IR 05000528/2017003

NRC Integrated Inspection Report 05000528/2017003, 05000529/2017003, and 05000530/2017003

ML17318A180
Person / Time
Site:	Palo Verde
Issue date:	11/13/2017
From:	Geoffrey Miller NRC/RGN-IV/DRP/RPB-D
To:	Bement R Arizona Public Service Co
GEOFFREY MILLER
References
IR 2017003
Download: ML17318A180 (36)

Text

ovember 13, 2017

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION - NRC INTEGRATED INSPECTION REPORT 05000528/2017003, 05000529/2017003, AND 05000530/2017003

Dear Mr. Bement:

On September 30, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Palo Verde Nuclear Generating Station Units 1, 2, and 3. On October 6, 2017, the NRC inspectors discussed the results of this inspection with Mr. B. Rash and other members of your staff. The results of this inspection are documented in the enclosed report.

NRC inspectors documented four findings of very low safety significance (Green) in this report.

Three of these findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC resident inspector at Palo Verde.

If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; and the NRC resident inspector at Palo Verde. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Geoffrey B. Miller, Branch Chief Project Branch D Division of Reactor Projects Docket Nos. 50-528, 50-529, 50-530 License Nos. NPF-41, NPF-51, NPF-74 Enclosure:

Inspection Report 05000528/2017003, 05000529/2017003, 05000530/2017003 w/ Attachment: Supplemental Information

SUNSI Review: ADAMS: Non-Publicly Available Non-Sensitive Keyword:

By: JDixon/dll Yes No Publicly Available Sensitive NRC-002 OFFICE DRP/SRI DRP/RI DRP/RI C:DRS/EB1 C:DRS/EB2 C:DRS/OB NAME CPeabody DReinert DYou TFarnholtz GWerner VGaddy SIGNATURE /RA/ /RA/ /RA/E /RA/ /RA/ /RA/

DATE 11/10/2017 11/13/2017 11/09/2017 11/13/2017 11/09/2017 11/9/17 OFFICE C:DRS/PS2 TL:IPAT C:DRP/D NAME HGepford THipschman GMiller SIGNATURE /RA/RDeese /RA/ /RA/

for DATE 11/13/2017 11/13/2017 11/13/2017

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 05000528, 05000529, 05000530 License: NPF-41, NPF-51, NPF-74 Report: 05000528/2017003, 05000529/2017003, and 05000530/2017003 Licensee: Arizona Public Service Company Facility: Palo Verde Nuclear Generating Station Location: 5801 South Wintersburg Road Tonopah, AZ 85354 Dates: July 1 through September 30, 2017 Inspectors: C. Peabody, Senior Resident Inspector D. Reinert, PhD, Resident Inspector D. You, Resident Inspector Approved Geoffrey B. Miller By: Chief, Project Branch D Division of Reactor Projects Enclosure

SUMMARY

IR 05000528, 529, 530/2017003, 7/1/2017 - 9/30/2017; PALO VERDE NUCLEAR

GENERATING STATION INTEGRATED INSPECTION REPORT; maintenance effectiveness, operability evaluations, problem identification and resolution, follow-up of events.

The inspection activities described in this report were performed between July 1 and September 30, 2017, by the resident inspectors at Palo Verde and inspectors from the NRCs Region IV office. Four findings of very low safety significance (Green) are documented in this report. Three of these findings involved violations of NRC requirements. The significance of inspection findings is indicated by their color (i.e., Green, greater than Green, White, Yellow, or Red), determined using Inspection Manual Chapter 0609, Significance Determination Process, dated April 29, 2015. Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, Aspects within the Cross-Cutting Areas, dated December 4, 2014. Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, dated July 2016.

Cornerstone: Initiating Events

Green.

The inspectors reviewed a self-revealed, Green finding for the licensees failure to initiate corrective actions to address elevated temperature measurements identified during thermography inspections of the Unit 3 Phase C main transformer control cabinet. As a result, an extended loss of cooling to the Phase C main transformer resulted in a manual trip of the main turbine and a reactor power cutback. This issue was entered into the licensees corrective action program under Condition Report 17-09022, and the licensee took immediate actions to reinsert and tighten a loose wire associated with the transformer cooling control circuitry.

The inspectors determined that the failure to follow procedure 37TI-9ZZ01, Thermography Inspection of Plant Components, Revision 8, Step 4.5.10.1 to initiate a condition notification report following the identification of elevated temperatures during thermography inspections is a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it was associated with the configuration control attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the failure to initiate corrective actions following the identification of the hot spot on the Unit 3 Phase C main transformer 4-8 contactor resulted in a reactor power cutback that upset plant stability. Using NRC Manual Chapter 609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 1, Initiating Events Screening Questions, the finding screened as having very low safety significance (Green) because the deficiency resulted in a reactor trip, but mitigation equipment remained unaffected. The inspectors determined this finding had a cross-cutting aspect in the area of problem identification and resolution, identification, in that the licensee failed to identify issues completely, accurately, and in a timely manner in accordance with the corrective action program. Specifically, on three occasions in 2016 and 2017, the licensee collected data indicating potential loose connections at the 4-8 contactor, but failed to recognize and communicate the data in accordance with the corrective action program [P.1]. (Section 1R12)

Green.

The inspectors reviewed a self-revealed, Green, non-cited violation of Technical Specification 5.4.1.a. Procedures, for the licensees failure to implement their Conduct of Operations procedure. Specifically, licensee personnel improperly performed a reactor coolant pump seal injection filter flushing evolution as a skill of the craft task without written instructions. Consequently, Unit 2 experienced a loss of letdown and exceeded the pressurizer level technical specification limit of 56 percent. Licensed operators took immediate corrective actions to restore letdown and lower pressurizer level to within acceptable limits. The licensee entered this issue into their corrective action program as Condition Report 17-09326.

The inspectors determined that the failure to follow the Conduct of Operations procedure for performance of skill of the craft tasks is a performance deficiency. The performance deficiency is more than minor, and therefore a finding, because it was associated with the configuration control attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the decision to perform the reactor coolant pump seal filter flushing evolution without a controlled procedure allowed operators to place the system in a configuration causing an automatic isolation of the letdown system that challenged the availability of the pressurizer to respond to reactor coolant system pressure transients. The inspectors evaluated the significance of the issue under the Significance Determination Process, as defined in Inspection Manual Chapter 0609.04, Initial Characterization of Findings, and Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. The inspectors determined that the finding was of very low safety significance (Green) because it only contributed to the likelihood of a reactor trip and not the likelihood that mitigation equipment or functions would not be available. The inspectors determined this finding had a cross-cutting aspect in the area of human performance, avoid complacency, because the licensee failed to recognize and plan for the possibility of mistakes, latent issues, and inherent risk. Specifically, licensee personnel did not recognize the inherent risks associated with the reactor coolant pump seal filter flushing evolution before proceeding to perform the task without formal written instructions [H.12].

(Section 4OA2)

Green.

The inspectors reviewed a self-revealed, Green, non-cited violation of Technical Specification 5.4.1.a Procedures, for the licensees failure to follow station procedure 73DP-0EE05, Engineering Preventive Maintenance Program. The licensee did not consult design basis resources and operating experience when changing the preventive maintenance frequency of the pressurizer spray valve air-operated volume boosters. The valve internals were not rated for ambient operating temperature conditions, as a result a pressurizer spray valve failed open, requiring operators to trip the reactor. The licensee entered this condition into their corrective action program as Condition Report 16-14219.

