary Coolant 8 EOP 2.0 Faulted Steam Generator 8 EOP-0.0A Reactor Trip or Safety Injection 8 EOP-0.0B Reactor Trip or Safety Injection 8 EOP-1.0A Loss of Reactor or Secondary Coolant 8 EOP-1.0B Loss of Reactor or Secondary Coolant 8 EOP-1.2A Post LOCA Cooldown and Depressurization 8 EOP-1.2B Post LOCA Cooldown and Depressurization 8 EOP-1.3A Transfer to Cold Leg Recirculation 8 EOP-1.3B Transfer to Cold Leg Recirculation 8 EOP-1.4A Transfer to Hot Leg Recirculation 8 EOP-1.4B Transfer to Hot Leg Recirculation 8 EOS 1.3 Transfer to Cold Leg Recirculation 8 ETP-104A 1-8804A and 1-8804B Control Circuit Interlock Test 0 ETP-203A Residual Heat Removal System Radioactive Leakage 4 Inspection Test ETP-203B Residual Heat Removal System Radioactive Leakage 5 Inspection Test A1-9

Procedures Number Title Revision ETP-204A Safety Injection System Radioactive Leakage Inspection Test 4 ETP-204B Safety Injection System Radioactive Leakage Inspection Test 4 MSE-C0-5811 Solidstate Controls 10 KVA Inverter Maintenance and 2 Operability Test MSE-S0-6304 Westinghouse 480 Volt Air Circuit Breaker PM and Surveillance 2 Inspections ODA-102 Conduct of Operations 27 OPT-204A SI System 14 OPT-205A Containment Spray System 17 OPT-206A AFW System 29 OPT-206B AFW System 21 OPT-207B Service Water System 14 OPT-512A RHR and SI Subsystem Valve Test 11 OPT-521A ECCS Operability 6 PPT-S0-6000 Motor Operated Valve Risk-Informed IST Testing 2 PPT-S1-6411 MOV External Limit Switch Contact Verification 0 PPT-SX-7517 Safe Shutdown Impoundment Inspection 2 PPT-TP-97B-12 DM 96-011 Acceptance Test Train B Safety-Related Inverters 0 SOP-103A Chemical and Volume Control System 18 SOP-201A Safety Injection System 17 SOP-604A 480 VAC Switchgear and MCCs 12 STI-214.01 Control of Timed Operator Actions 0 A1-10

Vendor Documents Number Title Revision/Date Curve No. 2323- 450 HP Safety Injection Pump Motor December 16, 1986 CC-6 Curve No. 37737N Pump No. 51667 (SI Pump) October 4, 1977 Curve No. 51649 Pump No. 51649 (SI Pump) August 13, 1986 VMTR-001-803 GEH-2614F GE 7700 Line Motor Control Center 1 Installation and Maintenance Instructions VTMR-001-005- Motor Description (SI Pump Motor) April 1, 1976 005 VTMR-001-803 Westinghouse Instructions for Low-Voltage Power October 1983 Circuit Breakers Types DS and DSL I.B. 33-790-1F Work Orders (WO)

0414117 4285751 4579724 4925991 3493596 4285802 4683971 4983200 3943646 4359332 4707872 4983936 rch 30, 2015

SUBJECT:

COMANCHE PEAK NUCLEAR POWER PLANT, UNITS 1 AND 2, -

NOTIFICATION OF NRC COMPONENT DESIGN BASES INSPECTION (05000445/2015007 AND 05000446/2015007) AND INITIAL REQUEST FOR INFORMATION

Dear Mr. Flores:

On June 1, 2015, the NRC will begin a triennial baseline Component Design Bases Inspection at the Comanche Peak Nuclear Power Plant. A six-person team will perform this inspection using NRC Inspection Procedure 71111.21, Component Design Bases Inspection.

The inspection focuses on components and operator actions that have high risk and low design margins. The samples reviewed during this inspection will be identified during an information gathering visit and during the subsequent in-office preparation week. In addition, a number of operating experience issues will also be selected for review.

