Text

NRC Component Design Base Inspection 05000528/2016007; 05000529/2016007; 05000530/2016007
	ML16280A625
Person / Time
Site:	Palo Verde
Issue date:	10/06/2016
From:	Thomas Farnholtz; Region 4 Engineering Branch 1
To:	Edington R; Arizona Public Service Co
References
	IR 2016007
	Download: ML16280A625 (48)
	v • d • e

ber 6, 2016

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 - NRC COMPONENT DESIGN BASES INSPECTION 05000528/2016007; 05000529/2016007; 05000530/2016007

Dear Mr. Edington:

On September 1, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Palo Verde Nuclear Generating Station. On September 1, 2016, the NRC inspectors discussed the results of this inspection with Mr. R. Bowman, Executive Vice President, Nuclear, and other members of your staff. Inspectors documented the results of this inspection in the enclosed inspection report.

NRC inspectors documented four findings of very low safety significance (Green) in this report.

All of these findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the Palo Verde Nuclear Generating Station.

If you disagree with a crosscutting aspect in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the Palo Verde Nuclear Generating Station. In accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRC's "Rules of Practice and Procedure," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS)

component of the NRC's Agencywide Documents Access and Management System (ADAMS).

ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Thomas R. Farnholtz, Branch Chief Engineering Branch 1 Division of Reactor Safety Docket Nos. 50-528, 50-529, and 50-530 License Nos. NPF-41, NPF-51, and NPF-74

Enclosure:

Inspection Report 05000528/2016007; 05000529/2016007; 05000530/2016007 w/Attachment: Supplemental Information

REGION IV==

Dockets: 05000528, 05000529, 05000530 Licenses: NPF-41, NPF-51, NPF-74 Report Nos.: 05000528/2016007; 05000529/2016007; 05000530/2016007 Licensee: Arizona Public Service Company Facility: Palo Verde Nuclear Generating Station Location: 5801 South Wintersburg Road Tonopah, AZ 85354 Dates: August 2 through September 1, 2016 Team Leader: W. Sifre, Senior Reactor Inspector, Engineering Branch 1 Inspectors: J. Drake, Senior Reactor Inspector, Engineering Branch 2 E. Stamm, Senior Reactor Inspector, Engineering Branch 1, RII S. Makor, Reactor Inspector, Engineering Branch 2 C. Stott, Reactor Inspector, Engineering Branch 1 Accompanying C. Baron, Contractor, Beckman and Associates Personnel: S. Kobylarz, Contractor, Beckman and Associates Approved By: Thomas R. Farnholtz Chief, Engineering Branch 1 Division of Reactor Safety Enclosure

SUMMARY

IR 05000528/2016007; 05000529/2016007; 05000530/2016007; 08/02/2016 - 09/01/2016;

Palo Verde Generating Station Baseline Inspection, NRC Inspection Procedure 71111.21,

Component Design Bases Inspection.

The inspection activities described in this report were performed between August 2, 2016, and September 1, 2016, by three inspectors from the NRCs Region IV office, one inspector from the NRCs Region II office, and two contractors. Four findings of very low safety significance (Green) are documented in this report and all four of these findings involved violations of NRC requirements. The significance of inspection findings is indicated by their color (Green, White,

Yellow, or Red), which is determined using Inspection Manual Chapter 0609, Significance Determination Process. Their crosscutting aspects are determined using Inspection Manual Chapter 0310, Aspects Within the Cross-Cutting Areas. Violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process.

Cornerstone: Mitigating Systems

Green.

The team identified a Green, non-cited violation of 10 CFR 50.63, Loss of All Alternating Current, which states, in part, The alternate AC power source, as defined in 10 CFR 50.2, will constitute acceptable capability to withstand station blackout provided an analysis is performed which demonstrates that the plant has this capability from onset of the station blackout until the alternate AC source(s) and required shutdown equipment are started and lined up to operate. Specifically, prior to August 5, 2016, the licensee replaced the gas turbine generator station blackout batteries in a modification to address obsolete components, but failed to identify the initial parameters to baseline the batteries and failed to implement a battery testing and maintenance program. In response to this issue, the licensee determined that the batteries continued to satisfy their design function and began to develop the necessary testing and preventive maintenance procedures. This finding was entered into the licensees corrective action program as Condition Report 14-02346.

The team determined that failure to implement preventative maintenance activities for the gas turbine generator station blackout batteries since their replacement in 2014 was a performance deficiency. This performance deficiency was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the licensee replaced the gas turbine generator station blackout batteries in a modification to address obsolete components, but failed to identify the initial parameters to baseline the batteries and failed to implement a battery testing and maintenance program.

In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2,

Mitigating Systems Screening Questions, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency that did not result in a loss of operability or functionality; did not represent an actual loss of safety function of a system or train; did not result in the loss of a single train for greater than technical specification allowed outage time; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding had a crosscutting aspect in the area of problem identification and resolution associated with resolution because the licensee failed to take effective corrective actions to address issues in a timely manner commensurate with their safety significance [P.3]. (Section 1R21.2.3.b)

Green.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, which states, in part, measures shall be established to assure that applicable regulatory requirements and the design basis, for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures, and instructions. Specifically, prior to August 5, 2016, the licensee did not adequately implement operator training and annunciator response procedures for Design Modification 216914, which resulted in the failure to adequately evaluate the impact on operability for the loss of forced cooling capability for the L31 load center transformer. In response to this issue, the licensee confirmed that the L31 load center was operable, but degraded, based on the remaining life for the transformer insulation when considering the maximum design basis accident load on the transformer and the expected load duration with the cooling fans disabled. This finding was entered into the licensees corrective action program as Condition Report 3-16-12571 and Condition Report 3-16-13316.