The licensees corrective actions included replacing the affected pneumatic volume boosters with high temperature qualified soft parts and by revising procedure 73DP-0EE05 to ensure a more thorough engineering management oversight of the equipment reliability engineering template process.

The inspectors determined that the failure to follow station procedure 73DP-0EE05,

Engineering Preventive Maintenance Program, Revision 6, Step 3.4.7, to consult design basis information including internal operating experience resources when determining a required preventive maintenance frequency is a performance deficiency. The performance deficiency is more than minor, and therefore a finding, because it was associated with the design control attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the pressurizer spray valve failed open requiring the operators to trip the reactor. The inspectors evaluated the significance of the issue under the Significance Determination Process, as defined in Inspection Manual Chapter 0609.04, Initial Characterization of Findings, and Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. The inspectors determined that the finding was of very low safety significance (Green) because the finding did not cause a reactor trip and the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition. Specifically after the reactor trip, control room operators were able to regain pressure control by securing the reactor coolant pumps driving pressurizer spray, and initiating auxiliary spray through the charging system. The inspectors determined this finding had a cross-cutting aspect in the area of human performance, consistent process, in that the licensee failed to use a systematic approach to make decisions including incorporating risk insights. Specifically, the pressurizer spray valves are designated as critical components and single point vulnerabilities in 73DP-0EE05, which requires a technical basis to allow for a preventive maintenance frequency change. The licensee did not document the technical basis to increase the service life from one to four cycles [H.13]. (Section 4OA3.1)

Cornerstone: Mitigating Systems

Green.

The inspectors reviewed a self-revealed, Green, non-cited violation of Technical Specification 3.7.10 Condition A for exceeding the allowed outage time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to restore one inoperable train of essential chilled water system to an operable status.

Specifically, the Unit 1 essential chiller B was inoperable from April 11, 2017, to April 18, 2017, due to a refrigerant leak. The licensee entered this issue into their corrective action program as Condition Report 17-05605. The licensees corrective actions included:

isolating the automatic purge unit, thereby stopping the leak; refilling the essential chiller with refrigerant; and retesting the essential chiller unit to return it to an operable status on April 18, 2017. Additionally, the licensee checked the other five essential chillers across the station and found no additional material deficiencies.

The inspectors determined that the failure to ensure the correct Swagelok fitting was being installed in accordance with station procedure is a performance deficiency. The performance deficiency is more than minor and a finding because it is associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, on April 18, 2013, the licensee installed the incorrect Swagelok fitting during maintenance on the essential chiller. When the licensee placed the auto purge system in service, this resulted in the refrigerant leaking out of the Swagelok fitting rendering the essential chiller inoperable.

The inspectors performed the initial significance determination using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, Step A.3 which required a senior reactor analyst to perform a detailed risk evaluation because essential chiller B was incapable of performing its safety function for greater than its technical specification allowed outage time.

A regional senior reactor analyst performed a detailed risk evaluation and determined that the finding was of very low safety significance (Green). Essential Chiller 1B was assumed to be unavailable for 8 days and the potential for common cause failure on the remaining essential chiller was assumed. This resulted in a change in core damage frequency of 3.6E-7 per year. Losses of offsite power comprised the most dominant core damage sequences. The emergency diesel generators and the emergency feed water systems remained available for mitigation of the dominant sequences.

The inspectors determined this finding had a cross-cutting aspect in the area of human performance, avoid complacency, in that the licensee failed to recognize and plan for the possibility of latent issues or mistakes. Specifically, the licensee failed to provide an appropriate post-maintenance testing procedure as required by station procedure. The work order executed on April 11, 2017, gave no direction to test for leaks on the filter assembly

[H.12]. (Section 1R15)

PLANT STATUS

Units 1, 2, and 3 operated at full power for the entire inspection period.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R01 Adverse Weather Protection

Readiness for Impending Adverse Weather Conditions

a. Inspection Scope

On July 7, 2017, and August 4, 2017, the inspectors completed an inspection of the stations readiness for impending adverse weather conditions. The inspectors reviewed plant design features, the licensees procedures to respond to severe thunderstorms, and walked down the switchyard. The inspectors evaluated operator staffing and accessibility of controls and indications for those systems required to control the plant.

These activities constituted two samples of readiness for impending adverse weather conditions, as defined in Inspection Procedure 71111.01.

b. Findings

No findings were identified.

1R04 Equipment Alignment

.1 Partial Walk-Down

a. Inspection Scope

The inspectors performed partial system walk-downs of the following risk-significant systems:

• July 11, 2017, Unit 2 auxiliary feedwater system train B

• August 1, 2017, Unit 1 auxiliary feedwater system train A

• September 24, 2017, Unit 2 diesel generator B The inspectors reviewed the licensees procedures and system design information to determine the correct lineup for the systems. They visually verified that critical portions of the systems were correctly aligned for the existing plant configuration.

These activities constituted three partial system walk-down samples as defined in Inspection Procedure 71111.04.

b. Findings

No findings were identified.

.2 Complete Walk-Down

a. Inspection Scope

On August 7, 2017, the inspectors performed a complete system walk-down inspection of the high pressure safety injection system. The inspectors reviewed the licensees procedures and system design information to determine the correct high pressure safety injection system lineup for the existing plant configuration. The inspectors also reviewed outstanding work orders, open condition reports, and other open items tracked by the licensees operations and engineering departments. The inspectors then visually verified that the system was correctly aligned for the existing plant configuration.

These activities constituted one complete system walk-down sample, as defined in Inspection Procedure 71111.04

b. Findings

No findings were identified.

1R05 Fire Protection

Quarterly Inspection

a. Inspection Scope

The inspectors evaluated the licensees fire protection program for operational status and material condition. The inspectors focused their inspection on five plant areas important to safety:

• July 20, 2017, Unit 2 essential cooling water pump room A, Fire Zone 34A

• July 20, 2017, Unit 3 main control room, Fire Zone 17

• July 28, 2017, Unit 1 turbine driven auxiliary feedwater pump room, Fire Zone 72

• September 6, 2017, Unit 1 essential switchgear room A, Fire Zone 5A

• September 27, 2017, Unit 1 essential chiller rooms, Fire Zones 1 and 2 For each area, the inspectors evaluated the fire plan against defined hazards and defense-in-depth features in the licensees fire protection program. The inspectors evaluated control of transient combustibles and ignition sources, fire detection and suppression systems, manual firefighting equipment and capability, passive fire protection features, and compensatory measures for degraded conditions.

These activities constituted five quarterly inspection samples, as defined in Inspection Procedure 71111.05.

b. Findings

No findings were identified.

1R06 Flood Protection Measures

a. Inspection Scope

On August 16, 2017, the inspectors completed an inspection of the stations ability to mitigate flooding due to internal causes. After reviewing the licensees flooding analysis, the inspectors chose three plant areas containing risk-significant structures, systems, and components that were susceptible to flooding:

• Auxiliary building 88 pipe chase rooms for Units 1, 2, and 3 The inspectors reviewed plant design features and licensee procedures for coping with internal flooding. The inspectors walked down the selected areas to inspect the design features, including the material condition of seals, drains, and flood barriers. The inspectors evaluated whether operator actions credited for flood mitigation could be successfully accomplished.

These activities constituted completion of one flood protection measures sample as defined in Inspection Procedure 71111.06.

b. Findings

No findings were identified.

