IR 05000250/2017007: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(Created page by program invented by StriderTol)
 
(7 intermediate revisions by the same user not shown)
Line 2: Line 2:
| number = ML17277A837
| number = ML17277A837
| issue date = 10/02/2017
| issue date = 10/02/2017
| title = Turkey Point Nuclear Generating Station - NRC Design Bases Assurance Inspection (Team) Report No. 05000250/2017007 and 05000251/2017007
| title = NRC Design Bases Assurance Inspection (Team) Report No. 05000250/2017007 and 05000251/2017007
| author name = Bartley J H
| author name = Bartley J
| author affiliation = NRC/RGN-II/DRS/EB1
| author affiliation = NRC/RGN-II/DRS/EB1
| addressee name = Nazar M
| addressee name = Nazar M
Line 18: Line 18:


=Text=
=Text=
{{#Wiki_filter:UNITED STATES NUCLEAR REGULATORY COMMISSION REGION II 245 PEACHTREE CENTER AVENUE NE, SUITE 1200 ATLANTA, GEORGIA 30303-1257 October 2, 2017  
{{#Wiki_filter:UNITED STATES NUCLEAR REGULATORY COMMISSION ber 2, 2017


Mr. Mano Nazar President and Chief Nuclear Officer Nuclear Division
==SUBJECT:==
TURKEY POINT NUCLEAR GENERATING STATION - NRC DESIGN BASES ASSURANCE INSPECTION (TEAM) REPORT NUMBER 05000250/2017007 AND 05000251/2017007


Florida Power & Light Company Mail Stop: EX/JB 700 Universe Blvd.
Dear Mr. Nazar On August 18, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Turkey Point Nuclear Generating Station Units 3 and 4. On August 18, 2017, the NRC inspectors discussed the results of this inspection with Mr. Brian Stamp, Plant General Manager, and other members of your staff. The results of this inspection are documented in the enclosed report.


Juno Beach, FL 33408
NRC inspectors documented nine findings of very low safety significance (Green) in this report.


SUBJECT: TURKEY POINT NUCLEAR GENERATING STATION - NRC DESIGN BASES ASSURANCE INSPECTION (TEAM) REPORT NUMBER 05000250/2017007 AND 05000251/2017007
Nine of these findings involved violations of NRC requirements; one of these violations was determined to be Severity Level IV under the traditional enforcement process. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.
 
Dear Mr. Nazar
 
On August 18, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Turkey Point Nuclear Generating Station Units 3 and 4. On August 18, 2017, the NRC inspectors discussed the results of this inspection with Mr. Brian Stamp, Plant General Manager, and other members of your staff. The results of this inspection are documented in the enclosed report.
 
NRC inspectors documented nine findings of very low safety significance (Green) in this report. Nine of these findings involved violations of NRC requirements; one of these violations was determined to be Severity Level IV under the traditional enforcement process. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the  
 
Enforcement Policy.


If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region II; the Director, Office of Enforcement; and the NRC resident inspector at the Turkey Point Nuclear Plant..
If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region II; the Director, Office of Enforcement; and the NRC resident inspector at the Turkey Point Nuclear Plant..
If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement] in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region II; and the NRC resident inspector at the Turkey Point Nuclear Plant.
If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement] in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region II; and the NRC resident inspector at the Turkey Point Nuclear Plant.


M. Nazar 2 This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, "Public Inspections, Exemptions, Requests for Withholding.
M. Nazar   2 This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.


"
Sincerely,
 
/RA/
Sincerely,/RA/
Jonathan H. Bartley, Chief Engineering Branch 1 Division of Reactor Safety Docket Nos. 50-250, 50-251 License Nos. DPR-31 and DPR-41
Jonathan H. Bartley, Chief Engineering Branch 1  
 
Division of Reactor Safety  
 
Docket Nos. 50-250, 50-251 License Nos. DPR-31 and DPR-41  


===Enclosure:===
===Enclosure:===
Inspection Report 05000250/2017007 and 05000251/2017007,  
Inspection Report 05000250/2017007 and 05000251/2017007, w/Attachment:
Supplemental Information


===w/Attachment:===
REGION II==
Supplemental Information
Docket Nos.: 050000250, 05000251 License Nos.: DPR-31 and DPR-41 Report Nos.: 05000250/2017007, 05000251/2017007 Licensee: Florida Power and Light Facility: Turkey Point Nuclear Generating Station, Units 3 and 4 Location: Homestead, FL Dates: July 31, 2017 - August 18, 2017 Inspectors: T. Fanelli, Senior Reactor Inspector (Lead)
S. Bussey, Senior Reactor Technology Instructor M. Riley, Reactor Inspector N. Morgan, Reactor Inspector M. Jones, Reactor Inspector (RIII)
H. Leake, Contractor R. Waters, Contractor Approved by: Jonathan H. Bartley, Chief Engineering Branch 1 Division of Reactor Safety Enclosure


cc: Distribution via ListServ
=SUMMARY=
IR 05000250/2017-007, 05000251/2017-007; 7/31/2017 - 8/18/2017; Turkey Point Nuclear


__ _____________ SUNSI REVIEW COMPLETE FORM 665 ATTACHED OFFICE RII:DRS RII:DRS RII:DRS RIII:DRS CONTRACTOR CONTRACTOR RII:DRP SIGNATURE JHB1 FOR TNF1 VIA EMAIL VIA EMAIL VIA EMAIL VIA EMAIL VIA EMAIL VIA EMAIL NAME TFANELLI MRILEY NMORGAN MJONES RWATERS HLEAKE LSUGGS DATE 10/2/2017 9/26/2017 9/22/2017 9/22/2017 9/26/2017 9/23/2017 9/29/2017 E-MAIL COPY? YES NO YES NO YES NO YES NO YES NO YES NO YES NO OFFICE ADHRTD: RTTB SIGNATURE VIA EMAIL NAME SBUSSEY DATE 10/2/2017 E-MAIL COPY? YES NO Enclosure U. S. NUCLEAR REGULATORY COMMISSION
Generating Station Units 3 and 4; Design Bases Assurance Inspection (Team).


REGION II  
The inspection activities described in this report were performed between July 31, 2017 and August 18, 2017, by five Nuclear Regulatory Commission (NRC) inspectors and one trainee from Region II and one inspector from Region III. The significance of inspection findings are indicated by their color (i.e., greater than Green, or Green, White, Yellow, or Red) and determined using Inspection Manual Chapter (IMC) 0609, Significance Determination Process, (SDP) dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310, Aspects Within the Cross-Cutting Areas, dated December 4, 2014. All violations of NRC requirements were dispositioned in accordance with the NRCs Enforcement Policy dated November 1, 2016.


Docket Nos.: 050000250, 05000251
The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision


License Nos.: DPR-31 and DPR-41
===NRC-Identified and Self-Revealing Findings===


Report Nos.: 05000250/2017007, 05000251/2017007
===Cornerstone: Initiating Events===
* Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, for failure to verify or check the adequacy of design of the under frequency trip feature of the main generator circuit breakers with regard to the effect of its operation on plant stability and the maintenance of critical safety functions. The licensee entered this issue into their corrective action program as AR 2220874 and AR 2224998.


Licensee: Florida Power and Light
The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions. Specifically, opening of the main generator breakers due to an under frequency condition on the offsite power system would cause the generator load to suddenly drop from full power to the level of the plant loads, and there was no verification that plant stability and critical safety functions would be maintained. The team evaluated the finding with Inspection Manual Chapter 0609,
Appendix A, and determined the finding met the Support System Initiators screening criteria for requiring a detailed risk evaluation. The team determined that this issue increased the likelihood of the support system initiator loss of offsite power (LOOP).


Facility: Turkey Point Nuclear Generating Station, Units 3 and 4
The regional senior risk analyst conducted a detailed risk evaluation with a one year exposure and determined the change in core damage frequency was less than 1E-6, which was of very low safety significance (Green). The team did not assign a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.2)
* Green: The NRC identified a Green non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the adequacy of design for the non-safety related component protective covers attached to safety related equipment. For immediate corrective actions, the licensee entered this into their corrective action program as AR 02220993 and removed visibly degraded protective covers.


Location: Homestead, FL
The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute and of the Initiating Events Cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the failure to ensure the quality and qualification of commercial components and assemblies to maintain adequate mounting to Class 1E equipment increased the likelihood of inadvertent component failures, and thus increased the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. The team determined the finding to be of very low safety significance because the finding did not cause a reactor trip and the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition (e.g. loss of condenser, loss of feedwater). This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.


Dates: July 31, 2017 - August 18, 2017
      (Section 1R21.2.b.4)


Inspectors: T. Fanelli, Senior Reactor Inspector (Lead) S. Bussey, Senior Reactor Technology Instructor M. Riley, Reactor Inspector N. Morgan, Reactor Inspector M. Jones, Reactor Inspector (RIII)
===Cornerstone: Mitigating Systems===
H. Leake, Contractor
* Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, for failure to verify that coordination exists between the protective devices on safety related switchgear in order to minimize the probability of losing a safety related power bus. For immediate corrective actions, the licensee entered this issue into their corrective action program as Action Request (AR) 2220956 and performed an operability determination, which determined the system was operable, and was performing a reevaluation of the calculation to determine adequate coordination.
 
R. Waters, Contractor
 
Approved by: Jonathan H. Bartley, Chief Engineering Branch 1 Division of Reactor Safety


=SUMMARY=
The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, failing to verify short circuits in non-safety related SSCs downstream of the safety related switchgear would not cause a lockout of the safety-related bus affected its availability and reliability. The team determined the finding to be of very low safety significance because the finding was a deficiency affecting the design of a mitigating structure, system, or component (SSC), and the SSC maintained their operability or functionality. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.1)
IR 05000250/2017-007, 05000251/2017-007; 7/31/2017 - 8/18/2017; Turkey Point Nuclear Generating Station Units 3 and 4; Design Bases Assurance Inspection (Team).
* Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the adequacy of design of temperature set points used for isolation of the Component Cooling Water (CCW) from the CCW supplemental cooling system (SCS) during an accident. For immediate corrective actions, the licensee entered this into their corrective action program as AR 2218834, performed an operability determination, which determined the system is operable but non-conforming, and issued engineering change (EC) 289598 to account for uncertainties in the CCW SCS temperature isolation setpoint.


The inspection activities described in this report were performed between July 31, 2017 and August 18, 2017, by five Nuclear Regulatory Commission (NRC) inspectors and one trainee from Region II and one inspector from Region III. The significance of inspection findings are indicated by their color (i.e., greater than Green, or Green, White, Yellow, or Red) and determined using Inspection Manual Chapter (IMC) 0609, "Significance Determination Process," (SDP) dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310, "Aspects Within the Cross-Cutting Areas," dated December 4, 2014. All violations of NRC requirements were dispositioned in accordance with the NRC'
The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, by not ensuring prompt isolation or adjusting the isolation setpoint to account for instrument uncertainties and temperature lag, the licensee failed to ensure that the SCS loop would be isolated at onset of an accident, which affected the reliability and capability of the CCW system when called upon. The determined the finding to be of very low safety significance because the findings were a deficiency affecting the design of a mitigating structure, system, or component (SSC), and the SSC maintained their operability or functionality. The finding had a cross-cutting aspect in the area of Human Performance because the licensee failed to ensure knowledge transfer to maintain a knowledgeable, technically competent workforce and instill nuclear safety values [H.9]. (Section 1R21.2.b.3)
s Enforcement Policy dated November 1, 2016. The NRC's program for overseeing the safe operati on of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 6.
* Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion XI, Test Control, for the licensees failure to perform surveillance testing on station battery 3B in accordance with the requirements of Institute of Electrical and Electronic Engineers (IEEE) 450-1987. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2219948 and performed an extent of condition review, which determined that none of the station batteries were currently in a degraded condition, and placed surveillance procedure 0-SME-003.15 on administrative hold until the corrective actions are completed.