The team determined that the failure to adequately update design documentation, operating procedures, and operator training was a performance deficiency. This performance deficiency was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to update appropriate design calculations, annunciator response procedures, and licensed operator training when Design Modification 216904 was implemented in 1996 contributed to conditions that resulted in Operations preparing an inadequate Immediate Operability Determination when the L31 transformer cooling equipment failed on April 21, 2015. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the finding was determined to have very low safety significance (Green)because it was a design or qualification deficiency that did not result in the loss of operability or functionality; did not represent an actual loss of safety function of a system or train; did not result in the loss of a single train for greater than technical specification allowed outage time; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather.

This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance. (Section 1R21.2.5.b)

Green.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, which states, in part, Measures shall be established to assure that applicable regulatory requirements and the design basis for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures, and instructions. Specifically, prior to August 3, 2016, the licensee failed to establish measures to assure an adequate water level was maintained in the condensate storage tank, failed to establish a time critical action to isolate the condensate storage tank, and failed to establish specific procedures to isolate the condensate storage tank in the event of a tornado. In response to this issue, the licensee initiated the process to revise plant procedures and evaluate associated operator time critical actions. This finding was entered into the licensees corrective action program as Condition Reports 16-13761, 16-12430, and 16-13762.

The team determined that failure to verify the ability to isolate the safety-related condensate storage tank from the non-safety portion of the auxiliary feedwater system while preserving enough tank capacity to safely shutdown was a performance deficiency. This performance deficiency was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees failure to ensure timely isolation of the condensate storage tank would adversely affect the capability to safely shutdown the plant using the condensate storage tank and safety-related auxiliary feedwater system. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012,

Exhibit 2, Mitigating Systems Screening Questions, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency that did not result in a loss of operability or functionality; did not represent an actual loss of safety function of a system or train; did not result in the loss of a single train for greater than technical specification allowed outage time; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance.

(Section 1R21.2.15.b.1)

Green.

The team identified a Green, non-cited violation of 10 CFR 50.55a(g)4, Inservice Inspection Standards Requirement for Operating Plants, which states, in part, Throughout the service life of a pressurized water-cooled nuclear power facility, components that are classified as ASME Code Class 1, Class 2, and Class 3 must meet the requirements set forth in Section XI of the ASME Code. The ASME Code,Section XI, Article IWA-2610, requires that a reference system be established for all welds and areas subject to a surface or volumetric examination. Specifically, prior to August 8, 2016, for two welds located in an ASME Code,Section XI, Class 3, suction line between the condensate storage tank and the non-safety-related auxiliary feedwater pump, a weld reference system was not established.

In response to this issue, the licensee reclassified the subject welds and scheduled weld examinations to ensure potential cracks would be detected. This finding was entered into the licensees corrective action program as Condition Report 16-13150.

The team determined that the licensees failure to establish a weld reference system for two welds in the suction line between the condensate storage tank and the startup feed pump system was contrary to the ASME Code,Section XI, Article IWA-2610, and was a performance deficiency. This performance deficiency was more than minor because the finding, if left uncorrected, would become a more significant safety concern. Specifically, absent NRC identification, the licensee would not have examined these welds, which could have allowed service induced cracks to go undetected. Undetected cracks would place the suction pipe segment at increased risk for through-wall leakage and/or failure, which would affect the safety of an operating reactor. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency that did not result in the loss of operability of functionality; did not represent an actual loss of safety function of a system or train; did not result in the loss of a single train for greater than technical specification allowed outage time; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance. (Section 1R21.2.15.b.2)

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity This inspection of component design bases verifies that plant components are maintained within their design basis. Additionally, this inspection provides monitoring of the capability of the selected components and operator actions to perform their design basis functions. As plants age, modifications may alter or disable important design features making the design bases difficult to determine or obsolete. The plant risk assessment model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems, and Barrier Integrity cornerstones for which there are no indicators to measure performance.

1R21 Component Design Basis Inspection

Main article: IP 71111.21

.1 Overall Scope

To assess the ability of the Palo Verde Nuclear Generating Station equipment and operators to perform their required safety functions, the team inspected risk-significant components and the licensees responses to industry operating experience. The team selected risk-significant components for review using information contained in the Palo Verde Nuclear Generating Station probabilistic risk assessments and the U.S.

Nuclear Regulatory Commissions (NRC) standardized plant analysis risk model. In general, the selection process focused on components that had a risk achievement worth factor greater than 1.3 or a risk reduction worth factor greater than 1.005. The items selected included components in both safety-related and non-safety-related systems including pumps, circuit breakers, heat exchangers, transformers, and valves.

The team selected the risk-significant operating experience to be inspected based on its collective past experience.

To verify that the selected components would function as required, the team reviewed design basis assumptions, calculations, and procedures. In some instances, the team performed calculations to independently verify the licensee's conclusions. The team also verified that the condition of the components was consistent with the design basis and that the tested capabilities met the required criteria.

The team reviewed maintenance work records, corrective action documents, and industry operating experience records to verify that licensee personnel considered degraded conditions and their impact on the components. For selected components, the team observed operators during simulator scenarios, as well as during simulated actions in the plant.

The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design bases have been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions because of modifications, and margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as failed performance test results; significant corrective actions; repeated maintenance; 10 CFR 50.65(a)1 status; operable, but degraded, conditions; NRC resident inspector input of problem equipment; system health reports; industry operating experience; and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in-depth margins.