1R07 Heat Sink Performance

a. Inspection Scope

On August 24, 2017, the inspectors completed an inspection of the readiness and availability of risk-significant heat exchangers. The inspectors reviewed performance testing data for the Unit 2 shutdown cooling heat exchanger B. Additionally, the inspectors walked down the heat exchanger to observe its material condition.

These activities constituted completion of one heat sink performance annual review sample, as defined in Inspection Procedure 71111.07.

b. Findings

No findings were identified.

1R11 Licensed Operator Requalification Program and Licensed Operator Performance

.1 Review of Licensed Operator Requalification

a. Inspection Scope

On September 28, 2017, the inspectors observed an evaluated simulator scenario performed by an operating crew. The inspectors assessed the performance of the operators and the evaluators critique of their performance.

These activities constituted completion of one quarterly licensed operator requalification program sample, as defined in Inspection Procedure 71111.11.

b. Findings

No findings were identified.

.2 Review of Licensed Operator Performance

a. Inspection Scope

On August 7, 2017, the inspectors observed the performance of on-shift licensed operators in the Unit 1 main control room. At the time of the observations, the plant was in a period of heightened risk due to the replacement of a diesel generator hand switch.

The inspectors observed the operators performance of the pre-job brief, and the control room oversight and communications of the activity.

In addition, the inspectors assessed the operators adherence to plant procedures, including procedures 40DP-9OP02, Conduct of Shift Operations, and 01DP-0AP57, Sensitive Issues Awareness and Management.

These activities constituted completion of one quarterly licensed operator performance sample, as defined in Inspection Procedure 71111.11.

b. Findings

No findings were identified.

1R12 Maintenance Effectiveness

Routine Maintenance Effectiveness

a. Inspection Scope

The inspectors reviewed two instances of degraded performance or condition of safety-significant structures, systems, and components (SSCs):

• August 10, 2017, Unit 2 main transformer cooling failure

• September 11, 2017, Unit 1 diverse auxiliary feedwater B spurious trip The inspectors reviewed the extent of condition of possible common cause SSC failures and evaluated the adequacy of the licensees corrective actions. The inspectors reviewed the licensees work practices to evaluate whether these may have played a role in the degradation of the SSCs. The inspectors assessed the licensees characterization of the degradation in accordance with 10 CFR 50.65 (the Maintenance Rule), and verified that the licensee was appropriately tracking degraded performance and conditions in accordance with the Maintenance Rule.

These activities constituted completion of two maintenance effectiveness samples, as defined in Inspection Procedure 71111.12.

b. Findings

FIN 05000530/2017003-01, Failure to Initiate Corrective Actions for Thermography Tests

Introduction.

The inspectors reviewed a self-revealed, Green finding for the licensees failure to initiate corrective actions to address elevated temperature measurements identified during thermography inspections of the Unit 3 Phase C main transformer control cabinet. Specifically, three opportunities occurred during predictive maintenance thermography inspections to initiate corrective actions for temperature anomalies observed at the main transformer 4-8 contactor. As a result, an extended loss of cooling to the Phase C main transformer resulted in a manual trip of the main turbine and a reactor power cutback.

Description.

On June 19, 2017, the Unit 3 control room received a Phase C main transformer trouble alarm. Control room operators dispatched an area operator who reported that no cooling fans or oil pumps were running on the Phase C main transformer. The area operator performed the local alarm response procedure 40AL-9MA01, Transformer Trouble Alarm Responses, Revision 38, as directed by the control room. The alarm response procedure actions to restore cooling were unsuccessful, and the control room operators tripped the main turbine generator 30 minutes after the loss of cooling to de-energize the transformer. The reactor power cutback system operated as designed, decreasing reactor power to approximately 46 percent. Operators subsequently lowered and stabilized reactor power at approximately 10 percent while technicians began troubleshooting the loss of main transformer cooling.

The licensee initiated Condition Report 17-09022 to document the loss of the Unit 3 Phase C main transformer cooling and subsequent turbine trip. Initial investigations revealed that the direct cause of the event was that a wire on the 4-8 relay contactor associated with the transformer cooling control circuitry was disconnected. The wire was reinserted and tightened into place and the Unit 3 main turbine was synched to the grid the following day.

During the course of the apparent cause investigation, the licensee reviewed archived thermographic images and identified that they had failed to follow station procedures on three occasions while gathering thermography data on the Unit 3 Phase C main transformer control cabinet. The licensee uses infrared thermography cameras to perform diagnostics of plant components such as electrical cabinets to identify conditions such as loose connections. The licensees thermography program is governed by procedure 37TI-9ZZ01, Infrared Thermography Inspection of Plant Components, Revision 8. Procedure 37TI-9ZZ01, Step 4.5.10.1 requires that for all anomalies (temperature variations in excess of normally accepted deviations) the thermographer shall notify the thermography engineer and ensure a Condition Notification Report is initiated documenting the suspected anomaly. A condition notification report is a licensee communication tool used to report and record evaluations of data collected by various predictive maintenance technologies.

The three opportunities to initiate a condition notification report to determine the appropriate corrective actions after recording temperature anomalies for the Unit 3 Phase C main transformer 4-8 contactor were:

• On May 16, 2016, a thermography scan identified a 22°F temperature rise above reference on the 4-8 contactor. The thermographer did not recognize the anomaly and no condition notification report was initiated.

• On October 6, 2016, the thermographer identified two hotspots. One anomaly was on the Unit 3 Phase A main transformer 8-5 relay. The second anomaly was a 127°F temperature rise above reference on the Unit 3 Phase C main transformer 4-8 contactor. The thermographer generated a condition notification report and the condition report screening committee assigned a corrective maintenance work order containing both conditions. However, a work planner mistakenly cancelled the maintenance because the Phase A main transformer 8-5 relay was scheduled for replacement during the October 2016 refueling outage. Consequently, the licensee did not take any corrective actions for the Phase C main transformer 4-8 contactor.

• On April 30, 2017, a thermography scan identified an indication on the 4-8 contactor with a 106°F temperature increase above reference, but again the thermographer did not generate a condition notification report. The thermographer noted in the work order that the images were downloaded but still needed to be evaluated. A work planning supervisor in the maintenance department closed out the work order the following day, noting No anomalies found after review of thermographic images.

Following the loss of main transformer cooling and turbine trip on June 19, 2017, the licensee subsequently completed thermography on all nine main transformer cooling control cabinets in Units 1, 2, and 3. The licensee did not identify any additional abnormal conditions. As a corrective action, the licensee has committed to establish an engineering supervisor review of thermography data to ensure indications are correctly identified and corrective actions addressed.

Analysis.

The inspectors determined that the failure to follow procedure 37TI-9ZZ01, Thermography Inspection of Plant Components, Revision 8, Step 4.5.10.1 to initiate a condition notification report following the identification of elevated temperatures during thermography inspections is a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it was associated with the configuration control attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations.

Specifically, the failure to initiate corrective actions following the identification of the hot spot on the Unit 3 Phase C main transformer 4-8 contactor resulted in a reactor power cutback that upset plant stability. Using NRC Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 1, Initiating Events Screening Questions, the finding screened as having very low safety significance (Green) because the deficiency resulted in a reactor trip, but mitigation equipment remained unaffected. The inspectors determined this finding had a cross-cutting aspect in the area of problem identification and resolution, identification, in that the licensee failed to identify issues completely, accurately, and in a timely manner in accordance with the corrective action program. Specifically, on three occasions in 2016 and 2017, the licensee collected data indicating potential loose connections at the 4-8 contactor, but failed to recognize and communicate the data in accordance with the corrective action program [P.1].