===NRC-Identified and Self-Revealing Findings===
The performance deficiency was determined to be more than minor because if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern. Specifically, the performance deficiency could result in masking degradation of the battery on future performance discharge tests and adversely affect the ability to trend when the testing periodicity should be increased to once a year as required by Technical Specifications (TS). The team determined the finding to be of very low safety significance because the finding did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for greater than 24 hrs. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.5)
* Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the Emergency Containment Cooler (ECC) unit 4A auto start circuitry would not result in exceeding the thermal limits of the CCW system during a design basis accident.


===Cornerstone: Initiating Events===
Specifically, the licensee failed to verify that a single active failure of the motor starter auxiliary contacts would not result in exceeding the design basis limits for CCW as described in updated final safety analysis report (UFSAR) Section 9.3. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2219505, performed a prompt determination of operability, and determined that the CCW system remained operable.
* Green:  The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, "Design Control," for failure to verify or check the adequacy of design of the under frequency trip feature of the main generator circuit breakers with regard to the effect of its operation on plant stability and the maintenance of critical safety functions. The licensee entered this issue into their corrective action program as AR 2220874 and AR 2224998. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions. Specifically, opening of the main generator breakers due to an under frequency condition on the offsite power system would cause the generator load to suddenly drop from full power to the level of the plant loads, and there was no verification that plant stability and critical safety functions would be maintained. The team evaluated the finding with Inspection Manual Chapter 0609,
Appendix A, and determined the finding met the Support System Initiators screening criteria for requiring a detailed risk evaluation. The team determined that this issue increased the likelihood of the support system initiator "loss of offsite power (LOOP)."


The regional senior risk analyst conducted a detailed risk evaluation with a one year exposure and determined the change in core damage frequency was less than 1E-6, which was of very low safety significanc e (Green). The team did not assign a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.2)
The performance deficiency was determined to be more than minor because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, three ECC fans running during a during a design basis accident would result in exceeding the design basis temperature of 158.6 °F for the
* Green:  The NRC identified a Green non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the adequacy of design for the non-safety related component protective covers attached to safety related equipment. For immediate corrective actions, the licensee entered this into their corrective action program as AR 02220993 and removed visibly degraded protective covers.


3        The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute and of the Initiating Events Cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the failure to ensure the quality and qualification of commercial components and assemblies to maintain adequate mounting to Class 1E equipment increased the likelihood of inadvertent component failures, and thus increased the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. The team determined the finding to be of very low safety significance because the finding did not cause a reactor trip and the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition (e.g. loss of condenser, loss of feedwater). This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.
CCW supply and a significant reduction in margin for the SI pump lube oil cooler. The team determined the finding to be of very low safety significance because the finding was a deficiency affecting the design of a mitigating structure, system, or component (SSC) and the SSC maintained its operability. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.6)
: '''Green.'''
The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the licensees failure to inspect Intake Cooling Water (ICW) piping in accordance with license renewal commitments. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 02218430 and AR 02218437, planned to perform localized corrosion wall thickness measurements to ensure the ICW system remained operable.


(Section 1R21.2.b.4)
The performance deficiency was determined to be more-than-minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the reliability of systems that respond to initiating events to prevent undesirable consequences.


===Cornerstone: Mitigating Systems===
Specifically, unmonitored corrosion affects the reliability of the ICW systems. The team determined the finding to be of very low safety significance because it did not represent an actual loss of function of one or more non-Tech Spec trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for
* Green:  The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, "Design Control," for failure to verify that coordination exists between the protective devices on safety related switchgear in order to minimize the probability of losing a safety related power bus. For immediate corrective actions, the licensee entered this issue into their corrective action program as Action Request (AR) 2220956 and performed an operability determination, which determined the system was operable, and was performing a reevaluation of the calculation to determine adequate coordination. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, failing to verify short circuits in non-safety related SSCs downstream of the safety related switchgear would not cause a lockout of the safety-related bus affected its availability and reliability. The team determined the finding to be of very low safety significance because the finding was a deficiency affecting the design of a mitigating structure, system, or component (SSC), and the SSC maintained their operability or functionality. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.1)
      >24 hrs. The finding had a cross-cutting aspect in the area of Problem Identification and Resolution, Identification, because the licensee failed to implement a corrective action program with a low enough threshold for identifying issues [P.1]. Specifically, individuals routinely failed to identify corrosion issues on CCW system area walk downs that exceeded proceduralized acceptance criteria of light surface rust specified in 0-ADM-564, during the July 5, 2017, August 11, 2016, and April 11, 2016 CCW area walk downs. (Section 1R21.2.b.7)
* Green:  The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the adequacy of design of temperature set points used for isolation of the Component
 
Cooling Water (CCW) from the CCW supplemental cooling system (SCS) during an accident. For immediate corrective actions, the licensee entered this into their corrective action program as AR 2218834, performed an operability determination, which determined the system is operable but non-conforming, and issued engineering change (EC) 289598 to account for uncertainties in the CCW SCS temperature isolation setpoint. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, by not ensuring prompt isolation or adjusting the isolation setpoint to account for instrument uncertainties and temperature lag, the licensee failed to ensure that the SCS loop would be isolated at onset of an accident, which affected the reliability and capability of the CCW system when called upon. The determined the finding to be of very low safety significance because the findings were a deficiency affecting the design of a mitigating structure, system, or component (SSC), and the SSC maintained their operability or functionality. The finding had a cross-cutting aspect in the area of Human Performance because the licensee failed to ensure knowledge transfer to maintain a knowledgeable, technically competent workforce and instill nuclear safety values [H.9]. (Section 1R21.2.b.3)
* Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion XI, "Test Control," for the licensee's failure to perform surveillance testing on station battery 3B in accordance with the requirements of Institute of Electrical and Electronic Engineers (IEEE) 450-1987. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2219948 and performed an extent of condition review, which determined that none of the station batteries were currently in a degraded condition, and placed surveillance procedure 0-SME-003.15 on administrative hold until the corrective actions are completed. The performance deficiency was determined to be more than minor because if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern. Specifically, the performance deficiency could result in masking degradation of the battery on future performance discharge tests and adversely affect the ability to trend when the testing periodicity should be increased to once a year as required by Technical Specifications (TS). The team determined the finding to be of very low safety significance because the finding did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety-significant in accordance with the licensee's maintenance rule program for greater than 24 hrs. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.5)
* Green:  The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the Emergency Containment Cooler (ECC) unit 4A auto start circuitry would not result in exceeding the thermal limits of the CCW system during a design basis accident. Specifically, the licensee failed to verify that a single active failure of the motor starter auxiliary contacts would not result in exceeding the design basis limits for CCW as described in updated final safety analysis report (UFSAR) Section 9.3. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2219505, performed a prompt determination of operability, and determined that the CCW system remained operable. The performance deficiency was determined to be more than minor because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, three ECC fans running during a during a design basis accident would result in exceeding the design basis temperature of 158.6 °F for the 5        CCW supply and a significant reduction in margin for the SI pump lube oil cooler. The team determined the finding to be of very low safety significance because the finding was a deficiency affecting the design of a mitigating structure, system, or component (SSC) and the SSC maintained its operability. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.6)
: '''Green.'''
The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," for the licensee's failure to inspect Intake Cooling Water (ICW) piping in accordance with license renewal commitments. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 02218430 and AR 02218437, planned to perform localized corrosion wall thickness measurements to ensure the ICW system remained operable. The performance deficiency was determined to be more-than-minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the reliability of systems that respond to initiating events to prevent undesirable consequences. Specifically, unmonitored corrosion affects the reliability of the ICW systems. The team determined the finding to be of very low safety significance because it did not represent an actual loss of function of one or more non-Tech Spec trains of equipment designated as high safety-significant in accordance with the licensee's maintenance rule program for >24 hrs. The finding had a cross-cutting aspect in the area of Problem Identification and Resolution, Identification, because the licensee failed to implement a corrective action program with a low enough threshold for identifying issues [P.1]. Specifically, individuals routinely failed to identify corrosion issues on CCW system area walk downs that exceeded proceduralized acceptance criteria of "light surface rust" specified in 0-ADM-564, during the July 5, 2017, August 11, 2016, and April 11, 2016 CCW area walk downs. (Section 1R21.2.b.7)  


===Cornerstone: Barrier Integrity===
===Cornerstone: Barrier Integrity===
* Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion XVI, "Corrective Action," for the licensee's failure to take timely corrective action to maintain the unit 3 and 4 containment cathodic protection systems. These systems have been non-functional on both units since 2009. The cathodic protection system's purpose is to protect the containment's interconnected liner, reinforcing bars, and tendon trumplates. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2216534 and performed a prompt operability determination. The licensee concluded that the containment structure was operable but non-conforming and established plans to monitor the potentially impacted inaccessible areas through continued performance of the American Society of Mechanical Engineers (ASME) IWL and IWE programs until actions are taken to restore the Cathodic Protection System.
* Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion XVI, Corrective Action, for the licensees failure to take timely corrective action to maintain the unit 3 and 4 containment cathodic protection systems. These systems have been non-functional on both units since 2009. The cathodic protection systems purpose is to protect the containments interconnected liner, reinforcing bars, and tendon trumplates. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2216534 and performed a prompt operability determination. The licensee concluded that the containment structure was operable but non-conforming and established plans to monitor the potentially impacted inaccessible areas through continued performance of the American Society of Mechanical Engineers (ASME) IWL and IWE programs until actions are taken to restore the Cathodic Protection System.


The performance deficiency was determined to be more than minor, because it is associated with the Design Control attribute of the Barrier Integrity cornerstone and affected the cornerstone objective of maintaining the containment structural integrity and operational capability to provide reasonable assurance that the containment protects the public from radionuclide releases caused by accident or events. Specifically, the failure to implement timely corrective actions to maintain the protection of the containment's interconnected liner, reinforcing bars, and tendon trumplates affected the structural integrity and operational capability of the containment structure. The team determined the finding to be of very low safety significance because the finding was not a pressurized thermal shock issue, did not represent an actual open pathway in the physical integrity of the reactor containment, and did not involve an actual reduction in function of hydrogen igniters in the reactor containment. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.
The performance deficiency was determined to be more than minor, because it is associated with the Design Control attribute of the Barrier Integrity cornerstone and affected the cornerstone objective of maintaining the containment structural integrity and operational capability to provide reasonable assurance that the containment protects the public from radionuclide releases caused by accident or events. Specifically, the failure to implement timely corrective actions to maintain the protection of the containments interconnected liner, reinforcing bars, and tendon trumplates affected the structural integrity and operational capability of the containment structure. The team determined the finding to be of very low safety significance because the finding was not a pressurized thermal shock issue, did not represent an actual open pathway in the physical integrity of the reactor containment, and did not involve an actual reduction in function of hydrogen igniters in the reactor containment. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.