The inspection procedure requires a review of 15 to 25 total samples that include risk-significant and low design margin components, components that affect the large early release frequency, and operating experience issues. The sample selection for this inspection was 17 components, 3 of which affect large early release frequency, and 5 operating experience items. The selected inspection and associated operating experience items supported risk-significant functions including the following:

a. Electrical power to mitigation systems: The team selected several components in the electrical power distribution systems to verify operability to supply alternating current (ac)and direct current

(dc) power to risk-significant and safety-related loads in support of safety system operation in response to initiating events such as loss of offsite power, station blackout, and a loss-of-coolant accident concurrent with loss of offsite power available. As such the team selected:

125 Vdc Battery, 3E-PKA-F11

125 Vdc Battery Charger, 3E-PKA-H1

Gas Turbine Generator, Station Blackout Batteries

4160 V Bus, 3E-PBB-S04

480V Load Center Bus, 3E-PGB-L32

Safety-Related Inverter, 3E-PNA-N11

Gas Turbine Generator Buried Power Cables Components that affect large early release frequency: The team reviewed components required to perform functions that mitigate or prevent an unmonitored release of radiation. The team selected the following components:

Containment Spray Injection Valve, 2JSIBUV671

Containment Spray Check Valve, 2PSIAV164

Containment Spray Pump, 2MSIAP03 b. Mitigating systems needed to attain safe shutdown: The team reviewed components required to perform the safe shutdown of the plant. As such the team selected:

Spray Pond Chemical Addition and Filtration for Unit 3, Train B

Auxiliary Feedwater Pump, AFN-P01

Auxiliary Feedwater Pump N Discharge Check Valve, AFN V012

Gas Turbine Generator

Essential Chilled Water Pump, 3MECBP01

Essential Cooling Water Heat Exchangers, 2MEWAE01 and 2MEWBE01

Essential Chilled Water Expansion Tanks, 3MECAT01 and 3MECBT01

.2 Results of Detailed Reviews for Components:

.2.1 125 Vdc Battery, 3E-PK-F11

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with 125 Vdc Battery, 3E-PKA-F11. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function. Specifically, the team reviewed:

Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

Calculations for electrical distribution, system load flow/voltage drop, short-circuit, and electrical protection to verify that bus capacity and voltages remained within minimum acceptable limits.

Sizing calculations to verify input assumptions, design loading, and environmental parameters are appropriate and that the battery cell is sized to perform the battery design basis function.

Procedures for preventative maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

b. Findings

No findings were identified.

.2.2 Train A 125 Vdc Battery Charger, 3E-PKA-H1

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with 125 Vdc Battery Charger A Train, 3E-PKA-H1. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function.

Specifically, the team reviewed:

Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

Calculations for electrical distribution, system load flow/voltage drop, short-circuit, and electrical protection to verify that bus capacity and voltages remained within minimum acceptable limits.

Sizing calculations to verify input assumptions, design loading, and environmental parameters are appropriate and that the battery cell is sized to perform the battery design basis function.

Procedures for preventative maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

b. Findings

No findings were identified.

.2.3 Gas Turbine Generator Station Blackout Batteries

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with gas turbine generator station blackout batteries. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function.

Specifically, the team reviewed:

Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

Calculations for electrical distribution, system load flow/voltage drop, short-circuit, and electrical protection to verify that bus capacity and voltages remained within minimum acceptable limits.

Sizing calculations to verify input assumptions, design loading, and environmental parameters are appropriate and that the battery cell is sized to perform the battery design basis function.

Procedures for preventative maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

b. Findings

Failure to Establish Maintenance Activities and Instructions for Gas Turbine Generator Station Blackout Batteries

Introduction.

The team identified a Green, non-cited violation of 10 CFR 50.63, Loss of All Alternating Current, for the licensees failure to maintain appropriate quality assurance requirements for components needed to cope with a station blackout event.

Specifically, the licensee failed to establish adequate maintenance activities and instructions to demonstrate conformance with design and system readiness requirements through effective preventive maintenance.

Description.

In 2014, the licensee replaced the gas turbine generator station blackout batteries in a modification to address obsolete components. The team reviewed the replacement modification and determined that the licensee failed to identify the initial baseline parameters for the batteries, failed to establish and implement a maintenance program, and failed to meet the vendors requirements.

Regulatory Guide 1.155, Station Blackout, Section C.3.3.5, states, in part, that the alternate ac power source should have sufficient capacity to operate the systems necessary for coping with a station blackout for the time required to bring and maintain the plant in safe shutdown. Regulatory Guide 1.155, Section 3.5, Quality Assurance and Specification Guidance for Station Blackout Equipment That Is Not Safety-Related, states that the subject guidance is provided in Appendices A, Quality Assurance Guidance for Non-Safety Systems and Equipment; and B, Guidance Regarding System and Station Equipment Specifications, of the Regulatory Guide. In response to 10 CFR 50.63, Loss of All Alternating Current Power, as stated in Arizona Public Services letter to USNRC, No. 102-05370-CDM/TNW/RAB, dated October 28, 2005, Revised Station Blackout (Station blackout) Evaluation, the licensee adopted Regulatory Guide 1.155, Sections 3.3.5 and 3.5, and Appendix A, as the manner by which they would meet the requirements of 10 CFR 50.63. This includes Appendix A, Criterion 5, Testing and Test Control, which contains requirements for a test program to ensure that testing is performed to demonstrate conformance with design and system requirements.

The team determined that the licensees lack of maintenance activities on the batteries since installation was ineffective in demonstrating conformance with design and system readiness requirements. Although the batteries had internal monitoring which would alert the control room of any performance issues, this did not take the place of the required testing. The batteries were replaced under Work Order 2917568 which did not include any provisions to perform or identify maintenance activities. Condition Report 14-02346 was generated in September 2014 to address the need to review preventative maintenance strategy associated with station blackout gas turbine generators.

The team identified that there was nothing to address what inspections or tests should be completed in the interim. The team determined that there was no documentation of an initial capacity test or the performance of annual maintenance as recommended in the vendor manual. Although the licensee failed to establish a maintenance program when the batteries were installed in 2014, the licensee did perform an initial functional test.

Analysis.