Enforcement.

Enforcement action does not apply because the performance deficiency did not involve a violation of a regulatory requirement. Specifically, the main transformer cooling system does not perform a safety-related function. This issue was entered into the licensees corrective action program under Condition Report 17-09022. Because this finding does not involve a violation of a regulatory requirement and has very low safety significance, it is identified as a finding: FIN 05000530/2017003-01, Failure to Initiate Corrective Actions for Thermography Tests.

1R13 Maintenance Risk Assessments and Emergent Work Control

a. Inspection Scope

The inspectors reviewed three risk assessments performed by the licensee prior to changes in plant configuration and the risk management actions taken by the licensee in response to elevated risk:

• July 10, 2017, Unit 2 weekly risk assessment during high pressure safety injection and auxiliary feedwater valve work windows and engineered safeguards features switchgear heating, ventilation, and air conditioning (HVAC) planned maintenance

• August 3, 2017, Unit 3 weekly risk assessment during diesel generator relay replacement

• August 18-20, 2017, Unit 1 weekly risk assessment for engineered safeguards features actuation system B relays functional testing The inspectors verified that these risk assessment were performed timely and in accordance with the requirements of 10 CFR 50.65 (the Maintenance Rule) and plant procedures. The inspectors reviewed the accuracy and completeness of the licensees risk assessments and verified that the licensee implemented appropriate risk management actions based on the result of the assessments.

These activities constituted completion of three maintenance risk assessments and emergent work control inspection samples, as defined in Inspection Procedure 71111.13.

b. Findings

No findings were identified.

1R15 Operability Determinations and Functionality Assessments

a. Inspection Scope

The inspectors reviewed seven operability determinations that the licensee performed for degraded or nonconforming structures, systems, or components (SSCs):

• April 18, 2017, Unit 1 past operability determination of essential chiller B loss of refrigerant

• July 11, 2017, Unit 2 operability determination of essential cooling water pump A due to increased room cooler vibrations

• August 1, 2017, Unit 1 operability determination of diesel generator A control room test hand switch failure

• August 9, 2017, Unit 3 operability determination of reactor trip switchgear degraded test limit switch

• August 15, 2017, Unit 2 operability determination of safety injection manual valve SIBV185 shear pin failure

• August 17, 2017, Unit 1 operability determination of diesel generator B speed increase during shutdown cycle

• August 23, 2017, Unit 1 prompt operability determination of feedwater isolation valve 177 broken bolt found on 4-way valve end cap The inspectors reviewed the timeliness and technical adequacy of the licensees evaluations. Where the licensee determined the degraded SSC to be operable, the inspectors verified that the licensees compensatory measures were appropriate to provide reasonable assurance of operability. The inspectors verified that the licensee had considered the effect of other degraded conditions on the operability of the degraded SSC.

These activities constituted completion of seven operability and functionality review samples as defined in Inspection Procedure 71111.15.

b. Findings

NCV 05000528/2017003-02, Loss of Refrigerant Failure of Essential Chiller Unit due to Installation of Incorrect Parts

Introduction.

The inspectors reviewed a self-revealed, Green, non-cited violation of Technical Specification 3.7.10 Condition A for exceeding the allowed outage time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to restore one inoperable train of essential chilled water system to an operable status. Specifically, the Unit 1 essential chiller B was inoperable from April 11, 2017, to April 18, 2017, due to a refrigerant leak.

Description.

On April 17, 2017, an HVAC technician was conducting weekly chiller readings and noticed that there was no refrigerant visible in the level indicator for the Unit 1 essential chiller B. The control room declared essential chiller B inoperable entering Technical Specification Action Statement 3.7.10 Condition A. The HVAC technicians refilled the chiller unit with refrigerant and operations performed a surveillance test run of the chiller. Essential chiller B was declared operable on April 18, 2017.

An investigation performed by the HVAC technicians determined the direct cause of the event was a refrigerant leak through a Swagelok fitting in the air filter assembly that did not have a plug installed. As an immediate corrective action, the Swagelok fitting on essential chiller B was replaced with the appropriate fitting with a plug. Additionally, as an extent of condition, the licensee checked the other five essential chillers across the station and verified that the correct Swagelok fitting with a plug was installed per the design drawings.

The licensees apparent cause evaluation determined that prior to June 1, 2007, maintenance work orders involving the filter assembly for the essential chillers would individually list the parts required for the filter system (the filter, the Swagelok fitting with a plug, and the replacement filter element). However, work order 4018492 (performed on April 8, 2013) did not list the parts individually. Instead the filter assembly was listed as one part vice each component in the assembly being itemized. The licensees procedure for writing work orders per procedure 30DP-0AP01, Maintenance Work Order Writers Guide, Revision 51, Step 4.8.3 states, in part, that materials used in a work order are identified by ensuring that the material used meets the approved plant configuration. The licensee failed to meet this requirement when the work orders did not individually list each part of the filter assembly. This resulted in the installation of an incorrect part, specifically a Swagelok fitting with no plug. The follow on post-maintenance test directed for a leak check to be performed on a junction box that was not associated with the filter assembly.

In the past, the licensee has maintained the filter assembly isolated via isolation valve 13PECBV527 from the rest of the essential chiller unit. On April 11, 2017, the HVAC technicians opened isolation valve 13PECBV527 to place the Unit 1 B train essential chiller automatic purge units in service. Opening isolation valve 13PECVB527 served to connect the essential chiller unit to the filter assembly. This action was done following business review (basic or low-level) evaluation 17-02744-002 by the system engineer that supported maintaining these valves in the open position. This would allow for the automatic purge function to be utilized rather than requiring operators or HVAC technicians to manually purge the essential chiller unit. Instructions for work order 4734220 gave directions to verify the isolation valve was open. However there was no direction to check for leaks near the filter assembly where the isolation valve is located.

The post-maintenance test was not written in accordance with station procedure 30DP-9WP04, Post-Maintenance Testing Development, Revision 19, Step 4.1.4.3 which states, in part, that the testing should be tailored to the specific maintenance performed.

No maintenance was performed on the junction box, and no post-maintenance leak test was performed on the filter assembly or its subcomponents that were affected by the maintenance activity.

The licensees past operability evaluation concluded that the Unit 1 essential chiller B was inoperable since April 11, 2017, when isolation valve 13PECBV527 was repositioned by work order 4734220. This resulted in a period of inoperability of approximately seven days, which exceeded the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowable outage time to restore one inoperable chiller per Technical Specification 3.7.10 Condition A.

Analysis.

The licensees failure to ensure the correct Swagelok fitting was being installed in accordance with station procedure is a performance deficiency. The performance deficiency is more-than-minor and a finding because it is associated with the design control attribute associated with the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, on April 18, 2013, the licensee installed the incorrect Swagelok fitting during maintenance on the essential chiller. When the licensee placed the auto purge system in service, this resulted in the refrigerant leaking out of the Swagelok fitting rendering the essential chiller inoperable.

The inspectors performed the initial significance determination using NRC Inspection Manual Chapter 0609, Appendix A, Exhibit 2, Step A.3 required a senior reactor analyst to perform a detailed risk assessment because the essential chiller B was incapable of performing its safety function greater than its Technical Specification allowed outage time.