(Section 1R21.2.b.8)
      (Section 1R21.2.b.8)
Traditional Enforcement
Traditional Enforcement
* SLIV: The NRC identified a Severity Level-IV non-cited violation of Title 10 Code of Federal Regulations 71(e), "Maintenance of Records, Making of Reports," for the failure to assure that the Updated Final Safety Analysis Report (UFSAR) contained the latest information developed, including all changes made in the facility or procedures as described in the UFSAR. The team determined that the licensee failed to update the UFSAR to include the latest information regarding several design features associated with turbine runback. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2218695 to update the UFSAR. The NRC determined this violation was associated with a minor performance deficiency in accordance with the screening criteria in IMC 0612, Appendix E. Because the failure to update the UFSAR impacted the NRC's ability to perform its regulatory process, the team evaluated the violation using the traditional enforcement process. The team determined that this met the criteria for a SLIV violation because not accurately describing turbine runback design features in the UFSAR could have a material impact on licensed activities, and met the SLIV violation criteria in 6.1.d.3 of the NRC Enforcement Policy. The violation represented a failure to update the UFSAR as required by Title 10 Code of Federal Regulations Part 50.71(e), but the lack of up-to-date information has not resulted in any unacceptable change to the facility or procedures. Cross-cutting aspects are not assigned to traditional enforcement violations. (Section 1R21.2.b.9)
* SLIV: The NRC identified a Severity Level-IV non-cited violation of Title 10 Code of Federal Regulations 71(e), Maintenance of Records, Making of Reports, for the failure to assure that the Updated Final Safety Analysis Report (UFSAR) contained the latest information developed, including all changes made in the facility or procedures as described in the UFSAR. The team determined that the licensee failed to update the UFSAR to include the latest information regarding several design features associated with turbine runback. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2218695 to update the UFSAR.
 
The NRC determined this violation was associated with a minor performance deficiency in accordance with the screening criteria in IMC 0612, Appendix E. Because the failure to update the UFSAR impacted the NRCs ability to perform its regulatory process, the team evaluated the violation using the traditional enforcement process. The team determined that this met the criteria for a SLIV violation because not accurately describing turbine runback design features in the UFSAR could have a material impact on licensed activities, and met the SLIV violation criteria in 6.1.d.3 of the NRC Enforcement Policy. The violation represented a failure to update the UFSAR as required by Title 10 Code of Federal Regulations Part 50.71(e), but the lack of up-to-date information has not resulted in any unacceptable change to the facility or procedures. Cross-cutting aspects are not assigned to traditional enforcement violations. (Section 1R21.2.b.9)


=REPORT DETAILS=
=REPORT DETAILS=


==REACTOR SAFETY==
==REACTOR SAFETY==
Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity
Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity {{a|1R21}}
{{a|1R21}}
==1R21 Design Bases Assurance Inspection (Team)==
==1R21 Design Bases Assurance Inspection (Team)==
{{IP sample|IP=IP 71111.21M}}
{{IP sample|IP=IP 71111.21M}}
===.1 Inspection Sample Selection Process===
===.1 Inspection Sample Selection Process===


The team selected risk-significant samples and related operator actions for review using information contained in the licensee's probabilistic risk assessment. In general, this included risk significant structures, syst ems, and components (SSCs) that had a risk achievement worth factor greater than 1.3 or Birnbaum value greater than 1E-6. The sample included seven components selected based on risk significance, one component associated with containment large early release frequency (LERF), four modifications to mitigation SSCs, and two operating experience (OE) items.
The team selected risk-significant samples and related operator actions for review using information contained in the licensees probabilistic risk assessment. In general, this included risk significant structures, systems, and components (SSCs) that had a risk achievement worth factor greater than 1.3 or Birnbaum value greater than 1E-6. The sample included seven components selected based on risk significance, one component associated with containment large early release frequency (LERF), four modifications to mitigation SSCs, and two operating experience (OE) items.


The team performed a margin assessment and a detailed review of the selected risk-significant components and associated operator actions to verify that the design bases had been correctly implemented and maintained. Where possible, this margin was determined by the review of the design basis and Updated Final Safety Analysis Report (UFSAR). This margin assessment also considered original design issues, margin reductions due to modifications, or margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for a detailed review. These reliability issues included items related to failed performance test results, significant corrective action, repeated maintenance, maintenance rule status, Inspection Manual Chapter 0326 conditions, NRC Resident Inspector input regarding problem equipment, system health reports, industry OE, and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, OE, and the available defense-in-depth margins. An overall summary of the reviews performed and the specific inspection findings identified is included in the following sections of the report.
The team performed a margin assessment and a detailed review of the selected risk-significant components and associated operator actions to verify that the design bases had been correctly implemented and maintained. Where possible, this margin was determined by the review of the design basis and Updated Final Safety Analysis Report (UFSAR). This margin assessment also considered original design issues, margin reductions due to modifications, or margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for a detailed review. These reliability issues included items related to failed performance test results, significant corrective action, repeated maintenance, maintenance rule status, Inspection Manual Chapter 0326 conditions, NRC Resident Inspector input regarding problem equipment, system health reports, industry OE, and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, OE, and the available defense-in-depth margins. An overall summary of the reviews performed and the specific inspection findings identified is included in the following sections of the report.
Line 150: Line 135:
* Pressurizer set point change EC246924 For the seven components listed above, the team reviewed the plant technical specifications (TS), UFSAR, design bases documents, and drawings to establish an overall understanding of the design bases of the components. Design calculations and procedures were reviewed to verify that the design and licensing bases had been appropriately translated into these documents and that the most limiting parameters and equipment line-ups were used. Logic and wiring diagrams were also reviewed to verify that operation of electrical components conformed to design requirements. Test procedures and recent test results were reviewed against design bases documents to verify the adequacy of test methods and that acceptance criteria for tested parameters were supported by calculations or other engineering documents, and that individual tests and analyses served to validate component operation under accident conditions.
* Pressurizer set point change EC246924 For the seven components listed above, the team reviewed the plant technical specifications (TS), UFSAR, design bases documents, and drawings to establish an overall understanding of the design bases of the components. Design calculations and procedures were reviewed to verify that the design and licensing bases had been appropriately translated into these documents and that the most limiting parameters and equipment line-ups were used. Logic and wiring diagrams were also reviewed to verify that operation of electrical components conformed to design requirements. Test procedures and recent test results were reviewed against design bases documents to verify the adequacy of test methods and that acceptance criteria for tested parameters were supported by calculations or other engineering documents, and that individual tests and analyses served to validate component operation under accident conditions.


Maintenance procedures were reviewed to ensure components were appropriately included in the licensee's preventive maintenance program, that components or sub-components were being replaced before the end of their intended service life, and that the licensee has appropriate controls in place for components that are beyond vendor recommended life. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action program documents were reviewed (as applicable) in order to verify that the performance capability of the component was not negatively impacted, and that potential degradation was monitored or prevented. Maintenance Rule information was reviewed to verify that the component was properly scoped, and that appropriate preventive maintenance was being performed to justify current Maintenance Rule status. Component walk downs and interviews were conducted to verify that the installed configurations would support their design and licensing bases functions under accident conditions, and had been maintained to be consistent with design assumptions.
Maintenance procedures were reviewed to ensure components were appropriately included in the licensees preventive maintenance program, that components or sub-components were being replaced before the end of their intended service life, and that the licensee has appropriate controls in place for components that are beyond vendor recommended life. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action program documents were reviewed (as applicable) in order to verify that the performance capability of the component was not negatively impacted, and that potential degradation was monitored or prevented.


For the four modifications listed above, the team reviewed design bases, licensing bases, and performance capability of components to ensure they have not been degraded through modifications. In addition, post-modification testing was reviewed to ensure operability was established by verifying unintended system interactions will not occur, SSC performance characteristic continue to meet the design bases, modification design assumptions are appropriate, and modification test acceptance criteria have been met. The team also verified design basis documentation was updated consistent with  
Maintenance Rule information was reviewed to verify that the component was properly scoped, and that appropriate preventive maintenance was being performed to justify current Maintenance Rule status. Component walk downs and interviews were conducted to verify that the installed configurations would support their design and licensing bases functions under accident conditions, and had been maintained to be consistent with design assumptions.


the design change, verified other design basis features were not adversely impacted, verified procedures and training plans affected by the modification were updated, and verified that affected test documentation was updated or initiated as required by applicable test programs. Walk downs and interviews were conducted as necessary to verify that the modifications were adequat ely implemented. Documents reviewed are listed in the Attachment.
For the four modifications listed above, the team reviewed design bases, licensing bases, and performance capability of components to ensure they have not been degraded through modifications. In addition, post-modification testing was reviewed to ensure operability was established by verifying unintended system interactions will not occur, SSC performance characteristic continue to meet the design bases, modification design assumptions are appropriate, and modification test acceptance criteria have been met. The team also verified design basis documentation was updated consistent with the design change, verified other design basis features were not adversely impacted, verified procedures and training plans affected by the modification were updated, and verified that affected test documentation was updated or initiated as required by applicable test programs. Walk downs and interviews were conducted as necessary to verify that the modifications were adequately implemented. Documents reviewed are listed in the Attachment.


Additionally, the team performed the following specific reviews:
Additionally, the team performed the following specific reviews:
* For the selected operator actions, the inspectors performed a margin assessment and detailed review of the operator actions listed below. Where possible, margins were determined by the review of the assumed design basis and UFSAR response times and performance times. The team observed time critical operator actions performed during simulator evaluated scenarios in accordance with the station annunciator response procedures, emergency operating procedures, and the off normal operating procedures for the following conditions:  
* For the selected operator actions, the inspectors performed a margin assessment and detailed review of the operator actions listed below. Where possible, margins were determined by the review of the assumed design basis and UFSAR response times and performance times. The team observed time critical operator actions performed during simulator evaluated scenarios in accordance with the station annunciator response procedures, emergency operating procedures, and the off normal operating procedures for the following conditions:
1) During the onset of a main steam line break (MSLB) inside containment, stop AFW flow to the faulted steam generator to limit mass and energy releases into containment.
 
2) During the onset of a main steam line break (MSLB) inside containment, limit high head safety injection (HHSI) pump operating time at shutoff head on minimum recirculation flow to prevent pump overheating.
 
3) During a residual heat removal (RHR) pump start with operation at shutoff head, secure RHR pump to prevent pump overheating.


1) During the onset of a main steam line break (MSLB) inside containment, stop AFW flow to the faulted steam generator to limit mass and energy releases into containment. 2) During the onset of a main steam line break (MSLB) inside containment, limit high head safety injection (HHSI) pump operating time at shutoff head on minimum recirculation flow to prevent pump overheating. 3) During a residual heat removal (RHR) pump start with operation at shutoff head, secure RHR pump to prevent pump overheating. 4) During a component cooling water (CCW) 50 gpm out-leakage, initiate makeup to prevent emptying the CCW surge tank.
4) During a component cooling water (CCW) 50 gpm out-leakage, initiate makeup to prevent emptying the CCW surge tank.
* The team observed a field simulated performance of restoring intake cooling water (ICW) flow at least the minimum allowable value during a basket strainer backwash evolution.
* The team observed a field simulated performance of restoring intake cooling water (ICW) flow at least the minimum allowable value during a basket strainer backwash evolution.