The team determined that failure to implement preventative maintenance activities for the gas turbine generator station blackout batteries since their replacement in 2014 was a performance deficiency. This performance deficiency was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee replaced the gas turbine generator station blackout batteries in a modification to address obsolete components, but failed to identify the initial parameters to baseline the batteries and failed to implement a battery testing and maintenance program. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency that did not result in a loss of operability or functionality; did not represent an actual loss of safety function of a system or train; did not result in the loss of a single train for greater than technical specification allowed outage time; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding had a crosscutting aspect in the area of problem identification and resolution associated with resolution because the licensee failed to take effective corrective actions to address issues in a timely manner commensurate with their safety significance [P.3].

Enforcement.

The team identified a Green, non-cited violation of 10 CFR 50.63, Loss of All Alternating Current, which states, in part, The alternate AC power source, as defined in 10 CFR 50.2, will constitute acceptable capability to withstand station blackout provided an analysis is performed which demonstrates that the plant has this capability from onset of the station blackout until the alternate AC source(s) and required shutdown equipment are started and lined up to operate. Contrary to the above, prior to August 5, 2016, the licensee failed to demonstrate acceptable capability to withstand station blackout. Specifically, the licensee replaced the gas turbine generator station blackout batteries in a modification to address obsolete components, but failed to identify the initial parameters to baseline the batteries and failed to implement a battery testing and maintenance program. In response to this issue, the licensee determined that the batteries continued to satisfy their design function and began to develop the necessary testing and preventive maintenance procedures. This finding was entered into the licensees corrective action program as Condition Report 14-02346. Because this finding was of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000528;529;530/2016007-01, Failure to Establish Maintenance Activities and Instructions for Gas Turbine Generator Station Blackout Batteries.

.2.4 Train B 4160 V Bus, 3E-PBB-S04

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with train B 4160 V bus, 3E-PBB-S04. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function. Specifically, the team reviewed:

Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

Calculations for electrical distribution, system load flow/voltage drop, short-circuit, and electrical protection to verify that bus capacity and voltages remained within minimum acceptable limits.

The protective device settings and circuit breaker ratings to ensure adequate selective protection coordination of connected equipment during worst-case short circuit conditions.

Procedures for circuit breaker preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

Palo Verde Nuclear Generating Station response to NRC Information Notice 2006-31, Inadequate Fault Interrupting Rating of Breakers.

b. Findings

No findings were identified

.2.5 Unit 3, 480V Load Center Bus L32, 3E-PGB-L32

a. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with safety-related 480V load center bus L32. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function.

Specifically, the team reviewed:

Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

Calculations for electrical distribution, including system load flow/voltage drop and short-circuit current, to verify that system voltage and equipment ratings remained within minimum acceptable limits and that protective devices were adequately rated.

The protective device settings and circuit breaker ratings to ensure adequate selective protection coordination of connected equipment during worst-case short circuit conditions.

Design modifications to verify that design information was translated into design documentation, testing, training, and plant operating procedures.

Vendor documentation to verify that equipment ratings were translated into design documentation, training, and plant operating procedures, and

Periodic testing and maintenance to ensure equipment capability for reliable operation during worse-case design conditions.

b. Findings

Failure to Translate Information from Design Modification into Design Documentation, Operating Procedures, and Operator Training

Introduction.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to implement design control measures commensurate with those applied to the original design on a design change that added Class 1E transformer cooling fans and temperature indication and controls to 480 Volt load centers L31 and L32. Specifically, the licensee did not correctly translate the design information from the design change into specifications, drawings, procedures, and instructions.

Description.

In 1996, Design Modification 216904 implemented a modification to Class 1E electronic transformer temperature module for load centers L31 and L32 that included a digital indicator and six cooling fans that upgraded the transformer forced-air rating to 1000 KVA. Prior to the design modification, the load center transformer was rated at 750 KVA on its self-cooled rating. The transformer rating was upgraded to provide additional power to meet the maximum calculated load expected during loss of offsite power (LOOP) and forced shutdown conditions.

Upon review of the documents that were updated as a result of Design Modification 216914, the team found discrepancies in design and operator training documentation, and also the failure to adequately update alarm response procedures for the design change.

Specifically, the team found the operators load center alarm response procedures did not assess transformer operability for the loss of or the degradation of the forced-air cooling system that was required to operate so that the load center transformer could provide the power required during design basis conditions. Licensed operator training was also found deficient in that there was no training that identified the requirements for load center transformer cooling fans and their related temperature module control system to be operable to respond to plant accident conditions, such as loss of offsite power and forced shutdown. The team also found that relay setting sheets were based on the calculated maximum transformer load, but the relay setting calculations were not updated for the maximum load condition. This created a discrepancy between the setting sheets and the relay setting calculation. The team further found that the transformer overcurrent relay settings were based on calculated maximum load conditions, which was not in accordance with the calculations relay setting criteria that required relay settings based on the maximum rated transformer output.

During a plant walkdown on August 5, 2016, the team observed that the electronic temperature module for load center L31 was not functioning. The licensee originally initiated Condition Report 3-15-02001 for the condition that the team observed and performed an immediate operability determination that confirmed that the load center was operable. The team reviewed the immediate operability determination and found that the licensee evaluated the loss of transformer temperature indication, but failed to consider that the cooling fans controlled from the temperature module were not functional. The team confirmed that the licensees design analysis required the fans to operate for maximum design basis loading conditions, specifically loss of offsite power and forced shutdown. When the team questioned the content and adequacy of the original operability determination with regard to the apparent loss of fans for transformer cooling, the licensee prepared a revised immediate operability determination for Condition Report 3-15-02001 on August 5, 2016, that confirmed the load center was operable, but degraded. The revised operability determination was based on the remaining life for the transformer insulation, when considering the maximum design basis accident load on the transformer and the expected load duration with the cooling fans disabled.