A regional senior reactor analyst performed a detailed risk evaluation and determined that the finding was of very low safety significance (Green). Essential Chiller 1B was assumed to be unavailable for 8 days and the potential for common cause failure on the remaining essential chiller was assumed. This resulted in a change in core damage frequency of 3.6E-7/year. Losses of offsite power comprised the most dominant core damage sequences. The emergency diesel generators and the emergency feed water systems remained available for mitigation of the dominant sequences.

The analyst reviewed the Palo Verde IPEEE to determine if external events would be a significant contributor to the increase in core damage frequency. Seismic and high wind events were screened out due to their significantly lower initiating event frequencies relative to the loss of offsite power initiating event frequency in the internal events model.

The analyst reviewed the internal event results to choose risk significant fires. From this review, the analyst evaluated switchgear, offsite power transformer; and main control board fires. These postulated fires occurring in the 8-day exposure time with the performance deficiency present represented an increase in core damage frequency of 1.1E-7 per year. Combining internal and external event inputs yielded an estimate of the total increase in core damage frequency of 4.7E-7 per year, or of very low safety significance (Green).

The analyst reviewed the dominant sequences and compared them to Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process. A review was conducted using the large early release screening criteria to determine that steam generator tube rupture sequences were the only potential significant contributor to large early release frequency. Since the increase in core damage frequency from steam generator tube rupture sequences for this finding was 1.6E-8 per year (below 1.0E-7 per year) the analyst screened the significance of the finding from large early release frequency to Green (very low safety significance). The analyst ran the Palo Verde SPAR model, Revision 8.50, on SAPHIRE, Version 8.1.5, to calculate the conditional core damage probability using a cutset truncation of 1.0E-12.

The finding has a cross-cutting aspect in the area of human performance associated with the avoid complacency component in that the licensee failed to recognize and plan for the possibility of latent issues or mistakes. Specifically the licensee failed to provide an appropriate post-maintenance testing procedure as required by station procedure.

The work order executed on April 11, 2017, gave no direction to test for leaks on the filter assembly. The licensee did not consider monitoring for potential leaks through the filter assembly when opening isolation valve 13PECVB527. [H.12]

Enforcement.

Technical Specification 3.7.10 Condition A states the licensee must restore an inoperable train of essential chill water to an operable status in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Contrary to the above, from April 11, 2017 to April 18, 2017, the Unit 1 B train essential chill water was inoperable and the licensee did not restore the inoperable train to an operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Specifically, on April 18, 2013, during maintenance on the essential chiller the licensee installed the incorrect Swagelok fitting. As a result, the refrigerant leaked out of the essential chiller when maintenance personnel placed the automatic purge unit into service on April 11, 2017. The licensees corrective actions included: isolating the automatic purge unit, thereby stopping the leak; refilling the essential chiller with refrigerant; and retesting the essential chiller unit to return it to an operable status on April 18, 2017. Additionally, the licensee checked the other five essential chillers across the station and found no additional material deficiencies.

Because this finding is of very low safety significance and has been entered into the licensees corrective action program as Condition Report 17-05605, this violation is being treated as a non-cited violation in accordance with Section 2.3.2.a of the Enforcement Policy: NCV 05000528/2017003-02, Loss of Refrigerant Failure of Essential Chiller Unit due to Installation of Incorrect Parts

1R19 Post-Maintenance Testing

a. Inspection Scope

The inspectors reviewed three post-maintenance testing activities that affected risk-significant structures, systems, or components (SSCs):

• July 12, 2017, Unit 2 auxiliary feedwater flow control valve timed stroke test following periodic maintenance

• August 7, 2017, Unit 1 diesel generator A start following control room hand switch replacement

• September 20, 2017, Unit 2 essential spray pond pump B replacement circuit breaker functional testing The inspectors reviewed licensing- and design-basis documents for the SSCs and the maintenance and post-maintenance test procedures. The inspectors observed the performance of the post-maintenance tests to verify that the licensee performed the tests in accordance with approved procedures, satisfied the established acceptance criteria, and restored the operability of the affected SSCs.

These activities constituted completion of three post-maintenance testing inspection samples, as defined in Inspection Procedure 71111.19.

b. Findings

No findings were identified.

1R22 Surveillance Testing

a. Inspection Scope

The inspectors observed four risk-significant surveillance tests and reviewed test results to verify that these tests adequately demonstrated that the structures, systems, and components (SSCs) were capable of performing their safety functions:

In-service tests:

• July 5, 2017, Unit 2 essential spray pond A comprehensive pump test

• July 31, 2017, Unit 3 turbine driven auxiliary feedwater pump test Other surveillance tests:

• August 18-20, 2017, Unit 1 ESFAS train B subgroup relay function test

• August 28, 2017, Station blackout generator 1 monthly surveillance test The inspectors verified that these tests met technical specification requirements, that the licensee performed the tests in accordance with their procedures, and that the results of the tests satisfied appropriate acceptance criteria. The inspectors verified that the licensee restored the operability of the affected SSCs following testing.

These activities constituted completion of four surveillance testing inspection samples, as defined in Inspection Procedure 71111.22.

b. Findings

No findings were identified.

1EP6 Drill Evaluation

Emergency Preparedness Drill Observation

a. Inspection Scope

The inspectors observed an emergency preparedness drill on July 18, 2017, to verify the adequacy and capability of the licensees assessment of drill performance. The inspectors reviewed the drill scenario, observed the drill from the Technical Support Center, and attended the post-drill critique. The inspectors verified that the licensees emergency classifications, off-site notifications, and protective action recommendations were appropriate and timely. The inspectors verified that any emergency preparedness weaknesses were appropriately identified by the licensee in the post-drill critique and entered into the corrective action program for resolution.

The inspectors observed an emergency preparedness drill on August 29, 2017, to verify the adequacy and capability of the licensees assessment of drill performance. The inspectors reviewed the drill scenario, observed the drill from the Emergency Operations Facility, and attended the post-drill critique. The inspectors verified that the licensees emergency classifications, off-site notifications, and protective action recommendations were appropriate and timely. The inspectors verified that any emergency preparedness weaknesses were appropriately identified by the licensee in the post-drill critique and entered into the corrective action program for resolution.

These activities constituted completion of two emergency preparedness drill observation samples, as defined in Inspection Procedure 71114.06.

b. Findings

No findings were identified.

OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Security

4OA1 Performance Indicator Verification

.1 Reactor Coolant System Specific Activity (BI01)

a. Inspection Scope

The inspectors reviewed the licensees reactor coolant system chemistry sample analyses for the period of July 1, 2016, through June 30, 2017, to verify the accuracy and completeness of the reported data. The inspectors observed a chemistry technician obtain and analyze a reactor coolant system sample on July 19, 2017. The inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, to determine the accuracy of the reported data.

These activities constituted verification of the reactor coolant system specific activity performance indicator for Units 1, 2, and 3, as defined in Inspection Procedure 71151.

b. Findings

No findings were identified.

.2 Reactor Coolant System Identified Leakage (BI02)

a. Inspection Scope

The inspectors reviewed the licensees records of reactor coolant system identified leakage for the period of July 1, 2016, through June 30, 2017, to verify the accuracy and completeness of the reported data. The inspectors observed the performance of 40ST-9RC02, ERFDADS (Preferred) Calculation of RCS Water Inventory on July 24, 2017. The inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, to determine the accuracy of the reported data.