====b. Findings====
====b. Findings====
===.1 Inadequate Verification of Electrical Protective Device Selective Coordination
===.1 Inadequate Verification of Electrical Protective Device Selective Coordination===


=====Introduction:=====
=====Introduction:=====
The NRC identified a Green non-cited violation (NCV) of Title 10 Code of Federal Regulations Part 50 (10 CFR 50), Appendix B, Criterion III, "Design Control," for failure to correctly verify that coordination exists between the protective devices on safety related switchgear in order to minimize the probability of losing a safety related===
The NRC identified a Green non-cited violation (NCV) of Title 10 Code of Federal Regulations Part 50 (10 CFR 50), Appendix B, Criterion III, Design Control, for failure to correctly verify that coordination exists between the protective devices on safety related switchgear in order to minimize the probability of losing a safety related power bus.
 
power bus.


=====Description:=====
=====Description:=====
The team reviewed Calculation PTN-BFJE-91-019, "AC Emergency Power System Coordination," revision 11, to determine if the licensee had established adequate breaker coordination to minimize the probability of losing electric power to safety related 4160 volt-alternating-current (Vac) switchgear. The team noted that the two trains of safety related switchgear supplied both non-safety and safety-related components. The UFSAR Section 7.2 stated, that the reactor protection system was designed in accordance with Institute of Electrical and Electronic Engineers (IEEE) 279-1968, "IEEE Standard Criteria for Protection Systems for Nuclear Power Generating Stations."  The criteria in Section 4.7 "Control and Protection System Interaction," specified, in part, that where a plant condition that requires protective action can be brought on by a failure or malfunction of the control system, and the same failure or malfunction prevents proper action of a protection system channel or channels designed to protect against the resultant unsafe condition, the remaining portion of the protection system shall independently meet the "General Functional Requirement" for precision and reliability (Section 4.1), and the "Single Failure Criterion" (Section 4.2).
The team reviewed Calculation PTN-BFJE-91-019, AC Emergency Power System Coordination, revision 11, to determine if the licensee had established adequate breaker coordination to minimize the probability of losing electric power to safety related 4160 volt-alternating-current (Vac) switchgear. The team noted that the two trains of safety related switchgear supplied both non-safety and safety-related components. The UFSAR Section 7.2 stated, that the reactor protection system was designed in accordance with Institute of Electrical and Electronic Engineers (IEEE) 279-1968, IEEE Standard Criteria for Protection Systems for Nuclear Power Generating Stations. The criteria in Section 4.7 Control and Protection System Interaction, specified, in part, that where a plant condition that requires protective action can be brought on by a failure or malfunction of the control system, and the same failure or malfunction prevents proper action of a protection system channel or channels designed to protect against the resultant unsafe condition, the remaining portion of the protection system shall independently meet the General Functional Requirement for precision and reliability (Section 4.1), and the Single Failure Criterion (Section 4.2).


The calculation, PTN-BFJE-91-019, concluded that coordination existed between all the electrical protective devices. The team determined that this conclusion was not supported because the calculation did not consider:
The calculation, PTN-BFJE-91-019, concluded that coordination existed between all the electrical protective devices. The team determined that this conclusion was not supported because the calculation did not consider:
: (1) uncertainties for the response protective device as an assembly including current transformers and other components in the loop etc., including the tolerances allowed in calibration procedures: (2)asymmetrical short circuit currents that would occur at the inception of a fault; and (3)the responses of overcurrent relays in the range of 100 to 115% of their amp setting.
: (1) uncertainties for the response protective device as an assembly including current transformers and other components in the loop etc., including the tolerances allowed in calibration procedures: (2)asymmetrical short circuit currents that would occur at the inception of a fault; and (3)the responses of overcurrent relays in the range of 100 to 115% of their amp setting.


The team determined that if a downstream fault was postulated on the non-safety related control system components, the lack of coordination could cause the safety related switchgear's protection devices (lockout relays) to lockout the entire safety related switchgear. This would disable one of the two trains of the protection system components, trip the reactor coolant pumps perturbing the system flows, and trip the reactor. The team determined the remaining portion of the protection system could not meet Section 4.1 and 4.2 of IEEE 279-1968. A single failure in the remaining protection train could prevent it from performing its safety function.
The team determined that if a downstream fault was postulated on the non-safety related control system components, the lack of coordination could cause the safety related switchgears protection devices (lockout relays) to lockout the entire safety related switchgear. This would disable one of the two trains of the protection system components, trip the reactor coolant pumps perturbing the system flows, and trip the reactor. The team determined the remaining portion of the protection system could not meet Section 4.1 and 4.2 of IEEE 279-1968. A single failure in the remaining protection train could prevent it from performing its safety function.


=====Analysis:=====
=====Analysis:=====
The team determined the failure to verify that the design of control and protection system interactions were in accordance with the specifications of with IEEE 279-1968 Section 4.7, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, failing to verify that faults on control system SSCs (e.g. reactor coolant pumps) downstream of the safety related switchgear would not cause a lockout of the safety-related bus affected its availability and reliability. The team evaluated the finding with Inspection Manual Chapter (IMC) 0609, Att. 4, "Initial Characterization of Findings," issued October 7, 2016, for Initiating Events, and IMC 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the findings were a deficiency affecting the design of a mitigating structure, system, or component (SSC), and the SSC maintained their operability or functionality. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.
The team determined the failure to verify that the design of control and protection system interactions were in accordance with the specifications of with IEEE 279-1968 Section 4.7, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, failing to verify that faults on control system SSCs (e.g. reactor coolant pumps) downstream of the safety related switchgear would not cause a lockout of the safety-related bus affected its availability and reliability. The team evaluated the finding with Inspection Manual Chapter (IMC) 0609, Att. 4, Initial Characterization of Findings, issued October 7, 2016, for Initiating Events, and IMC 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the findings were a deficiency affecting the design of a mitigating structure, system, or component (SSC),and the SSC maintained their operability or functionality. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.


=====Enforcement:=====
=====Enforcement:=====
10 CFR Part 50, Appendix B, Criterion III, "Design Control," required, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, since March 4, 2004, the licensee failed to provide design control measures for verifying or checking the adequacy of design. Specifically, calculation PTN-BFJE-91-019, "AC Emergency Power System Coordination," did not correctly verify that control and protection system interactions would not create the possibility of losing both trains of engineered safety features required to mitigate design basis accidents. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2220956 and performed an operability determination, which determined the system was operable, and was performing a reevaluation of the calculation to determine adequate coordination. This violation is identified as NCV 05000250/2017007-01 and 05000251/2017007-01, "Inadequate Verification of Electrical Protective Device Selective Coordination."
10 CFR Part 50, Appendix B, Criterion III, Design Control, required, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.
 
Contrary to the above, since March 4, 2004, the licensee failed to provide design control measures for verifying or checking the adequacy of design. Specifically, calculation PTN-BFJE-91-019, AC Emergency Power System Coordination, did not correctly verify that control and protection system interactions would not create the possibility of losing both trains of engineered safety features required to mitigate design basis accidents.
 
For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2220956 and performed an operability determination, which determined the system was operable, and was performing a reevaluation of the calculation to determine adequate coordination. This violation is identified as NCV 05000250/2017007-01 and 05000251/2017007-01, Inadequate Verification of Electrical Protective Device Selective Coordination.


===.2 Failure to Perform Design Verification for Under Frequency Trip of the Main Generator===
===.2 Failure to Perform Design Verification for Under Frequency Trip of the Main Generator===
Line 189: Line 181:


=====Introduction:=====
=====Introduction:=====
The NRC identified a Green NCV of 10 CFR 50, Appendix B, Criterion III, "Design Control," for failure to verify or check the adequacy of design of the under frequency trip feature of the main generator circuit breakers with regard to the effect of its operation on plant stability and the maintenance of critical safety functions.
The NRC identified a Green NCV of 10 CFR 50, Appendix B, Criterion III, Design Control, for failure to verify or check the adequacy of design of the under frequency trip feature of the main generator circuit breakers with regard to the effect of its operation on plant stability and the maintenance of critical safety functions.


=====Description:=====
=====Description:=====
UFSAR Section 1.1.4, "Regulatory Guide Application," identified that the licensee was committed to Regulatory Guide 1.28, "Quality Assurance Program Requirements (Design and Construction)," June 1972, and thus to ANSI N45.2-1971, "Quality Assurance Program Requirements for Nuclear Power Plants."  The standard ANSI N45.2-1971 required that "Design control measures shall be applied to verify or check the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program."  Prior to receiving the operating license for Unit 3 in July 1972, the licensee installed a new design feature without submitting the design as part of the original FSAR for licensing review nor later in 1982, as part their evaluation of the site electrical system design for their licensing submittal for General Design Criteria (GDC) 17 (Reference: FPL letter L-82-509, November 16, 1982). The UFSAR section 8.1.1 "Principal Design Criteria" for "Electrical Systems," stated, in part, that Turkey Point complied with the requirements of GDC 17. The team determined that the licensee neither verified and validated the as installed design nor evaluated this design feature as part of the safety analysis. The design opened the main generator circuit breakers feeding power to the switchyard in the event of a transmission grid under frequency of 57 Hertz or less. The specification for the design placed the unit in an islanding mode where the main generator provided power to the plant instead of the grid or emergency diesel generators.
UFSAR Section 1.1.4, Regulatory Guide Application, identified that the licensee was committed to Regulatory Guide 1.28, Quality Assurance Program Requirements (Design and Construction), June 1972, and thus to ANSI N45.2-1971, Quality Assurance Program Requirements for Nuclear Power Plants. The standard ANSI N45.2-1971 required that Design control measures shall be applied to verify or check the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Prior to receiving the operating license for Unit 3 in July 1972, the licensee installed a new design feature without submitting the design as part of the original FSAR for licensing review nor later in 1982, as part their evaluation of the site electrical system design for their licensing submittal for General Design Criteria (GDC)17 (Reference: FPL letter L-82-509, November 16, 1982). The UFSAR section 8.1.1 Principal Design Criteria for Electrical Systems, stated, in part, that Turkey Point complied with the requirements of GDC 17. The team determined that the licensee neither verified and validated the as installed design nor evaluated this design feature as part of the safety analysis. The design opened the main generator circuit breakers feeding power to the switchyard in the event of a transmission grid under frequency of 57 Hertz or less. The specification for the design placed the unit in an islanding mode where the main generator provided power to the plant instead of the grid or emergency diesel generators.


The under frequency design was specified on Logic diagrams 5610-T-L1, Sheet 4B, "Generator Trip Logic," Revision 8, and 5613-T-L1, Sheet 4A, "Generator Trip Logic,"
The under frequency design was specified on Logic diagrams 5610-T-L1, Sheet 4B, Generator Trip Logic, Revision 8, and 5613-T-L1, Sheet 4A, Generator Trip Logic, Revision 3, which showed under frequency relays UF1, UF2, UF3, and UF4 that trip the main generator output circuit breakers in the event of a frequency less than 57 Hz. Logic diagram 5610-T-L1, Sheet 4C, Generator Trip Logic, Revision 7, stated, regarding these relays, Operation at other than synchronous speed, at load, results in excessive turbine blade stress. Only a limited total lifetime operation is allowed at approximately 57 Hz. The switchyard bkrs [circuit breakers] are opened after 12 seconds but not the field breaker and the unit acts as a house generator. Opening of the main generator circuit breakers would cause the generator load to suddenly drop from full power to the level of the plant loads, approximately 5%, resulting in a 95%
Revision 3, which showed under frequency relays UF1, UF2, UF3, and UF4 that trip the main generator output circuit breakers in the event of a frequency less than 57 Hz. Logic diagram 5610-T-L1, Sheet 4C, "Generator Trip Logic," Revision 7, stated, regarding these relays, "Operation at other than synchronous speed, at load, results in excessive turbine blade stress. Only a limited total lifetime operation is allowed- at approximately 57 Hz. The switchyard bkr's [circuit breakers] are opened after 12 seconds but not the field breaker and the unit acts as a house generator."  Opening of the main generator circuit breakers would cause the generator load to suddenly drop from full power to the level of the plant loads, approximately 5%, resulting in a 95%
system runback. This would result in the main generator powering plant house loads including the reactor coolant pumps, steam generator feed pumps, and the Class 1E AC loads. The team determined that the UFSAR Section 7.3, Regulating System, specified that the reactor could automatically reduce to approximately 15% power without tripping the turbine and reactor making this unanalyzed under frequency design possible. However, the plants licensing basis only allows a 50% runback, which does not require the reactor to reduce power to 15%.
system runback. This would result in the main generator powering plant house loads including the reactor coolant pumps, steam generator feed pumps, and the Class 1E AC loads. The team determined that the UFSAR Section 7.3, "Regulating System," specified that the reactor could automatically reduce to approximately 15% power without tripping the turbine and reactor making this unanalyzed under frequency design possible. However, the plant's licensing basis only allows a 50% runback, which does not require the reactor to reduce power to 15%.  
UFSAR Section 14.1.10, Loss of External Electrical Load, discusses the analysis for a complete loss of load but assumes a turbine and reactor trip at the start of the event. There is no discussion whether the analysis described in 14.1.10 bounds the generator breaker under frequency trip event, which does not involve a trip.