The failure to adequately update the alarm response procedures and the lack of licensed operator training for the design change were considered by the team to be contributing factors that resulted in Operations preparing an inadequate immediate operability determination on Condition Report 3-15-02001 when the temperature monitor for load center 3E-PGA-L31 was found to be not indicating and giving an alarm in the control room.

Analysis.

The team determined that the failure to adequately update design documentation, operating procedures, and operator training was a performance deficiency. This performance deficiency was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the failure to update appropriate design calculations, annunciator response procedures, and licensed operator training when Design Modification 216904 was implemented in 1996 contributed to conditions that resulted in Operations preparing an inadequate Immediate Operability Determination when the L31 transformer cooling equipment failed on April 21, 2015. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency that did not result in the loss of operability or functionality; did not represent an actual loss of safety function of a system or train; did not result in the loss of a single train for greater than technical specification allowed outage time; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, which states, in part, measures shall be established to assure that applicable regulatory requirements and the design basis, for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, prior to August 5, 2016, the licensee failed to ensure that the applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the licensee did not adequately implement operator training and annunciator response procedures for Design Modification 216914, which resulted in the failure to adequately evaluate the impact on operability for the loss of forced cooling capability for the L31 load center transformer. In response to this issue, the licensee confirmed that the L31 load center was operable, but degraded, based on the remaining life for the transformer insulation when considering the maximum design basis accident load on the transformer and the expected load duration with the cooling fans disabled. This finding was entered into the licensees corrective action program as Condition Report 3-16-12571 and Condition Report 3-16-13316. Because this finding was of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000528;529;530/2016007-02, Failure to Translate Information from Design Modification into Design Documentation, Operating Procedures, and Operator Training.

.2.6 Unit 3, Safety Related Inverter, Channel A, 3E-PNA-N11

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with safety-related inverter, channel A. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function. Specifically, the team reviewed:

Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

Calculations for electrical distribution, including system load flow/voltage drop and short-circuit current, to verify that system and equipment voltages remained within minimum acceptable limits and that protective devices were adequately rated.

The protective device settings and circuit breaker ratings to ensure adequate selective protection coordination of connected equipment during worst-case short circuit conditions.

Periodic testing and maintenance to ensure equipment capability for reliable operation during worse-case design conditions.

Procedures for inverter preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

b. Findings

No findings were identified.

.2.7 Gas Turbine Generator Buried Power Cables

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, selected drawings, maintenance and test procedures, and condition reports associated with the gas turbine generator (GTG) buried power cables. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function. Specifically, the team reviewed:

Power cable voltage drop calculation to verify that system and equipment voltages remained within minimum acceptable limits.

Duct bank and cable ampacity calculations to verify power cable sizing and ampacity for the worse-case load conditions anticipated during station blackout.

The as-found field conditions during a walkdown and interior inspection of a typical manhole that contained buried gas turbine generator power cables and splices.

Power cable condition monitoring program and test results for the power cable insulation system, including the cable splices.

Power cable and cable protective device maintenance history and corrective action program reports to verify the monitoring of potential degradation.

b. Findings

No findings were identified.

.2.8 Containment Spray Injection Valve 2JSIBUV671

a. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with containment spray injection valve 2JSIBUV671. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function.

Specifically, the team reviewed:

Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

Calculations for variance in pressure against the valve to ensure the valve will operate within the tolerance of the output of the containment spray pumps.

Original vendor design specifications and maintenance manual.

Corrective action documents and system health reports to determine whether there were any adverse operating trends and to assess the stations ability to evaluate and correct problems.

Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

Completed surveillance procedures to verify valve opens within design acceptance criteria.

b. Findings

No findings were identified.

.2.9 Containment Spray Check Valve 2PSIAV164

a. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with containment spray check valve 2PSIAV164. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function.

Specifically, the team reviewed:

Procedures for preventive maintenance and inspection to compare maintenance practices against vendor guidance.

Maintenance records including the results of disassembly and inspection of the valve.

Completed surveillance procedures to verify the level in containment spray header piping remains above the minimum required height per technical specifications.

Trend data for integrated leak rate testing of containment.

b. Findings

No findings were identified.

.2.10 Spray Pond Chemical Addition and Filtration for Unit 3, Train B

a. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with spray pond chemical addition and filtration for Unit 3, train B. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function. Specifically, the team reviewed:

Results from changes made to the spray pond chemistry to preclude scaling inside the various heat exchangers that use the essential spray pond system for cooling.

Testing procedures and results of the spray pond to test for adequate chemical composition and filtration of the water coming from the ultimate heat sink.

Changes made to the filtration system to prevent inadvertently draining the ultimate head sink.

Piping arrangement of the essential spray pond system in concert with the crosstie valves in the ultimate heat sink to ensure adequate treated inventory is supplied to the essential spray pond system.

Inspections of the emergency chilled water heat exchanger, right and left emergency diesel generator intercoolers, lube oil heat exchanger, and jacket water heat exchanger have been verified that the heat exchanger tubes remain free from blockages and scaling that are expected to be precluded from use of the essential spray pond chemical addition and filtration system.

Calculations of the essential spray pond system with degraded spray headers due to a credible tornado design basis event.

Calculations to characterize the effects of sediment that accumulates at the bottom of the ultimate heat sink that is not filtered out by the filtration system.

Effectiveness of the screen mesh leading to the essential spray pond system pumps.

Design of the ultimate heat sink inventory with regards to the effects of normal system leakage and also from a postulated single passive failure of the essential spray pond system piping.

b. Findings

No findings were identified.

.2.11 Containment Spray Pump, 2MSIAP03

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with containment spray pump 2MSIAP03. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function. Specifically, the team reviewed:

Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

Corrective action documents issued in the past five years to verify that repeat failures, and potential chronic issues, will not prevent the pump and associated components from performing their safety function.

Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance, with special emphasis on whether test acceptance criteria supported design parameters and assumptions.

Runout analysis including design assumptions, limiting parameters, and whether the available net positive suction head was sufficient to satisfy the required net positive suction head to prevent cavitation and assure the capability of the pump to perform its safety function.

b. Findings

No findings were identified.

.2.12 Essential Chilled Water Pump, 3MECBP01

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with essential chilled water pump 3MECBP01. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function. Specifically, the team reviewed:

Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

Corrective action documents issued in the past five years to verify that repeat failures, and potential chronic issues, will not prevent the pump and associated components from performing their safety function.

Calculations for runout analysis and net positive suction head requirements.

Piping arrangement of the essential spray pond system in concert with the crosstie valves in the ultimate heat sink to ensure adequate treated inventory is supplied to the essential spray pond system.

Inspections of the emergency chilled water heat exchanger, right and left emergency diesel generator intercoolers, lube oil heat exchanger, and jacket water heat exchanger have been verified that the heat exchanger tubes remain free from blockages and scaling that are expected to be precluded from use of the essential spray pond chemical addition and filtration system.

Calculations of the essential spray pond system with degraded spray headers due to a credible tornado design basis event.

Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

b. Findings

No findings were identified.

.2.13 Essential Cooling Water Heat Exchangers 2MEWAE01 and 2MEWBE01

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with essential cooling water heat exchangers 2MEWAE01 and 2MEWBE01. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of these components to perform their design basis function. Specifically, the team reviewed:

Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

Calculations related to tube plugging allowances and system thermal performance.

Corrective action documents issued in the past five years to verify that repeat failures, and potential chronic issues, will not prevent the components from performing their safety function.

Vendor manual guidance and maintenance procedure guidance related to closure and torqueing of the heat exchanger channel covers.

Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

b. Findings

No findings were identified.

.2.14 Essential Chilled Water Expansion Tanks 3MECAT01 and 3MECBT01

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with essential chilled water expansion tanks 3MECAT01 and 3MECBT01. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of these components to perform their design basis function. Specifically, the team reviewed:

Component maintenance history and corrective action program reports to verify the monitoring of potential degradation.

Corrective Action documents issued in the past five years to verify that repeat failures, and potential chronic issues, will not prevent the components from performing their safety function.

Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance.

b. Findings

No findings were identified.

.2.15 Non-Safety Auxiliary Feedwater Pump AFN-P01

a. Inspection Scope

.1 The team reviewed the updated safety analysis report, system description, the current

system health report, selected drawings, maintenance and test procedures, and condition reports associated with the non-safety auxiliary feedwater pump, AFN-P01.

The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function.

Specifically, the team reviewed:

Component maintenance history and corrective action program reports to verify the monitoring of potential pump degradation.

Operating procedures and analyses to verify the ability to start and align pump to steam generators in the event of a loss of normal and emergency feedwater sources prior to steam generator dry out.

Results of recent pump tests to verify the capability of the pump to provide required flow to the steam generators in the event of a loss of normal and emergency feedwater sources.

Operating procedures and analyses to verify the ability to isolate a failed portion of the non-safety auxiliary feedwater system from the safety-related condensate storage tank while preserving enough tank capacity to safely shutdown.

Inservice inspection and inservice testing boundaries between the safety-related condensate storage tank and the non-safety auxiliary feedwater system to verify piping and components were being appropriately inspected and tested.

b. Findings

.1 Failure to Verify the Ability to Isolate the Safety-Related Condensate Storage Tank from

Non-Safety Piping

Introduction.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the ability to isolate the safety-related condensate storage tank from the non-safety portion of the auxiliary feedwater system while preserving enough tank capacity to safely shutdown the plant. Specifically, the licensee failed to ensure an adequate water level was maintained in the condensate storage tank, failed to analyze for or establish a time critical action to isolate the condensate storage tank, and failed to establish specific procedures to isolate the condensate storage tank in the event of a tornado.

Description.

Two motor-operated isolation valves, CT-HV-4 and CT-HV-1, were located between the condensate storage tank and the non-safety auxiliary feedwater pump suction piping. The team inspected the plants ability to close at least one of these isolation valves in the event of a downstream piping failure. Isolating these valves would be required to preserve enough condensate storage tank inventory to ensure a safe shutdown of the plant. The team also noted that the two motor-operated isolation valves were powered from the same vital bus, creating the possibility that the valves would have to be locally closed in the event of a single failure. The team identified several concerns related to this aspect of the design:

Plant operating procedures did not require a minimum water level in the condensate storage tank during non-safety auxiliary feedwater pump operation (plant startup, plant shutdown, and pump testing). As a result, there was no assurance that sufficient time would be available for the operators to close the valves in the event of a non-safety piping failure ensuring enough tank capacity to safely shutdown. In response to this concern, Condition Report 16-13761 was initiated to revise plant procedures to require a minimum condensate storage tank water level during non-safety auxiliary feedwater pump operation.

There was no analysis for time critical operator action to verify the operators ability to close these valves (either from the control room or locally, in the event of a single failure) in sufficient time to ensure adequate condensate storage tank volume. In response to this issue, Condition Report 16-12430 was initiated to evaluate this activity and initiate a time critical action if required.

The existing operating procedure addressed the isolation of these valves during a seismic event that could damage the non-safety piping, but did not include similar directions for a tornado event that could also damage the non-safety piping. In response to this issue, Condition Report 16-13762 was initiated to provide appropriate procedure changes.

Analysis.