The inspection will include an information gathering site visit by the team leader and a senior reactor analyst, and three weeks of on-site inspection by the team. The inspection will consist of four NRC inspectors and two contractors, of which five will focus on engineering and one on operations. The current inspection schedule is as follows:

On-site Information Gathering Visit: May 11 -14, 2015 Preparation Week(s): May 18, 2015; June 8, 2015; and June 22, 2015 On-site Week(s): June 1, 2015; June 15, 2015; and June 29, 2015 The purpose of the information gathering visit is to meet with members of your staff to identify potential risk-significant components and operator actions. The lead inspector will also request a tour of the plant with members of your operations staff and probabilistic safety assessment staff. During the on-site weeks, several days of time will be needed on the plant-referenced simulator in order to facilitate the development of operator action-based scenarios. Additional information and documentation needed to support the inspection will be identified during the inspection, including interviews with engineering managers, engineers, and probabilistic safety assessment staff.

Our experience with these inspections has shown that they are extremely resource intensive, both for the NRC inspectors and the licensee staff. In order to minimize the inspection impact on the site and to ensure a productive inspection, we have enclosed a request for information needed for the inspection. The request has been divided into three groups. The first group lists A2-1 Attachment 2 information necessary for the information gathering visit and for general preparation. This information should be available to the regional office no later than May 4, 2015. Insofar as possible, this information should be provided electronically to the lead inspector. Since the inspection will be concentrated on high risk/low margin components, calculations associated with your list of high risk components should be available to review during the information gathering visit to assist in our selection of components based on available design margin.

The second group of documents requested is those items that the team will need access to during the preparation week in order to finalize the samples to be inspected. The third group lists information necessary to aid the inspection team in tracking issues identified as a result of the inspection. It is requested that this information be provided to the lead inspector as the information is generated during the inspection. Additional requests by inspectors will be made throughout all three on-site weeks for specific documents needed to complete the review of that component/selection. It is important that all of these documents are up to date and complete in order to minimize the number of additional documents requested during the preparation and/or the on-site portions of the inspection. In order to facilitate the inspection, we request that a contact individual be assigned to each inspector to ensure information requests, questions, and concerns are addressed in a timely manner.

The lead inspector for this inspection is Ronald A. Kopriva. We understand that our licensing engineer contact for this inspection is Gary Merka. If there are any questions about the inspection or the requested materials, please contact the lead inspector by telephone at 817-200-1104 or by e-mail at Ron.Kopriva@nrc.gov.

In accordance with 10 CFR 2.390 of the NRC's Rules of Practice, a copy of this letter will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS).

ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Eric A. Ruesch, Acting Chief Engineering Branch 1 Division of Reactor Safety Docket Nos. 05000445 and 05000446 License Nos. NPF-87 and NPF-89 Enclosure:

Component Design Bases Inspection Request for Information cc: Electronic Distribution for Comanche Peak Nuclear Power Plant A2-2

ML15089A554 SUNSI Review ADAMS Publicly Available Non-Sensitive Keyword:

By: RKopriva Yes No Non-Publicly Available Sensitive OFFICE SRI:EB1 ABC:EB1 NAME RKopriva/dch ERuesch SIGNATURE /RA/ /RA/

DATE 3/25/15 3/30/15

Letter to Rafael Flores from Eric A. Ruesch, dated March 30, 2015 SUBJECT: COMANCHE PEAK NUCLEAR POWER PLANT, UNITS 1 AND 2, -

NOTIFICATION OF NRC COMPONENT DESIGN BASES INSPECTION (05000445/2015007 AND 05000446/2015007) AND INITIAL REQUEST FOR INFORMATION Electronic distribution by RIV:

Regional Administrator (Marc.Dapas@nrc.gov)

Deputy Regional Administrator (Kriss.Kennedy@nrc.gov)

DRP Director (Troy.Pruett@nrc.gov)

Acting DRP Deputy Director (Thomas.Farnholtz@nrc.gov)

DRS Director (Anton.Vegel@nrc.gov)

DRS Deputy Director (Jeff.Clark@nrc.gov)

Senior Resident Inspector (John.Kramer@nrc.gov)

Senior Resident Inspector (Jeffrey.Josey@nrc.gov)

Resident Inspector (Rayomand.Kumana@nrc.gov)

Administrative Assistant (Rhonda.Smith@nrc.gov)

Branch Chief, DRP/A (Wayne.Walker@nrc.gov)

Senior Project Engineer, DRP/A (Ryan.Alexander@nrc.gov)

Project Engineer, DRP/A (Thomas.Sullivan@nrc.gov)

Project Engineer, DRP/A (Margaret.Tobin@nrc.gov)

Public Affairs Officer (Victor.Dricks@nrc.gov)