These activities constituted verification of the reactor coolant system leakage performance indicator for Units 1, 2, and 3, as defined in Inspection Procedure 71151.

b. Findings

No findings were identified.

4OA2 Problem Identification and Resolution

.1 Routine Review

a. Inspection Scope

Throughout the inspection period, the inspectors performed daily reviews of items entered into the licensees corrective action program and periodically attended the licensees condition report screening meetings. The inspectors verified that licensee personnel were identifying problems at an appropriate threshold and entering these problems into the corrective action program for resolution. The inspectors verified that the licensee developed and implemented corrective actions commensurate with the significance of the problems identified. The inspectors also reviewed the licensees problem identification and resolution activities during the performance of the other inspection activities documented in this report.

b. Findings

No findings were identified.

.2 Annual Follow-up of Selected Issues

a. Inspection Scope

The inspectors selected one issue for an in-depth follow-up:

• On June 23, 2017, Unit 2 loss of letdown abnormal operating procedure entry The inspectors assessed the licensees problem identification threshold, cause analyses, extent of condition reviews, and compensatory actions. The inspectors verified that the licensee appropriately prioritized the corrective actions and that these actions were adequate to prevent the recurrence of losing letdown during future reactor coolant pump seal injection filter swapping evolutions.

These activities constituted completion of one annual follow-up sample as defined in Inspection Procedure 71152.

b. Findings

NCV 05000529/2017003-03, Failure to Follow Conduct of Operations Procedure

Introduction.

The inspectors reviewed a self-revealed, Green, non-cited violation of Technical Specification 5.4.1.a. for the licensees failure to implement their Conduct of Operations procedure. Specifically, licensee personnel improperly performed a reactor coolant pump seal injection filter flushing evolution as a skill of the craft task without written instructions. Consequently, Unit 2 experienced a loss of letdown and exceeded the pressurizer level technical specification limit of 56 percent.

Description.

On June 21, 2017, Fix-It-Now team (FIN) personnel attempted to isolate reactor coolant pump seal injection filter B in preparation to change out the filter under work order 4904773. Operators found the filter inlet isolation valve CHN-V819 leaking by its closed seat. At this point, the team could no longer follow their work order instructions and regrouped at the shop to determine an alternative solution to establish the plant conditions required to allow the filter change out. The team decided that the inlet valve was not seating correctly and may have debris obstructing the seating surface. The team surmised that the valve seat could be flushed with the charging system flow. The team did not discuss system pressures, pipe sizes, and flow rates.

On June 23, 2017, an area operator and FIN team mechanic discussed with the Unit 2 shift manager and control room supervisor the plan to flush the CHN-V819 valve seat.

The plan was to open the filter drain valve and cycle the inlet isolation valve several times. They felt this could be performed as skill of the craft as it was a simple task of flushing a valve which was performed regularly. The control room operators judged the flushing activity to be very simple and low risk, and would not cause an equipment status change. The team had the mindset that the flushing flow rate would be 10-15 gallons per minute which would be expected normal flow rate through seal injection. They did not recognize that this normal flow path includes a restricting orifice that limits the flow rate to the seal injection system. The proposed flushing flow path through the filter drain valve did not have a flow restricting orifice.

The FIN team headed to the plant and proceeded to perform the flush as they had planned. After the second cycling of the inlet isolation valve, the area operator radioed the control room to let them know the flush was complete. The control room operator informed the area operator that the plant was experiencing a loss of letdown and had entered abnormal operating procedure 40AO-9ZZ05, Loss of Charging or Letdown.

The flushing evolution had diverted approximately 70 gallons of charging and letdown flow to the equipment drain tank in less than 30 seconds. This flow diversion decreased flow to the regenerative heat exchanger which caused a high regenerative heat exchanger outlet temperature resulting in an automatic isolation of letdown. Shortly after the loss of letdown, pressurizer level exceeded its technical specification limit of 56 percent and operators entered Technical Specification 3.4.9 Condition A, a six-hour shutdown action statement. Control room operators were able to promptly restore letdown and pressurizer level began to lower. Technical Specification 3.4.9 was exited after 27 minutes.

The licensees apparent cause analysis report, 17-09326-009, found that control room operators had not properly implemented procedure 40DP-9OP02, Conduct of Operations, Revision 69, when allowing the valve flushing evolution to be performed as a skill of the craft task. Procedure 40DP-9OP02 Step 4.12.1 defines the criteria for designating a task as skill of the craft. Skill of the craft tasks must be low risk and performance of the task without written guidance must not result in an event as determined by the control room supervisor or shift manager. Step 4.12.2 states that if any of the criteria of Step 4.12.1 are not met, then use of a controlled document (for example, procedure) is required to provide guidance for performing the task. The reactor coolant pump seal injection filter valve seat flushing evolution was not low risk, resulted in an event, and was not performed with written guidance.

Analysis.

The inspectors determined that the failure to follow the Conduct of Operations procedure for performance of skill of the craft tasks is a performance deficiency. The performance deficiency is more than minor, and therefore a finding, because it was associated with the configuration control attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the decision to perform the reactor coolant pump seal filter flushing evolution without a controlled procedure allowed operators to place the system in a configuration causing an automatic isolation of the letdown system that challenged the availability of the pressurizer to respond to reactor coolant system pressure transients. The inspectors evaluated the significance of the issue under the Significance Determination Process, as defined in Inspection Manual Chapter 0609.04, Initial Characterization of Findings, and Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. The inspectors determined that the finding was of very low safety significance (Green) because it only contributed to the likelihood of a reactor trip and not the likelihood that mitigation equipment or functions would not be available. The inspectors determined this finding had a cross-cutting aspect in the area of human performance, avoid complacency, because the licensee failed to recognize and plan for the possibility of mistakes, latent issues, and inherent risk. Specifically, licensee personnel did not recognize the inherent risks associated with the reactor coolant pump seal filter flushing evolution before proceeding to perform the task without formal written instructions [H.12].

Enforcement.

Technical Specification 5.4.1.a requires, in part, that the licensee implement procedures recommended by Regulatory Guide 1.33, Revision 2. Regulatory Guide 1.33, Appendix A, Section 1 recommends procedures for authorities and responsibilities for safe operation and shutdown. The licensee satisfies these requirements, in part, through procedure 40DP-9OP02, Conduct of Operations, Revision 69. Procedure 40DP-9OP02, Step 4.12.1, defines criteria for designating a task as skill of the craft. Skill of the craft tasks must be low risk and performance of the task without written guidance will not result in an event as determined by the control room supervisor or shift manager. Step 4.12.2 states that if any of the criteria of Step 4.12.1 are not met, then use of a controlled document (for example, procedure) is required to provide guidance for performing the task. Contrary to the above, on June 23, 2017, Unit 2 operators performed a task that did not meet the skill of the craft criteria of Step 4.12.1 without the use of a controlled document to provide guidance for performing the task. Specifically, the reactor coolant pump seal filter valve seat flushing evolution was not low risk and resulted in an event. Unit 2 experienced a loss of letdown and exceeded the pressurizer level technical specification limit of 56 percent. Following the transient, control room operators stabilized the plant, and restored letdown and pressurizer level. Because this finding is of very low safety significance and has been entered into the licensees corrective action program as Condition Report 17-09326, this violation is being treated as a non-cited violation in accordance with Section 2.3.2.a of the Enforcement Policy: NCV 05000529/2017003-03, Failure to Follow Conduct of Operations Procedure.