UFSAR Section 14.1.10, "Loss of External Electrical Load," discusses the analysis for a complete loss of load but assumes a turbine and reactor trip at the start of the event. There is no discussion whether the analysis described in 14.1.10 bounds the generator breaker under frequency trip event, which does not involve a trip. The team determined that the licensee did not perform analysis or testing of this design feature to determine its impact on the plants electrical systems and the design requirements of GDC 17. The GDC specified the design to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies. The team reached their conclusion for the following reasons:
The team determined that the licensee did not perform analysis or testing of this design feature to determine its impact on the plants electrical systems and the design requirements of GDC 17. The GDC specified the design to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies. The team reached their conclusion for the following reasons:
* AC system degradation would be certain because the under frequency event would be electrically unstable and unpredictable,
* AC system degradation would be certain because the under frequency event would be electrically unstable and unpredictable,
* the buses connected to the auxiliary transformer prevents their subsequent fast transfer to the startup transformer when the instability occurs,
* the buses connected to the auxiliary transformer prevents their subsequent fast transfer to the startup transformer when the instability occurs,
* the large non- Class 1E loads would continue to operate connected to the safety bus,
* the large non- Class 1E loads would continue to operate connected to the safety bus,
* Class 1E and non- Class 1E loads share a common bus, and
* Class 1E and non- Class 1E loads share a common bus, and
* the design has never been tested or analyzed  
* the design has never been tested or analyzed


=====Analysis:=====
=====Analysis:=====
The team determined the failure to perform design verification for the main generator breaker under frequency trip feature, as required by ANSI N45.2, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Initiating Events  
The team determined the failure to perform design verification for the main generator breaker under frequency trip feature, as required by ANSI N45.2, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions. Specifically, opening of the main generator breakers due to an under frequency condition on the offsite power system would cause the generator load to suddenly drop from full power to the level of the plant loads, and there was no verification that plant stability and critical safety functions would be maintained and would cause a loss of offsite power. The team evaluated the finding with Inspection Manual Chapter (IMC) 0609, Att. 4, Initial Characterization of Findings, issued October 7, 2016, for Initiating Events, and IMC 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding met the Support System Initiators screening criteria for requiring a detailed risk evaluation. The team determined that this issue increased the likelihood of the support system initiator loss of offsite power (LOOP). A regional senior risk analyst (SRA) conducted a detailed risk evaluation with a one year exposure and determined the change in core damage frequency was less than 1E-6, which was of very low safety significance (Green). The SRA modelled the effect of the performance deficiency as a potential loss of offsite power without the ability to recover the offsite power. This was based on the assumptions that, given a grid under frequency condition as described by the performance deficiency, all switchyard breakers would trip and lockout, except those feeding the unit auxiliary transformers and would not be recoverable in a timely manner because of the effort needed to reset the lockouts. The dominating sequence, (95% of the change) was an under frequency grid condition combined with failure of all emergency diesel generators (EDGs) leading to a station blackout. If one EDG were not recovered, core damage would result. The team did not assign a cross-cutting aspect because the issue did not reflect current licensee performance.


Cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions. Specifically, opening of the main generator breakers due to an under frequency condition on the offsite power system would cause the generator load to suddenly drop from full power to the level of the plant loads, and there was no verification that plant stability and critical safety functions would be maintained and would cause a loss of offsite power. The team evaluated the finding with Inspection Manual Chapter (IMC) 0609, Att. 4, "Initial Characterization of Findings," issued October 7, 2016, for Initiating Events, and IMC 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," issued June 19, 2012, and determined the finding met the Support System Initiators screening criteria for requiring a detailed risk evaluation. The team determined that this issue increased the likelihood of the support system initiator "loss of offsite power (LOOP)."  A regional senior risk analyst (SRA) conducted a detailed risk evaluation with a one year exposure and determined the change in core damage frequency was less than 1E-6, which was of very low safety significance (Green). The SRA modelled the effect of the performance deficiency as a potential loss of offsite power without the ability to recover the offsite power. This was based on the assumptions that, given a grid under frequency condition as described by the performance deficiency, all switchyard breakers would trip and lockout, except those feeding the unit auxiliary transformers and would not be recoverable in a timely manner because of the effort needed to reset the lockouts. The dominating sequence, (95% of the change) was an under frequency grid condition combined with failure of all emergency diesel generators (EDGs) leading to a station blackout. If one EDG were not
=====Enforcement:=====
 
10 CFR 50, Appendix B, Criterion III, Design Control, required, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, since July 1972, the licensee failed to provide design control measures for verifying or checking the adequacy of design of the main generator breaker under frequency trip feature. Specifically, the licensee failed to verify or check the adequacy of the design to assure that an under frequency trip of the main generator breakers would not cause an unplanned series of events and conditions leading up to a reactor trip, loss of offsite power, or damage to Class 1E equipment due to frequency transients. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2220874. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-02 and 05000251/2017007-02, Failure to Perform Design Verification for Under Frequency Trip of the Main Generator Breakers.
recovered, core damage would result. The team did not assign a cross-cutting aspect because the issue did not reflect current licensee performance.


=====Enforcement:=====
===.3 Failure to Verify the Adequacy of CCW isolation from Supplemental Cooling System===
10 CFR 50, Appendix B, Criterion III, "Design Control," required, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, since July 1972, the licensee failed to provide design control measures for verifying or checking the adequacy of design of the main generator breaker under frequency trip feature. Specifically, the licensee failed to verify or check the adequacy of the design to assure that an under frequency trip of the main generator breakers would not cause an unplanned series of events and conditions leading up to a reactor trip, loss of offsite power, or damage to Class 1E equipment due to frequency transients. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2220874. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-02 and 05000251/2017007-02, "Failure to Perform Design Verification for Under Frequency Trip of the Main Generator Breakers."


===.3 Failure to Verify the Adequacy of CCW isolation from Supplemental Cooling System (SCS)===
  (SCS)


=====Introduction:=====
=====Introduction:=====
The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the adequacy of design of temperature set points used for isolation of the CCW from the non-safety related SCS during an accident.  
The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the adequacy of design of temperature set points used for isolation of the CCW from the non-safety related SCS during an accident.


=====Description:=====
=====Description:=====
On September 14, 2015, the site completed modification EC 283225 that integrated the newly installed SCS to the CCW system. The SCS must be isolated during an accident to ensure adequate CCW flow to CCW components performing an accident function and to ensure the integrity of the CCW system on potential failure of non-safety related portions of the SCS. The UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968. The criteria specified in Section 4.1 "General Functional Requirement," required that the protection system shall, with precision and reliability, automatically initiate appropriate protective action whenever a plant condition monitored by the system reaches a preset level.
On September 14, 2015, the site completed modification EC 283225 that integrated the newly installed SCS to the CCW system. The SCS must be isolated during an accident to ensure adequate CCW flow to CCW components performing an accident function and to ensure the integrity of the CCW system on potential failure of non-safety related portions of the SCS. The UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968. The criteria specified in Section 4.1 General Functional Requirement, required that the protection system shall, with precision and reliability, automatically initiate appropriate protective action whenever a plant condition monitored by the system reaches a preset level.


The isolation signal used a temperature threshold at SCS discharge of 104 o F. The licensee assumed that this temperature would be indication of an accident in progress.
The isolation signal used a temperature threshold at SCS discharge of 104oF. The licensee assumed that this temperature would be indication of an accident in progress.


Safety related trip circuitry including cables and temperature switches (TS-254 and TS-2216) facilitated isolation. The team noted that the 104 oF setpoint did not ensure that the SCS would be isolated at the beginning of an accident because of the delay for any temperature increase to reach the SCS discharge. In addition, the installation did not account for instrument and loop uncertainty. Given a three year calibration frequency established by the licensee, the instrument uncertainty alone could account for approximately 14 oF of uncertainty before isolation would occur. The team determined that interaction between non-safety related and safety related SCS components did not ensure isolation of the CCW system at the onset of applicable accident sequences. When not isolated, the most limiting failure modes of the SCS chillers could affect the operation of the CCW (i.e. adverse thermal hydraulic conditions or shock). The team noted that accounting for instrument uncertainty was required by NextEra Standard IC-3.17, "Instrument Setpoint Methodology for Nuclear Power Plants," and Institute of Electrical and Electronic Engineers (IEEE) 279 Section 4.1.
Safety related trip circuitry including cables and temperature switches (TS-254 and TS-2216) facilitated isolation. The team noted that the 104oF setpoint did not ensure that the SCS would be isolated at the beginning of an accident because of the delay for any temperature increase to reach the SCS discharge. In addition, the installation did not account for instrument and loop uncertainty. Given a three year calibration frequency established by the licensee, the instrument uncertainty alone could account for approximately 14oF of uncertainty before isolation would occur. The team determined that interaction between non-safety related and safety related SCS components did not ensure isolation of the CCW system at the onset of applicable accident sequences.
 
When not isolated, the most limiting failure modes of the SCS chillers could affect the operation of the CCW (i.e. adverse thermal hydraulic conditions or shock). The team noted that accounting for instrument uncertainty was required by NextEra Standard IC-3.17, Instrument Setpoint Methodology for Nuclear Power Plants, and Institute of Electrical and Electronic Engineers (IEEE) 279 Section 4.1.


=====Analysis:=====
=====Analysis:=====
The failure to verify the SCS would isolate from the CCW at the onset of an accident was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, by not ensuring prompt isolation or adjusting the isolation setpoint to account for instrument uncertainties and temperature lag, the licensee failed to ensure that the SCS loop would be isolated at onset of an accident, which affected the reliability and capability of the CCW system when called upon. The team used IMC 0609 Attachment 4, "Initial Characterization of Findings," issued October 7, 2016, for Mitigating Systems, and IMC 0609 Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the findings were a deficiency affecting the design of a mitigating structure, system, or component (SSC), and the SSC maintained their operability or functionality. The finding had a cross-cutting aspect in the area of Human Performance because the licensee failed to ensure knowledge transfer to maintain a knowledgeable, technically competent workforce and instill nuclear safety values [H.9].
The failure to verify the SCS would isolate from the CCW at the onset of an accident was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, by not ensuring prompt isolation or adjusting the isolation setpoint to account for instrument uncertainties and temperature lag, the licensee failed to ensure that the SCS loop would be isolated at onset of an accident, which affected the reliability and capability of the CCW system when called upon. The team used IMC 0609 Attachment 4, Initial Characterization of Findings, issued October 7, 2016, for Mitigating Systems, and IMC 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the findings were a deficiency affecting the design of a mitigating structure, system, or component (SSC), and the SSC maintained their operability or functionality. The finding had a cross-cutting aspect in the area of Human Performance because the licensee failed to ensure knowledge transfer to maintain a knowledgeable, technically competent workforce and instill nuclear safety values [H.9].