Public Affairs Officer (Lara.Uselding@nrc.gov)

Project Manager (Balwant.Singal@nrc.gov)

Branch Chief, DRS/TSB (Geoffrey.Miller@nrc.gov)

RITS Coordinator (Marisa.Herrera@nrc.gov)

ACES (R4Enforcement.Resource@nrc.gov)

Regional Counsel (Karla.Fuller@nrc.gov)

Technical Support Assistant (Loretta.Williams@nrc.gov)

Congressional Affairs Officer (Jenny.Weil@nrc.gov)

RIV Congressional Affairs Officer (Angel.Moreno@nrc.gov)

RIV/ETA: OEDO (Michael.Waters@nrc.gov)

A2-4

Initial Request for Information Component Design Bases Inspection Comanche Peak Nuclear Power Plant Inspection Report: 05000445/2015007, 05000446/2015007 Information Gathering Dates: May 11 - 14, 2015 Inspection Dates: June 1, 2015; June 15, 2015; and June 29, 2015 Inspection Procedure: IP 71111.21, Component Design Bases Inspection Lead Inspector: Ron Kopriva, Senior Reactor Inspector I. Information Requested Prior to Information Gathering Visit (May 11, 2015)

The following information (Section I of this enclosure) should be sent to the Region IV office in hard copy or electronic format (Certrec IMS preferred), to the attention of Ronald Kopriva by May 4, 2015, to facilitate the reduction in the items to be selected.

The team leader will provide the licensee the selected components for Section II by May 12, 2015. The inspection team will finalize the selected list during the week of May 18, 2015 using the additional documents requested in Section II of this enclosure.

The specific items selected from the lists shall be available and ready for review on the day indicated in this request. *Please provide requested documentation electronically in pdf files, Excel, or other searchable formats, if possible. The information should contain descriptive names, and be indexed and hyperlinked to facilitate ease of use.

Information in "lists" should contain enough information to be easily understood by someone who has knowledge of pressurized water reactor technology. If requested documents are large and only hard copy formats are available, please inform the inspector(s), and provide subject documentation during the first day of the on-site inspection.

1. An excel spreadsheet of equipment basic events (with definitions) including importance measures sorted by risk achievement worth (RAW) and Fussell-Vesely (FV) from your internal events probabilistic risk assessment (PRA).

Include basic events with RAW value of 1.3 or greater.

2. Provide a list of the top 500 cut-sets from your PRA.

3. Copies of PRA "system notebooks," and the latest PRA summary document.

4. An excel spreadsheet of PRA human action basic events or risk ranking of operator actions from your site specific PSA sorted by RAW and FV. Provide copies of your human reliability worksheets for these items.

5. List of procedures used to accomplish operator actions associated with the basic event in your PRA.

A3-1 Attachment 3

6. A list of all time-critical operator actions in procedures.

7. If you have an external events or fire PSA model, provide the information requested in items 1-4 for external events and fire.

8. Any pre-existing evaluation or list of components and associated calculations with low design margins (i.e., pumps closest to the design limit for flow or pressure, diesel generator close to design required output, heat exchangers close to rated design heat removal, etc.).

9. List of high risk maintenance rule systems/components and functions; based on engineering or expert panel judgment.

10. Structures, systems, and components in the Maintenance Rule (a)(1) category.

11. Site top 10 issues list.

12. A list of operating experience evaluations for the last 2 years.

13. A list of permanent and temporary modifications for the previous 3 years.

14. List of current "operator workarounds/burdens."

15. List of root cause evaluations associated with component failures or design issues initiated/completed in the last 3 years.

16. List of any common-cause failures of components in the last 3 years.

17. Electrical one-line drawings for:

• Offsite power/switchyard supplies

• Normal AC power systems

• Emergency AC/DC power systems including

• 120VAC power

• 125VDC/24VDC safety class systems 18. A copy of any self-assessments and associated corrective action documents generated in preparation for the inspection.

19. A copy of engineering/operations-related audits completed in the last 2 years.

20. Current management and engineering organizational charts.

21. List of licensee contacts for the inspection team with phone numbers.

II. Information Requested to be Available on First Day of Preparation Week (May 18, 2015)

A3-2

1. An electronic copy of the Design Bases Documents for the selected components.

2. An electronic copy of the System Health notebooks for the selected components.

3. List of condition reports (corrective action documents) associated with each of the selected components for the last 5 years.