The team determined that failure to verify the ability to isolate the safety-related condensate storage tank from the non-safety portion of the auxiliary feedwater system while preserving enough tank capacity to safely shutdown was a performance deficiency. This performance deficiency was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees failure to ensure timely isolation of the condensate storage tank would adversely affect the capability to safely shutdown the plant using the condensate storage tank and safety-related auxiliary feedwater system. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency that did not result in a loss of operability or functionality; did not represent an actual loss of safety function of a system or train; did not result in the loss of a single train for greater than technical specification allowed outage time; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, which states, in part, Measures shall be established to assure that applicable regulatory requirements and the design basis for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, prior to August 3, 2016, the licensee failed to ensure that the applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the licensee failed to establish measures to assure an adequate water level was maintained in the condensate storage tank, failed to establish a time critical action to isolate the condensate storage tank, and failed to establish specific procedures to isolate the condensate storage tank in the event of a tornado. In response to this issue, the licensee initiated the process to revise plant procedures and evaluate associated operator time critical actions. This finding was entered into the licensees corrective action program as Condition Reports 16-13761, 16-12430, and 16-13762. Because this finding was of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000528;529;530/2016007-03, Failure to Verify the Ability to Isolate the Safety-Related Condensate Storage Tank from Non-Safety Piping.

.2 Pipe Welds Not Incorporated into the Inservice Inspection Program

Introduction.

The team identified a Green, non-cited violation of 10 CFR 50.55a(g)4, Inservice Inspection Standards Requirement for Operating Plants, for the licensees failure to establish a weld reference system for two welds in the suction line between the condensate storage tank and the non-safety-related auxiliary feedwater pump.

Consequently, these welds had not been entered into the inservice inspection weld database used to schedule follow-up surface or volumetric examinations.

Description.

On August 8, 2016, the team identified that two welds in the piping between the safety-related condensate storage tank and the non-safety-related auxiliary feedwater pump had not been recorded on Inservice Inspection isometric drawings nor entered into the Inservice Inspection database used to schedule weld examinations.

Specifically, plant drawings indicated that the two valves, CT-HV-4 and CT-HV-1, were normally closed and that the inservice inspection boundary was located at the outlet of the upstream valve. However, the team determined that these valves were actually open whenever the non-safety-related auxiliary feedwater pump is operating during plant operation; this includes plant startup, shutdown, and pump testing. The team also observed that both valves and the intervening piping had been designed and installed as safety-related in accordance with the ASME Code,Section III. As a result, the team determined that the inservice inspection boundary should be located at the outlet of the second valve, providing a boundary of two open valves capable of closure.

The ASME Code,Section XI, Article IWA-2610, required a reference system for all welds and areas subject to a surface or volumetric examination. This reference system included permanent identification and location of each weld and weld centerline. The team was concerned that failure to examine a sample of these welds could lead to failure to detect service induced cracks. To correct this issue, the licensee implemented changes to the applicable Inservice Inspection isometric drawings and entered these welds into the inservice inspection database.

Analysis.

The team determined that the licensees failure to establish a weld reference system for two welds in the suction line between the condensate storage tank and the startup feed pump system was contrary to the ASME Code,Section XI, Article IWA-2610, and was a performance deficiency. This performance deficiency was more than minor because the finding, if left uncorrected, would become a more significant safety concern. Specifically, absent NRC identification, the licensee would not have examined these welds, which could have allowed service induced cracks to go undetected. Undetected cracks would place the suction pipe segment at increased risk for through-wall leakage and/or failure, which would affect the safety of an operating reactor. In accordance with Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the finding was determined to have very low safety significance (Green) because it was a design or qualification deficiency that did not result in the loss of operability of functionality; did not represent an actual loss of safety function of a system or train; did not result in the loss of a single train for greater than technical specification allowed outage time; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a crosscutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement.

The team identified a Green, non-cited violation of 10 CFR 50.55a(g)4, Inservice Inspection Standards Requirement for Operating Plants, which states, in part, Throughout the service life of a pressurized water-cooled nuclear power facility, components that are classified as ASME Code Class 1, Class 2, and Class 3 must meet the requirements set forth in Section XI of the ASME Code. The ASME Code,Section XI, Article IWA-2610, requires that a reference system be established for all welds and areas subject to a surface or volumetric examination. Contrary to the above, prior to August 8, 2016, the licensee failed to establish a reference system for all welds and areas subject to a surface or volumetric examination. Specifically, for two welds located in an ASME Code,Section XI, Class 3, suction line between the condensate storage tank and the non-safety-related auxiliary feedwater pump, a weld reference system was not established. In response to this issue, the licensee reclassified the subject welds and scheduled weld examinations to ensure potential cracks would be detected. This finding was entered into the licensees corrective action program as Condition Report 16-13150. Because this finding was of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000528;529;530/2016007-04, Pipe Welds Not Incorporated into the Inservice Inspection Program.

.2.16 Non-Safety Auxiliary Feedwater Pump Discharge Check Valve, 3AFN-V012

a. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with the non-safety auxiliary feedwater pump discharge check valve, 3AFN-V012. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function. Specifically, the team reviewed:

Component maintenance history and corrective action program reports to verify the monitoring of potential check valve degradation.

Results of recent tests and operations to verify the capability of the valve to provide required flow to the steam generators in the event of a loss of normal and emergency feedwater sources.

Operator logs for monitoring of non-safety auxiliary feedwater piping temperature to verify the non-safety auxiliary feedwater pump discharge check valve was not leaking excessively.

b. Findings

No findings were identified.

.2.17 Gas Turbine Generators

a. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with gas turbine generators. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its design basis function. Specifically, the team reviewed:

Component maintenance history and corrective action program reports to verify the monitoring of potential station blackout generator degradation.

Results of recent tests to verify the capability of the station blackout generators and associated equipment to provide required electrical power in the event of a loss of all external and internal power.

Vendor recommendations regarding the operation of the station blackout generators for an extended period of time to verify the capability of the equipment to provide required electrical power in the event of a delayed loss of all external and internal power.

b. Findings

No findings were identified.

No findings were identified.