=====Enforcement:=====
=====Enforcement:=====
10 CFR Part 50, Appendix B, Criterion III, "Design Control," stated, in part, that "design control measures shall provide for verifying or checking the adequacy of design."  Contrary to the above, since September 14, 2015, the licensee's design control  
10 CFR Part 50, Appendix B, Criterion III, Design Control, stated, in part, that design control measures shall provide for verifying or checking the adequacy of design. Contrary to the above, since September 14, 2015, the licensees design control measures failed to provide for verifying or checking the adequacy of the SCS design to ensure it isolated from CCW at the onset of an accident. Specifically, failing to verify that the CCW was isolated from the SCS at the onset of an accident created the possibility that the CCW would not be able to meet the accident analysis. For immediate corrective actions, the licensee entered this into their corrective action program as AR 02218834, performed an operability determination, which determined the system is operable but non-conforming, and issued EC 289598 to account for uncertainties in the CCW temperature switch setpoint adjustment. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-03 and 05000251/2017007-03, Failure to Verify the Adequacy of CCW isolation from Supplemental Cooling System (SCS).


measures failed to provide for verifying or checking the adequacy of the SCS design to ensure it isolated from CCW at the onset of an accident. Specifically, failing to verify that the CCW was isolated from the SCS at the onset of an accident created the possibility that the CCW would not be able to meet the accident analysis. For immediate corrective actions, the licensee entered this into their corrective action program as AR 02218834, performed an operability determination, which determined the system is operable but non-conforming, and issued EC 289598 to account for uncertainties in the CCW temperature switch setpoint adjustment. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-03 and 05000251/2017007-03, "Failure to Verify the Adequacy of CCW isolation from Supplemental Cooling System (SCS)."
===.4 Failure to Verify the Adequacy of Design for Component Protective Covers===
 
===.4 Failure to Verify the Adequacy of Design for Component Protective Covers


=====Introduction:=====
=====Introduction:=====
===
The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the adequacy of design for the non-safety related component protective covers onto safety related equipment.
The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the adequacy of design for the non-safety related component protective covers onto safety related equipment.


=====Description:=====
=====Description:=====
On May 7, 1993, the licensee issued specification SPEC-C-013 "Installation Guidelines for Miscellaneous Non-System Related Items on Existing Structures". The specification was non-safety related and applied to non-safety related SSCs. On May 16, 1994, engineering evaluation JPN-PTN-SECS-94-018, Revision 2 "Engineering Evaluation of Bump Covers for the Reactor Trip Breakers in the Unit 3 & Unit 4 Reactor Control Rod Equipment Room" was issued. The engineering evaluation justified the use of the SPEC-C-013 to install the protective covers on Class 1E SSCs. The UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968. The criteria specified in Section 4.3 "Quality of Components and Modules," required that components and modules shall be of a quality that is consistent with minimum maintenance requirements and low failure rates, and this quality shall be achieved through the specification of requirements known to promote high quality, such as requirements for design, for manufacturing, and quality control. The criteria specified in Section 4.4 "Equipment Qualification," required that type test data or reasonable engineering extrapolation based on test data shall be available to verify that equipment that must operate to provide protection system action will meet, on a continuing basis, the performance requirements determined to be necessary for achieving the system requirements. The plant used two designs for their protective covers (bump covers) both used non-safety related commercial components. The first design consisted of two pieces of fire treated two by four wood, one on each side of the mechanism to be protected, with a piece of Plexiglas attached to the wood with screws. Velcro attached the wood to the SSC cabinet face. The second design utilized molded Plexiglas with neodymium magnets as the mounting mechanism.
On May 7, 1993, the licensee issued specification SPEC-C-013 Installation Guidelines for Miscellaneous Non-System Related Items on Existing Structures. The specification was non-safety related and applied to non-safety related SSCs. On May 16, 1994, engineering evaluation JPN-PTN-SECS-94-018, Revision 2 Engineering Evaluation of Bump Covers for the Reactor Trip Breakers in the Unit 3 & Unit 4 Reactor Control Rod Equipment Room was issued. The engineering evaluation justified the use of the SPEC-C-013 to install the protective covers on Class 1E SSCs. The UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968. The criteria specified in Section 4.3 Quality of Components and Modules, required that components and modules shall be of a quality that is consistent with minimum maintenance requirements and low failure rates, and this quality shall be achieved through the specification of requirements known to promote high quality, such as requirements for design, for manufacturing, and quality control. The criteria specified in Section 4.4 Equipment Qualification, required that type test data or reasonable engineering extrapolation based on test data shall be available to verify that equipment that must operate to provide protection system action will meet, on a continuing basis, the performance requirements determined to be necessary for achieving the system requirements.


These protective covers were installed on Class 1E components, which are protection syst em components and modules within the scope of IEEE 279-1968.
The plant used two designs for their protective covers (bump covers) both used non-safety related commercial components. The first design consisted of two pieces of fire treated two by four wood, one on each side of the mechanism to be protected, with a piece of Plexiglas attached to the wood with screws. Velcro attached the wood to the SSC cabinet face. The second design utilized molded Plexiglas with neodymium magnets as the mounting mechanism. These protective covers were installed on Class 1E components, which are protection system components and modules within the scope of IEEE 279-1968.


The team conducted walk downs and observed that the protective covers were installed on trip sensitive Class 1E equipment throughout Units 3 and 4. These included Reactor trip breakers, Class 1E MCCs, Class 1E Load Centers, Fire Panels C286 and C288, Vital Battery Chargers, Vital Inverters, and various other Class 1E 4160Vac switchgear cabinets. On each of three separate walk downs spanning the two weeks spent onsite, the team observed numerous examples where the mounting of the protective covers was degraded. In some cases, the covers were stacked on top of one another and the column of covers was separating from the cabinets. The Velcro and adhesive showed signs of separation (adhesive failure), and the Velcro showed signs of hook and loop connection failure. Falling covers would contact trip sensitive equipment and other degraded covers, which could cause failures of Class 1E components. The team determined that the design and manufacturing processes did not ensure that the commercial components maintained adequate quality nor did the processes ensure that the assembled protective covers would maintain adequate quality on a continuing basis.
The team conducted walk downs and observed that the protective covers were installed on trip sensitive Class 1E equipment throughout Units 3 and 4. These included Reactor trip breakers, Class 1E MCCs, Class 1E Load Centers, Fire Panels C286 and C288, Vital Battery Chargers, Vital Inverters, and various other Class 1E 4160Vac switchgear cabinets. On each of three separate walk downs spanning the two weeks spent onsite, the team observed numerous examples where the mounting of the protective covers was degraded. In some cases, the covers were stacked on top of one another and the column of covers was separating from the cabinets. The Velcro and adhesive showed signs of separation (adhesive failure), and the Velcro showed signs of hook and loop connection failure. Falling covers would contact trip sensitive equipment and other degraded covers, which could cause failures of Class 1E components. The team determined that the design and manufacturing processes did not ensure that the commercial components maintained adequate quality nor did the processes ensure that the assembled protective covers would maintain adequate quality on a continuing basis.


The protective covers were not qualified to meet the required performance requirements of maintaining secure mounting on a continuous basis to prevent inadvertent Class 1E component failure. The licensee generated AR 2220750 in their corrective action program to address the potential adverse effect of the degraded protective covers. In addition, the team questioned whether the magnetic field produced by the neodymium magnet covers would interfere with the electrical characteristic of the Class 1E components. Magnetic fields in the presence of large currents could produce physical forces, eddy currents, and inductive heating not evaluated by the licensee. The team determined that these protective covers were not shown to be qualified as required by IEEE 279-1968. The team determined that the design of the protective covers degraded the quality and qualification of the Class 1E components, on which they were mounted. Title 10 CFR 50, Appendix B criterion III "Design Control," required that the design of Class 1E equipment must be verified and checked, and that changes, including field changes, shall be subject to design control measures commensurate with those applied to the original design. The licensee initiated AR 02220993 on August 17, 2017, to address the performance deficiency and removed degraded covers.
The protective covers were not qualified to meet the required performance requirements of maintaining secure mounting on a continuous basis to prevent inadvertent Class 1E component failure. The licensee generated AR 2220750 in their corrective action program to address the potential adverse effect of the degraded protective covers. In addition, the team questioned whether the magnetic field produced by the neodymium magnet covers would interfere with the electrical characteristic of the Class 1E components. Magnetic fields in the presence of large currents could produce physical forces, eddy currents, and inductive heating not evaluated by the licensee. The team determined that these protective covers were not shown to be qualified as required by IEEE 279-1968.
 
The team determined that the design of the protective covers degraded the quality and qualification of the Class 1E components, on which they were mounted. Title 10 CFR 50, Appendix B criterion III Design Control, required that the design of Class 1E equipment must be verified and checked, and that changes, including field changes, shall be subject to design control measures commensurate with those applied to the original design. The licensee initiated AR 02220993 on August 17, 2017, to address the performance deficiency and removed degraded covers.


=====Analysis:=====
=====Analysis:=====
The licensee's failure to meet the criteria specified in IEEE 279-1968 to maintain the quality and qualification of Class 1E components was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute and of the Initiating Events Cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations.
The licensees failure to meet the criteria specified in IEEE 279-1968 to maintain the quality and qualification of Class 1E components was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute and of the Initiating Events Cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations.


Specifically, the failure to ensure the quality and qualification of commercial components and assemblies to maintain adequate mounting to Class 1E equipment increased the likelihood of inadvertent component failures, and thus increased the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. The team used IMC 0609 Attachment 4, "Initial Characterization of Findings," issued October 7, 2016, for initiating events, and IMC 0609 Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding did not cause a reactor trip and the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition (e.g. loss of condenser, loss of feedwater). Because the design of the protective covers was from 1993, the team determined the finding was not indicative of current licensee  
Specifically, the failure to ensure the quality and qualification of commercial components and assemblies to maintain adequate mounting to Class 1E equipment increased the likelihood of inadvertent component failures, and thus increased the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. The team used IMC 0609 Attachment 4, Initial Characterization of Findings, issued October 7, 2016, for initiating events, and IMC 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding did not cause a reactor trip and the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition (e.g. loss of condenser, loss of feedwater). Because the design of the protective covers was from 1993, the team determined the finding was not indicative of current licensee performance
 
performance  


=====Enforcement:=====
=====Enforcement:=====
10 CFR Part 50, Appendix B, Criterion III, "Design Control," required, in part, that design changes, including field changes, shall be subject to design control measures commensurate with those applied to the original design. Contrary to the above, since 1994, the licensee failed to use design control measures commensurate with those applied to the original design for design changes, including field changes.
10 CFR Part 50, Appendix B, Criterion III, Design Control, required, in part, that design changes, including field changes, shall be subject to design control measures commensurate with those applied to the original design. Contrary to the above, since 1994, the licensee failed to use design control measures commensurate with those applied to the original design for design changes, including field changes.