4. The corrective maintenance history associated with each of the selected components for the last 3 years.

5. Copies of calculations associated with each of the selected components (if not previously provided), excluding data files. Please review the calculations and also provide copies of reference material (such as drawings, engineering requests, and vendor letters).

6. Copies of operability evaluations associated with each of the selected components and plans for restoring operability, if applicable.

7. Copies of selected operator workaround evaluations associated with each of the selected components and plans for resolution, if applicable.

8. Copies of any open temporary modifications associated with each of the selected components, if applicable.

9. Trend data on the selected electrical/mechanical components performance for last 3 years (for example, pumps performance including in-service testing, other vibration monitoring, oil sample results, etc., as applicable).

10. List of motor-operated valves (MOVs) in the program, design margin and risk ranking.

11. List of air operated valves (AOVs) in the valve program, design and risk ranking.

III. Information Requested to be provided throughout the inspection 1. Copies of any corrective action documents generated as a result of the teams questions or queries during this inspection.

2. Copies of the list of questions submitted by the team members and the status/resolution of the information requested (provide daily during the inspection to each team member).

3. Reference materials (available electronically and as needed during all on-site weeks):

• General set of plant drawings

• IPE/PRA report

• Procurement documents for components selected A3-3

• Plant procedures (normal, abnormal, emergency, surveillance, etc.)

• Technical Specifications

• Updated Final Safety Analysis Report

• Vendor manuals Inspector Contact Information:

Ronald A. Kopriva Senior Reactor Inspector 817-200-1104 Ron.Kopriva@nrc.gov Mailing Address:

U.S. NRC, Region IV Attn: Ron Kopriva 1600 East Lamar Blvd.

Arlington, TX 76011-4511 A3-4

ML15245A507 SUNSI Review ADAMS: Sensitive Non-Publicly Available Keyword By: RAK Yes No Non-Sensitive Publicly Available NRC-002 OFFICE SRI/EB1/RIV: RI/EB1/RIV: RI/EB1/RIV: SRTI/TTC: C:EB1 NAME RKopriva/tk CSmith JWatkins APalmer TFarnholtz SIGNATURE /RA/ /RA/ /RA/ /RA/email /RA/

DATE 8/31/15 8/6/15 8/7/15 8/13/15 9/2/15

Letter to Rafael Flores from Thomas Farnholtz, dated September 2, 2015 SUBJECT: COMANCHE PEAK NUCLEAR POWER PLANT, UNITS 1 AND 2 - NRC COMPONENT DESIGN BASES INSPECTION (05000445/2015007 AND 05000446/2015007)

Distribution Regional Administrator (Marc.Dapas@nrc.gov)

Deputy Regional Administrator (Kriss.Kennedy@nrc.gov)

DRP Director (Troy.Pruett@nrc.gov)

DRP Deputy Director (Ryan.Lantz@nrc.gov)

DRS Director (Anton.Vegel@nrc.gov)

DRS Deputy Director (Jeff.Clark@nrc.gov)

Senior Resident Inspector (Jeffrey.Josey@nrc.gov)

Resident Inspector (Rayomand.Kumana@nrc.gov)

Administrative Assistant (Rhonda.Smith@nrc.gov)

Acting Branch Chief, DRP/A (Thomas.Hipschman@nrc.gov)

Senior Project Engineer, DRP/A (Ryan.Alexander@nrc.gov)

Project Engineer, DRP/A (Thomas.Sullivan@nrc.gov)

Project Engineer, DRP/A (Mathew.Kirk@nrc.gov)

Public Affairs Officer (Victor.Dricks@nrc.gov)

Public Affairs Officer (Lara.Uselding@nrc.gov)

Project Manager (Balwant.Singal@nrc.gov)

Acting Team Leader, DRS/TSS (Eric.Ruesch@nrc.gov)

RITS Coordinator (Marisa.Herrera@nrc.gov)

ACES (R4Enforcement.Resource@nrc.gov)

Regional Counsel (Karla.Fuller@nrc.gov)

Technical Support Assistant (Loretta.Williams@nrc.gov)

Congressional Affairs Officer (Jenny.Weil@nrc.gov)

RIV Congressional Affairs Officer (Angel.Moreno@nrc.gov)

RIV/ETA: OEDO (Cindy.Rosales-Cooper@nrc.gov)