4OA3 Follow-up of Events and Notices of Enforcement Discretion

.1 Licensee Event Report 05000528-2016-002-00, Reactor Trip due to Partially Open

Pressurizer Main Spray Valve

a. Inspection Scope

The inspectors reviewed a licensee event report regarding a manual reactor trip on Unit 1. On September 7, 2016, the unit was manually tripped and reactor coolant pumps were secured due to a control malfunction which prevented closure of a pressurizer spray valve. The cause of the spray valve malfunction was a failed pneumatic volume booster in the spray valve actuator system. The affected components were replaced during the forced outage. The event was reportable under 10 CFR 50.72(a)(2)(iv)(A) as an event that resulted in a manual actuation of the reactor protection system.

The inspectors determined that this event constituted a self-revealing violation of Technical Specification 5.4.1.a Procedures for a failure to follow established station procedures when determining required preventive maintenance frequencies.

Licensee Event Report 05000528-2016-002-00 is closed.

These activities constituted completion of one event follow-up sample, as defined in Inspection Procedure 71153.

b. Findings

NCV 0500530/2017003-04 Reactor Trip due to Pressurizer Spray Valve Failing Open due to Volume Booster Internals Not Environmentally Qualified for Anticipated Ambient Operating Temperatures

Introduction.

The inspectors reviewed a self-revealed, Green, non-cited violation of Technical Specification 5.4.1.a Procedures for the licensees failure to follow station procedure 73DP-0EE05, Engineering Preventive Maintenance Program, Revision 6.

The licensee did not consult design basis resources and operating experience when changing the preventive maintenance frequency of the pressurizer spray valve air-operated volume boosters. The valve internals were not rated for ambient operating temperature conditions, as a result a pressurizer spray valve failed open, requiring operators to trip the reactor.

Description.

On September 7, 2016, the licensee inadvertently sprayed water from the fire protection sprinkler system onto a non-class 480 Vac load center in the turbine building during sprinkler system testing. Electrical distribution from the bus was not affected, however, the licensee removed it from service to dry out the affected equipment. One of the affected loads was the non-class 120 Vac instrument power buses D11 and D12. At 9:31 p.m. the licensee decided to swap the instrument power to the emergency supply. However, a failed capacitor in the voltage regulating circuit on the emergency power supply caused irregular voltage signals on the instrument bus.

The irregular voltage affected the signal input to pressure (I/P) converter and the positioner of pressurizer spray valve, RC-100F, causing a demand perturbation of the pneumatic volume booster. This perturbation caused a neoprene O-ring internal to the volume booster to fail, resulting in a 5 percent pneumatic bypass flow which prevented the pressurizer spray valve from re-seating. With the pressurizer spray valve now failed open, reactor pressure began to drop from its normal value of 2250 psi. At 9:32 p.m.

operators manually tripped the reactor per procedure when reactor pressure dropped below 2075 psi. The operators then immediately secured the reactor coolant pumps which provide the motive force for the pressurizer spray lines. After completing the Standard Post Trip Actions procedure, the operators entered the Loss of Offsite Power

/ Loss of Forced Circulation emergency operating procedure. Operators established pressurizer pressure control by initiating auxiliary spray through the charging system.

Reactor pressure was restored to 2235 psi. Operators entered containment to manually isolate pressurizer spray valve RC-100F. At 12:15 a.m. on September 8, 2016, operators restored forced circulation via the reactor coolant pumps and exited the emergency operating procedure.

The licensee initiated Condition Report 16-14219 and conducted a root cause evaluation to determine the underlying causes of the event. The licensee identified the failure of the pneumatic volume booster as the direct cause of the event. The booster was sent to the vendor for a hardware failure analysis which identified an internal neoprene O-ring had failed likely due to higher than design temperature. The vendor provided feedback that neoprene O-rings were unsuitable in applications where temperatures exceed 130°F, and they recommended using a similar pneumatic volume booster with Viton O-rings in applications up to 200°F. The pressurizer cubicle temperature inside containment where the boosters are installed is typically 150-160°F during normal operations. The licensees root cause evaluation determined that the root cause of the event was that the pneumatic booster was not environmentally qualified up to its normal operating ambient temperature. The licensee is taking corrective actions for the pressurizer spray valves to replace all the neoprene pneumatic volume boosters with Viton boosters at the next refueling outage.

The vulnerability of the neoprene pneumatic volume boosters has existed since initial construction; however, the root cause evaluation determined that the licensee missed a significant opportunity to identify the vulnerability within the time frame of current licensee performance. The pneumatic volume boosters were replaced every refueling outage and typically discarded without inspection of the internals. However, in the 2012-2013 time frame, licensee engineers performed a preventive maintenance extension to increase the service life of the pressurizer spray neoprene boosters from one cycle (18 months) to four cycles (6 years). This effort was approved in 2014, however the extension did not take effect until the spring of 2016 when the booster replacement was skipped for the first time during a Unit 1 refueling outage. The root cause evaluation concluded that inadequacies in the preventive maintenance extension were a contributing cause to the event. Specifically, the governing station procedure did not require an appropriate level of review and documentation to justify the preventive maintenance frequency extension from one cycle to four cycles. The preventive maintenance extension was performed using the equipment reliability engineering template as defined in station procedure 73DP-0EE05, Engineering Preventive Maintenance Program, Revision 6. Step 3.4.7 instructs the engineer to consult various design basis information including operating experience and corrective action program data qualification resources when determining a required preventive maintenance (PM)frequency. Equipment reliability engineering template ERET 2826828 contained acknowledgement that the booster soft parts are not high temperature components, however the document lacked a technical basis. No exhaustive review of the original one cycle basis was provided in the justification. The pressurizer spray valve and its components were designated as critical components and as single point vulnerabilities which required additional technical basis to allow for the PM frequency change. The Action Item which made the change did not document such a basis, and no leader oversight or review was required or completed on the PM frequency change.

In conducting this root-cause review, the licensee observed a critical flaw that continued into the current revision of the procedure. The technical basis for a PM change can be provided via an Engineering Evaluation, Condition Report, Action Item, or Engineering Controlled Program Document. All of these document types have different levels of documentation and review requirements, but can ultimately be used to implement the same PM change. The licensee reached the conclusion that the performance deficiency associated with the contributing cause is indicative of current performance. The licensee took immediate corrective action to notify all engineering staff that any engineering actions taken under procedure 73DP-0EE05 require a full Engineering Evaluation and the justification and reviews that process entails. The licensee also issued Revision 12 of the procedure in July 2017 as a final action to resolve any programmatic inconsistency in the technical basis, justification, and review processes.

Analysis.

The inspectors determined that the failure to follow station procedure 73DP-0EE05, Engineering Preventive Maintenance Program, Revision 6, Step 3.4.7, to consult design basis information including internal operating experience resources when determining a required preventive maintenance frequency is a performance deficiency.