Specifically, the licensee did not maintain the quality and qualification requirements from IEEE 279-1968 for Class 1E equipment when applying filed changes. Degraded protective covers could fall and trip protection system components challenging the protection system reliability and availability. For immediate corrective actions, the licensee entered this into their corrective action program as AR 2220993 and removed the visibly degraded protective covers. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-04 and 05000251/2017007-04, "Failure to Verify the Adequacy of Design for Component Protective Covers."
Specifically, the licensee did not maintain the quality and qualification requirements from IEEE 279-1968 for Class 1E equipment when applying filed changes. Degraded protective covers could fall and trip protection system components challenging the protection system reliability and availability. For immediate corrective actions, the licensee entered this into their corrective action program as AR 2220993 and removed the visibly degraded protective covers. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-04 and 05000251/2017007-04, Failure to Verify the Adequacy of Design for Component Protective Covers.


===.5 Failure to adequately perform discharge testing on 3B Battery===
===.5 Failure to adequately perform discharge testing on 3B Battery===


=====Introduction:=====
=====Introduction:=====
The NRC identified a Green NCV of Title 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," for the licensee's failure to perform surveillance testing on station battery 3B in accordance with the requirements of IEEE 450-1987.
The NRC identified a Green NCV of Title 10 CFR Part 50, Appendix B, Criterion XI, Test Control, for the licensees failure to perform surveillance testing on station battery 3B in accordance with the requirements of IEEE 450-1987.


=====Description:=====
=====Description:=====
Surveillance testing requirements for Technical Specification (TS) limiting condition for operation 3.4.8.2, "DC Sources," required the verification that station battery 3B be at least equal to or greater than 80% of the manufacturer's rating when subjected to a performance discharge test every 5 years. The surveillance testing requirements also required that the frequency of this discharge test be increased to once a year if the battery showed signs of degradation or reached 85% of its expected service  
Surveillance testing requirements for Technical Specification (TS) limiting condition for operation 3.4.8.2, DC Sources, required the verification that station battery 3B be at least equal to or greater than 80% of the manufacturers rating when subjected to a performance discharge test every 5 years. The surveillance testing requirements also required that the frequency of this discharge test be increased to once a year if the battery showed signs of degradation or reached 85% of its expected service life. TS defined the station battery as degraded when the battery capacity drops by more than 10% of rated capacity from its previous average of performance tests or when capacity is below 90% of the manufacturers rating. Surveillance procedure 0-SME-003.15, Station Battery 60 Month Maintenance, Rev. 2, stated that the battery performance test was performed in accordance with IEEE 450-1987. The team noted that section 6.4 of IEEE 450 stated that the performance test be ended when battery terminal voltage reached 105V.


life. TS defined the station battery as degraded when the battery capacity drops by more than 10% of rated capacity from its previous average of performance tests or when capacity is below 90% of the manufacturers rating. Surveillance procedure 0-SME-003.15, "Station Battery 60 Month Maintenance," Rev. 2, stated that the battery performance test was performed in accordance with IEEE 450-1987. The team noted that section 6.4 of IEEE 450 stated that the performance test be ended when battery terminal voltage reached 105V. During the review of the previous two performance tests performed for station battery 3B, in 2011 and 2013 respectively, the team identified that both tests were ended based on time and not based on when voltage reached 105Vdc as required by IEEE 450. The team noted that both performance tests were ended at 122 minutes, when voltage was approximately 107V-direct-current (Vdc). The inspectors determined that the failure to end the surveillance test when the station battery terminal voltage reached 105Vdc resulted in an inaccurate battery capacity determination of 101% for station battery 3B. The team also determined that running the test longer until the battery terminal voltage reached 105Vdc would show more capacity for station battery 3B than currently recorded. The team concluded that the failure to perform the surveillance test in accordance with IEEE 450 would create an inaccurate baseline for battery capacity and mask the degradation of the battery on future performance tests that ensure that the battery capacity has not dropped by more than 10% of rated capacity from the average of previous capacity tests. The failure to detect a degraded battery would result in a failure to increase the frequency of performance testing as required by TS 3.4.8.2. The team noted that this deficiency affected the performance tests for all of the licensee's other safety-related station batteries. On August 11, 2017, the licensee entered this issue into their corrective action program as AR 2219948, performed an extent of condition review, and determined that none of the station batteries were currently in a degraded condition. The licensee also placed surveillance procedure 0-SME-003.15 on administrative hold until the corrective actions are completed.
During the review of the previous two performance tests performed for station battery 3B, in 2011 and 2013 respectively, the team identified that both tests were ended based on time and not based on when voltage reached 105Vdc as required by IEEE 450. The team noted that both performance tests were ended at 122 minutes, when voltage was approximately 107V-direct-current (Vdc). The inspectors determined that the failure to end the surveillance test when the station battery terminal voltage reached 105Vdc resulted in an inaccurate battery capacity determination of 101% for station battery 3B. The team also determined that running the test longer until the battery terminal voltage reached 105Vdc would show more capacity for station battery 3B than currently recorded. The team concluded that the failure to perform the surveillance test in accordance with IEEE 450 would create an inaccurate baseline for battery capacity and mask the degradation of the battery on future performance tests that ensure that the battery capacity has not dropped by more than 10% of rated capacity from the average of previous capacity tests. The failure to detect a degraded battery would result in a failure to increase the frequency of performance testing as required by TS 3.4.8.2. The team noted that this deficiency affected the performance tests for all of the licensees other safety-related station batteries.
 
On August 11, 2017, the licensee entered this issue into their corrective action program as AR 2219948, performed an extent of condition review, and determined that none of the station batteries were currently in a degraded condition. The licensee also placed surveillance procedure 0-SME-003.15 on administrative hold until the corrective actions are completed.


=====Analysis:=====
=====Analysis:=====
The licensee's failure to perform surveillance testing on station battery 3B in accordance with IEEE 450-1987, as required by Title 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," was a performance deficiency. The performance deficiency was determined to be more than minor because if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern. Specifically, the performance deficiency could result in masking degradation of the battery on future performance discharge tests and adversely affect the ability to trend when the testing periodicity should be increased to once a year as required by TS. The team used Inspection Manual Chapter (IMC) 0609, Att. 4, "Initial Characterization of Findings,"
The licensees failure to perform surveillance testing on station battery 3B in accordance with IEEE 450-1987, as required by Title 10 CFR Part 50, Appendix B, Criterion XI, Test Control, was a performance deficiency. The performance deficiency was determined to be more than minor because if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern. Specifically, the performance deficiency could result in masking degradation of the battery on future performance discharge tests and adversely affect the ability to trend when the testing periodicity should be increased to once a year as required by TS. The team used Inspection Manual Chapter (IMC) 0609, Att. 4, Initial Characterization of Findings, issued October 7, 2016, for mitigating systems, and IMC 0609 App. A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was not a deficiency affecting the design or qualification of a mitigating SSC, did not represent a loss of system and/or function, did not represent an actual loss of function of a single train for greater than its TS allowed outage time or two separate safety systems out-of-service for greater than their TS allowed outage time, and did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for greater than 24 hrs. Since the last performance test on station battery 3B was performed in 2013, the team determined the finding was not indicative of current licensee performance.
issued October 7, 2016, for mitigating systems, and IMC 0609 App. A, "The Significance Determination Process (SDP) for Findings At-Power," issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was not a deficiency affecting the design or qualification of a mitigating SSC, did not represent a loss of system and/or function, did not represent an actual loss of function of a single train for greater than its TS allowed outage time or two separate safety systems out-of-service for greater than their TS allowed outage time, and did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety-significant in accordance with the licensee's maintenance rule program for greater than 24 hrs. Since the last performance test on station battery 3B was performed in 2013, the team determined the finding was not indicative of current licensee  
 
performance.


=====Enforcement:=====
=====Enforcement:=====
Title 10 CFR Part 50, App. B, Criterion XI, "Test Control," required in part, a test program be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Section  
Title 10 CFR Part 50, App. B, Criterion XI, Test Control, required in part, a test program be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Section 6.4 of IEEE 450-1987 required performance discharge testing be terminated when battery terminal voltage reached 105Vdc. Contrary to the above, since at least 2011, the licensee failed to incorporate the requirements and acceptance limits contained in IEEE 450-1987 for battery performance discharge testing. Specifically, Surveillance procedure 0-SME-003.15 did not adequately specify that the battery performance discharge test not be terminated until voltage reached 105Vdc. The failure to perform surveillance testing in accordance with IEEE 450-1987 could result in masking degradation of the battery on future capacity tests and adversely affect the ability to trend when the testing periodicity would be required to be increased to once a year as required by TS 3.4.8.2. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2219948 and performed an extent of condition review, which determined that none of the station batteries were currently in a degraded condition, and placed surveillance procedure 0-SME-003.15 on administrative hold until the corrective actions are completed. This violation is being treated as an NCV consistent with Section 2.3.2.a of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-05 and 05000251/2017007-05, Failure to Adequately Perform Discharge Testing on Battery 3B


6.4 of IEEE 450-1987 required performance discharge testing be terminated when battery terminal voltage reached 105Vdc. Contrary to the above, since at least 2011, the licensee failed to incorporate the requirements and acceptance limits contained in IEEE 450-1987 for battery performance discharge testing. Specifically, Surveillance procedure 0-SME-003.15  did not adequately specify that the battery performance discharge test not be terminated until voltage reached 105Vdc. The failure to perform surveillance testing in accordance with IEEE 450-1987 could result in masking degradation of the battery on future capacity tests and adversely affect the ability to trend when the testing periodicity would be required to be increased to once a year as required by TS 3.4.8.2. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2219948 and performed an extent of condition review, which determined that none of the station batteries were currently in a degraded condition, and placed surveillance procedure 0-SME-003.15 on administrative hold until the corrective actions are completed. This violation is being treated as an NCV consistent with Section 2.3.2.a of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-05 and 05000251/2017007-05, "Failure to Adequately Perform Discharge Testing on Battery 3B"
===.6 Failure to verify the adequacy of design for the Emergency Containment Cooler (ECC)===


===.6 Failure to verify the adequacy of design for the Emergency Containment Cooler (ECC) and CCW systems
and CCW systems


=====Introduction:=====
=====Introduction:=====
===
The NRC identified a Green NCV of Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the ECC unit 4A auto start circuitry would not result in exceeding the thermal limits of the CCW system during a design basis accident. Specifically, the licensee failed to verify that a single active failure of the motor starter auxiliary contacts would not result in exceeding the design basis limits for CCW as described in UFSAR Section 9.3.
The NRC identified a Green NCV of Title 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the ECC unit 4A auto start circuitry would not result in exceeding the thermal limits of the CCW system during a design basis accident. Specifically, the licensee failed to verify that a single active failure of the motor starter auxiliary contacts would not result in exceeding the design basis limits for CCW as described in UFSAR Section 9.3.


=====Description:=====
=====Description:=====
UFSAR Section 6.3 stated that the emergency containment cooling system was designed to remove sufficient heat from the reactor containment following a design basis accident to keep the containment pressure from exceeding design pressure. The system consists of three forced-air cooling units that used the CCW as the heat sink.
UFSAR Section 6.3 stated that the emergency containment cooling system was designed to remove sufficient heat from the reactor containment following a design basis accident to keep the containment pressure from exceeding design pressure. The system consists of three forced-air cooling units that used the CCW as the heat sink.