.4 Results of Reviews for Operator Actions

a. Inspection Scope

The team selected risk-significant components and operator actions for review using information contained in the licensees probabilistic risk assessment. This included components and operator actions that had a risk achievement worth factor greater than two or Birnbaum value greater than 1E-6. For the review of operator actions, the team observed operators during simulator scenarios associated with the selected components as well as observing simulated actions in the plant.

The selected operator actions were:

Scenario 1 was a large break loss of coolant accident leading to a recirculation actuation signal and operator actions to isolate the refueling water tanks to prevent air binding of the emergency core cooling pumps. After the operators completed isolating the refueling water tanks, the timed actions and scenario were completed.

Scenario 2 was a loss of offsite power with the failure of the emergency diesel generator to automatically close onto the vital bus. The operators determined the emergency diesel generator was unavailable and declared a station blackout. The crew took actions to re-energize a vital bus from the station blackout generator.

When a vital bus was energized from the station blackout generator, the timed actions and the scenario were completed. The field actions were completed as a portion of the in-plant job performance measures.

Scenario 3 was a loss of feed. In addition, the A and B auxiliary feed water pumps were lost and the N auxiliary feed water pump suffered a loss of normal control power to the breaker. The crew was required to diagnose the problem and restore feed water to the steam generators prior to damaging the core. When feed water was restored to the steam generators, the timed actions and scenario were completed.

Scenario 4 was a fire near the control room that resulted in the operators evacuating the control room and taking actions to control the plant cooldown from the remote shutdown panel. After the operators completed transferring the atmospheric dump valve controls to local and commencing plant cooldown, the timed actions and scenario were completed.

In-plant job performance measure 1: This job performance measure was designed for the control room operators to don self-contained breathing apparatus within two minutes for a toxic environment in the control room affecting habitability.

This time critical action is described in the Updated Safety Analysis Report, Section 6.4.2.2 K.

In-plant job performance measure 2: This job performance measure was designed for the Area Nine operator to start the station blackout N generator and supply AC power to the NAN S07 bus for Unit 1 in sufficient time to allow the control room crew to restore power to one vital bus within the 60-minute time critical action.

In-plant job performance measure 3: This job performance measure was designed for the auxiliary operators to manually realign breakers and trips in the safety-related switchgear to allow buses to be reenergized from the station blackout generator.

In-plant job performance measure 4: This job performance measure was designed for the operators to place atmospheric dump valve disconnects to LOCAL and open specified breakers on PKA-D21 following control room evacuation.

b. Findings

No findings were identified.

OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity,

4OA2 Problem Identification and Resolution

Main article: IP 71152

The team reviewed action requests associated with the selected components, operator actions, and operating experience notifications. Any related findings are documented in prior sections of the report.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On September 1, 2016, the inspectors presented the inspection results to Mr. R. Bement, Executive Vice President, Nuclear, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

R. Bement, Executive Vice President of Nuclear Operations

M. Lacal, Sr. Vice President of Regulatory and Oversight

C. Kharrl, Vice President of Site Operations

M. McLaughlin, Vice President of Site Support

G. Andrews, Director Regulatory Affairs

K. House, Director Design Engineering

D. Elkinton, Section Leader, Compliance

D. Mooris, Engineer, Design Engineering

E. Arnold, Engineer, Plant Engineering

S. Schaeffer, Engineer, Plant Modifications

M. McKinley, Senior Engineer, Design Engineering

C. Arambula, Senior Engineer, Design Engineering

C. Sowers, Department Leader, Design Engineering

P. Beers, Senior Engineer, Design Engineering

W. Nau, Engineer III, Civil Design

C. King, Senior Engineer, Civil Design

C. Hsia, Senior Engineer, Plant Design Engineering

K. James, Engineer III, Plant Design Engineering

F. Gaber, Senior Engineer, SI System Engineer

Z. Hettel, Engineer III, EC System Engineer

J. Tolar, Senior Engineer, SI Design Engineer

D. Heckman, Senior Consultant, Regulatory Affairs

T. Romay, Operations support Manager, Operations

W. Barrero, Senior Consulting Engineer, Design Engineering

E. Montgomery, Consultant, Mechanical Design

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

Failure to Establish Maintenance Activities and

05000528;529;530/2016007-01 NCV Instructions for Gas Turbine Generator Station Blackout Batteries (Section 1R21.2.3.b)

Failure to Translate Information from Design Modification

05000528;529;530/2016007-02 NCV into Design Documentation, Operating Procedures, and Operator Training (Section 1R21.2.5.b)

Failure to Verify the Ability to Isolate the Safety-Related

05000528;529;530/2016007-03 NCV Condensate Storage Tank from Non-Safety Piping (Section 1R21.2.15.b.1)

Pipe Welds Not Incorporated into the Inservice Inspection

05000528;529;530/2016007-04 NCV Program (Section 1R21.2.15.b.2)

LIST OF DOCUMENTS REVIEWED

v t e Inspection Report - Palo Verde - 2016007
80 \| 81 \| 82 \| 83 \| 84 \| 85 \| 86 \| 87 \| 88 \| 89 \| 90 \| 91 \| 92 \| 93 \| 94 \| 95 \| 96 \| 97 \| 98 \| 99 00 \| 01 \| 02 \| 03 \| 04 \| 05 \| 06 \| 07 \| 08 \| 09 \| 10 \| 11 \| 12 \| 13 \| 14 \| 15 \| 16 \| 17 \| 18 \| 19 \| 20 \| 21 \| 22 \| 23 \| 24 \|
2016 Quarterly Integrated 1Q (3) 2Q (3) 3Q (0) 4Q (1) Assessments Mid Cycle End of Cycle 7(0) 8(2) 9(0) Security 201(0) 401(0) 402(0) 403(0) 404(1) 405(0) Operator Exams 301(0) Emergency Planning 501(0) Other