The performance deficiency is more than minor, and therefore a finding, because it was associated with the design control attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the pressurizer spray valve failed open requiring the operators to trip the reactor. The inspectors evaluated the significance of the issue under the Significance Determination Process, as defined in Inspection Manual Chapter 0609.04, Initial Characterization of Findings, and Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. The inspectors determined that the finding was of very low safety significance (Green) because the finding did not cause a reactor trip and the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition. Specifically, after the reactor trip, control room operators were able to regain pressure control by securing the reactor coolant pumps and initiating auxiliary spray through the charging system. The inspectors determined this finding had a cross-cutting aspect in the area of human performance, consistent process, in that the licensee failed to use a systematic approach to make decisions including incorporating risk insights. Specifically, the pressurizer spray valves are designated as critical components and single point vulnerabilities in 73DP-0EE05, which requires a technical basis to allow for a preventive maintenance frequency change. The licensee did not document the technical basis to increase the service life from one to four cycles [H.13].

Enforcement.

Technical Specification 5.4.1.a requires, in part, that the licensee implement procedures recommended by Regulatory Guide 1.33, Revision 2. Regulatory Guide 1.33, Appendix A, Section 9.b recommends procedures for scheduling preventive maintenance of components that have a specified lifetime. The licensee satisfies these requirements, in part, through procedure 73DP-0EE05 Engineering Preventive Maintenance Program, Revision 6. Procedure 73DP-0EE05, Step 3.4.7 requires design basis operating experience resources be consulted when determining required preventive maintenance activities. Contrary to the above, on June 28, 2013, the licensee determined required preventive maintenance activities without ensuring that applicable operating experience resources were adequately consulted. Specifically, pressurizer spray valve pneumatic volume boosters were approved for extended use in the pressurizer cubicle at ambient operating temperatures above vendor recommended limits. As a result, the booster internal O-rings failed directly causing a loss of reactor pressure control that required a manual reactor trip. The licensee entered this condition into their corrective action program as Condition Report 16-14219. The licensees corrective actions included replacing the affected pneumatic volume boosters with high temperature qualified soft parts and by revising procedure 73DP-0EE05 to ensure a more thorough engineering management oversight of the equipment reliability engineering template process. Because this finding is of very low safety significance (Green) and has been entered into the licensee corrective action program, it is being treated as a non-cited violation in accordance with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000528/2017003-04 Reactor Trip due to Pressurizer Spray Valve Failing Open due to Volume Booster Internals Not Environmentally Qualified for Anticipated Ambient Operating Temperatures.

.2 Licensee Event Report 05000530-2016-002-00 and 05000530-2016-002-01,

Emergency Diesel Generator Failure Resulting in a Condition Prohibited by Technical Specifications On December 15, 2016, Unit 3 diesel generator B experienced a catastrophic mechanical failure during a monthly surveillance test. Operators declared the diesel generator inoperable and entered Technical Specification LCO 3.8.1 Condition B. To support repairs, the licensee received two license amendments to extend the LCO 3.8.1 Condition B required action time from 10 days to a total of 62 days. The licensee completed repairs and the diesel generator was declared operable on February 10, 2017. The licensee conducted a root cause investigation and determined that the diesel generator was not capable of performing its safety function within the required action completion time specified in Technical Specification LCO 3.8.1 Condition B. Also, on two occasions on October 4, 2016, and September 7, 2016, when the Unit 3 diesel generator A was inoperable during planned maintenance, the Unit 3 diesel generator B was also likely not capable of performing its safety function. Thus, during these times, the degraded condition of the diesel generator B could have prevented the fulfillment of a safety function needed to mitigate the consequences of an accident.

The licensees investigation concluded that the direct cause of the diesel generator failure was high cycle fatigue of the #9 master rod ligament. The root cause was a misaligned crankshaft bore that resulted from a previous failure of the Unit 3 diesel generator B in 1986. As an initial corrective action to the 2016 failure, the licensee performed a precision line bore to restore the alignment to within manufacturer specifications. As an additional corrective action, the licensee committed to perform more frequent testing of diesel generator master rods to ensure identification of cracks prior to failure. The licensee has also begun to perform master rod bearing clearance and master rod stud preload checks to attempt to identify early indicator of conditions that could contribute to high cycle fatigue cracks. The inspectors reviewed the licensee event report and supplement, the licensees cause evaluation, and other corrective action documentation, including the licensees extent of condition investigation and post-maintenance test of the repaired diesel generator.

No findings or violations of NRC requirements were identified.

Licensee Event Reports 05000530/2016-002-00 and 05000530/2016-002-01 are closed.

.3 Licensee Event Report 05000528-2017-001-00, Essential Chiller B Inoperable Due to

Refrigerant Leak Resulting in Safety System Functional Failure On April 17, 2017, licensee staff identified a low refrigerant level in Unit 1 essential chiller B. Operations immediately declared the essential chiller B inoperable. On April 17, 2017, the leak was corrected and the essential chiller was refilled with refrigerant. The system was tested and declared operable on April 18, 2017. The chiller had been inoperable since April 11, 2017, when the automatic purge system was placed into service allowing refrigerant to leak out through an unplugged Swagelok fitting.

During the 7 day period that the essential chiller was inoperable, the supported low pressure safety injection system B was inoperable. On April 13, 2017, the low pressure safety injection system A was inoperable for a period of 17 minutes during performance of a routine surveillance. This 17 minute period represented a condition that could have prevented the fulfillment of a safety function.

The licensees investigation concluded that the cause of the leak was due to ineffective work instructions that did not identify the appropriate part number to be used during filter replacement. As a result, a fitting with no plug was installed in the filter assembly allowing the refrigerant to leak out. Corrective actions include revision of the work instructions to ensure that the existing plug type of fitting remains in place during future filter element replacements. A leak test was also added to the work instructions to verify that no refrigerant leaks are present following the maintenance.

A violation of NRC requirements pertaining to this event was identified and documented in Section 1R15 of this report.

Licensee Event Report 05000528-2017-001-00 is closed.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On October 6, 2017, the inspectors presented the inspection results to Mr. B. Rash, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

J. Cadogan, Senior Vice President, Site Operations

M. Lacal, Senior Vice President, Regulatory and Oversight

C. Kharrl, Vice President Operations and General Plant Manager

M. McGloughlin, Vice President Operations Support

B. Rash, Engineering Vice President

T. Horton, Director, Operations

T. Weber, Acting Director, Nuclear Regulatory Affairs

M. McGhee, Department Leader, Nuclear Regulatory Affairs

D. Elkinton, Section Leader, Nuclear Regulatory Affairs

M. Kura, Section Leader, Nuclear Regulatory Affairs

NRC Personnel

R. Deese, Sr. Reactor Analysist, RIV

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000530-2017003-01 FIN Failure to Initiate Corrective Actions for Thermography Tests (Section 1R12)

05000528-2017003-02 NCV Loss of Refrigerant Failure of Essential Chiller Unit due to Installation of Incorrect Parts (Section 1R15)

05000529-2017003-03 NCV Failure to Follow Conduct of Operations Procedure (Section 4OA2)

05000530-2017003-04 NCV Reactor Trip due to Pressurizer Spray Valve Failing Open due to Volume Booster Internals Not Environmentally Qualified for Anticipated Ambient Operating Temperatures (Section 4OA3.1)

Closed

05000528-2016002-00 LER Reactor Trip due to Partially Open Pressurizer Main Spray Valve (Section 4OA3.1)

05000530-2016002-00 LER Emergency Diesel Generator Failure Resulting in a Condition Prohibited by Technical Specifications (Section 4OA3.2)

05000530-2016002-01 LER Emergency Diesel Generator Failure Resulting in a Condition Prohibited by Technical Specifications (Section 4OA3.2)

05000528-2017001-00 LER Essential Chiller Inoperable due to Refrigerant Leak (Section 4OA3.3)