UFSAR Section 9.3 stated that to restrict CCW system post-accident temperatures to within acceptable limits, a design basis change remains in effect at expended power uprate (EPU) conditions to limit the maximum number of ECCs automatically starting to no more than two, assuming when only two CCW heat exchangers are in operation. As a result of the Unit 4 EPU, the licensee performed EC 273226 to ensure that only two ECC units were operable within 60 seconds of a safety injection signal and to ensure that the swing ECC 4A started automatically within one minute of an SI signal given a failure of one of the other two ECC units. The licensee stated in EC 273226 that only two of the containment cooling system's ECCs could operate simultaneously and that the operation of three ECCs was not acceptable because it would result in the transfer of too much heat load to the CCW system, exceeding the CCW design. During the review of the control logic for swing ECC 4A, the team identified the modification introduced the potential for a single failure of an auxiliary motor starter contact to cause the simultaneous operation of all three ECCs units, placing the plant in an unanalyzed condition at the time of identification. The team noted that this condition was also applicable to Unit 3. The licensee performed a prompt operability determination and determined that three ECC fans running would result in a CCW supply temperature of approximately 164
UFSAR Section 9.3 stated that to restrict CCW system post-accident temperatures to within acceptable limits, a design basis change remains in effect at expended power uprate (EPU) conditions to limit the maximum number of ECCs automatically starting to no more than two, assuming when only two CCW heat exchangers are in operation.
ºF, exceeding the design basis temperature of 158.6
 
ºF for the CCW supply as described in UFSAR Section 9.3.2 and UFSAR Table 9.3.1. The team also noted that this left approximately 1
As a result of the Unit 4 EPU, the licensee performed EC 273226 to ensure that only two ECC units were operable within 60 seconds of a safety injection signal and to ensure that the swing ECC 4A started automatically within one minute of an SI signal given a failure of one of the other two ECC units. The licensee stated in EC 273226 that only two of the containment cooling systems ECCs could operate simultaneously and that the operation of three ECCs was not acceptable because it would result in the transfer of too much heat load to the CCW system, exceeding the CCW design. During the review of the control logic for swing ECC 4A, the team identified the modification introduced the potential for a single failure of an auxiliary motor starter contact to cause the simultaneous operation of all three ECCs units, placing the plant in an unanalyzed condition at the time of identification. The team noted that this condition was also applicable to Unit 3. The licensee performed a prompt operability determination and determined that three ECC fans running would result in a CCW supply temperature of approximately 164ºF, exceeding the design basis temperature of 158.6ºF for the CCW supply as described in UFSAR Section 9.3.2 and UFSAR Table 9.3.1. The team also noted that this left approximately 1ºF of margin for the safety injection pump lube oil cooler, which reduced the available margin by ~80%. UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968, IEEE Standard Criteria for Protection Systems for Nuclear Power Generating Stations.
ºF of margin for the safety injection pump lube oil cooler, which reduced the available margin by ~80%. UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968, "IEEE Standard Criteria for Protection Systems for Nuclear Power Generating Stations."


Criterion 4.5 "Channel Integrity," of IEEE 279 required, that all protection system channels shall be designed to maintain necessary functional capability under extremes of conditions, as applicable, relating to environment, energy supply, malfunctions, and accidents.
Criterion 4.5 Channel Integrity, of IEEE 279 required, that all protection system channels shall be designed to maintain necessary functional capability under extremes of conditions, as applicable, relating to environment, energy supply, malfunctions, and accidents.


=====Analysis:=====
=====Analysis:=====
The failure to ensure the channel integrity of the ECCs and CCW in accordance with IEEE 279, as required by 10 CFR Part 50, Appendix B, Criterion III, "Design Control," was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, three ECC fans running during a during a design basis accident would result in exceeding the design basis temperature of 158.6 degrees F for the CCW supply and a significant reduction in margin for the SI pump lube oil cooler. The team used Inspection Manual Chapter (IMC) 0609, Att. 4, "Initial Characterization of Findings," issued October 7, 2016, for mitigating systems, and IMC 0609 App. A, "The Significance Determination Process (SDP) for Findings At-Power," issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was a deficiency affecting the design of a mitigating structure, system, or component (SSC) and the SSC maintained its operability. Since EC 273226 was completed in 2012, the team determined the finding was not indicative of current licensee performance.
The failure to ensure the channel integrity of the ECCs and CCW in accordance with IEEE 279, as required by 10 CFR Part 50, Appendix B, Criterion III, Design Control, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, three ECC fans running during a during a design basis accident would result in exceeding the design basis temperature of 158.6 degrees F for the CCW supply and a significant reduction in margin for the SI pump lube oil cooler. The team used Inspection Manual Chapter (IMC)0609, Att. 4, Initial Characterization of Findings, issued October 7, 2016, for mitigating systems, and IMC 0609 App. A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was a deficiency affecting the design of a mitigating structure, system, or component (SSC) and the SSC maintained its operability. Since EC 273226 was completed in 2012, the team determined the finding was not indicative of current licensee performance.


=====Enforcement:=====
=====Enforcement:=====
Title 10 CFR Part 50, Appendix B, Criterion III, "Design Control," required in part, that the design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews. Contrary to the above, since 2012, the licensee failed to verify and check the adequacy of the design of the ECC motor starter logic circuitry. Specifically, the failure of an auxiliary contact would result in automatically starting three ECC fans, thus exceeding the design bases temperature limits of the CCW supply system. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2219505, performed a prompt determination of operability, and determined that the CCW system remained operable. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-06 and 05000251/2017007-06, "Failure to Verify the Adequacy of Design for the ECC  
Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, required in part, that the design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews. Contrary to the above, since 2012, the licensee failed to verify and check the adequacy of the design of the ECC motor starter logic circuitry. Specifically, the failure of an auxiliary contact would result in automatically starting three ECC fans, thus exceeding the design bases temperature limits of the CCW supply system. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2219505, performed a prompt determination of operability, and determined that the CCW system remained operable. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-06 and 05000251/2017007-06, Failure to Verify the Adequacy of Design for the ECC and CCW Systems
 
and CCW Systems"


===.7 Failure to Identify ICW Pipe Corrosion
===.7 Failure to Identify ICW Pipe Corrosion===


=====Introduction:=====
=====Introduction:=====
The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," for the licensee's failure to inspect ICW piping in accordance with license renewal commitments.===
The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the licensees failure to inspect ICW piping in accordance with license renewal commitments.


=====Description:=====
=====Description:=====
On August 2, 2017, during CCW system walk-downs, the team identified multiple instances of notable corrosion, including approximately 0.25" thick metallic flakes, on unit 4 ICW riser piping to the CCW heat exchanger. The team determined that this corrosion met the deficiency criteria established in licensee procedure 0-ADM-
On August 2, 2017, during CCW system walk-downs, the team identified multiple instances of notable corrosion, including approximately 0.25 thick metallic flakes, on unit 4 ICW riser piping to the CCW heat exchanger. The team determined that this corrosion met the deficiency criteria established in licensee procedure 0-ADM-564, Systems/Programs Monitoring.


564, 'Systems/Programs Monitoring." The team reviewed License Renewal (LR) Basis Document, PTN-ENG-LRAM-00-0042, Systems and Structures Monitoring Program - License Renewal Basis Document, and determined per attachment 11.1, "Systems/Component Groups Requiring inspection for License Renewal," outdoor ICW piping susceptible to loss of material due to general corrosion and pitting (external), required visual inspection. Section 5 of the LR Bases stated, in part, that 0-ADM-561, 'Structures Monitoring Program' and 0-ADM-564, 'Systems/Programs Monitoring' have been generated to include those inspections and related attributes required to manage the aging effects identified in the License Renewal Aging Management Reviews and listed in Attachments 11.1 and 11.2. Inspection requirements were translated into Final Safety Analysis Report section 16.2.15, Existing Programs - Systems and Structures Monitoring, by stating "The Systems and Structures Monitoring Program (SSMP) has been enhanced via issuance of procedures 0-ADM-561, "Systems and Structures Monitoring Program", and 0-ADM-564, "Systems/Programs Monitoring."  These procedures address inspection requirements to manage certain aging effects in accordance with 10 CFR 54, modifying the scope of specific inspections, and improving documentation requirements." Procedure 0-ADM-564, section 4.3.7 stated, "The following is a list of items [that] shall be used for performing walk-downs for License Renewal scope listed on Attachment 2, System/Component Groups Requiring Inspection for License Renewal." Attachment 2 directly referenced Section 11.1 from the LR Bases document, to identify LR scope.
The team reviewed License Renewal (LR) Basis Document, PTN-ENG-LRAM-00-0042, Systems and Structures Monitoring Program - License Renewal Basis Document, and determined per attachment 11.1, Systems/Component Groups Requiring inspection for License Renewal, outdoor ICW piping susceptible to loss of material due to general corrosion and pitting (external), required visual inspection. Section 5 of the LR Bases stated, in part, that 0-ADM-561, Structures Monitoring Program and 0-ADM-564, Systems/Programs Monitoring have been generated to include those inspections and related attributes required to manage the aging effects identified in the License Renewal Aging Management Reviews and listed in Attachments 11.1 and 11.2.


Section 4.3.7.A stated, "For system commodities and components, the parameters monitored include corrosion, flaking, pitting, gouges, cracking, fouling, loss of material, loss of seal, change in material properties by visual inspection of external surfaces for leakage and defects, other surface irregularities, protective coating degradation on select stainless steel pipe welds, leakage at limited locations, and missing parts (LR commitment)."  Section 4.3.7.G stated "Deficiency Criteria: Piping: Any corrosion greater than uniform light surface corrosion (LR commitment)."
Inspection requirements were translated into Final Safety Analysis Report section 16.2.15, Existing Programs - Systems and Structures Monitoring, by stating The Systems and Structures Monitoring Program (SSMP) has been enhanced via issuance of procedures 0-ADM-561, "Systems and Structures Monitoring Program", and 0-ADM-564, "Systems/Programs Monitoring." These procedures address inspection requirements to manage certain aging effects in accordance with 10 CFR 54, modifying the scope of specific inspections, and improving documentation requirements.


The team reviewed inspection records for three inspections dated, April 9, 2016; August 8, 2016; and July 5, 2017. The inspectors determined that the license failed to identify any corrosion in excess of the deficiency criteria documented in Procedure 0-ADM-564. The team determined that this oversight was a failure to meet the requirements to inspect the ICW piping in accordance with license renewal commitment.  
Procedure 0-ADM-564, section 4.3.7 stated, The following is a list of items [that] shall be used for performing walk-downs for License Renewal scope listed on Attachment 2, System/Component Groups Requiring Inspection for License Renewal. Attachment 2 directly referenced Section 11.1 from the LR Bases document, to identify LR scope.
 
Section 4.3.7.A stated, For system commodities and components, the parameters monitored include corrosion, flaking, pitting, gouges, cracking, fouling, loss of material, loss of seal, change in material properties by visual inspection of external surfaces for leakage and defects, other surface irregularities, protective coating degradation on select stainless steel pipe welds, leakage at limited locations, and missing parts (LR commitment). Section 4.3.7.G stated Deficiency Criteria: Piping: Any corrosion greater than uniform light surface corrosion (LR commitment).
 
The team reviewed inspection records for three inspections dated, April 9, 2016; August 8, 2016; and July 5, 2017. The inspectors determined that the license failed to identify any corrosion in excess of the deficiency criteria documented in Procedure 0-ADM-564.
 
The team determined that this oversight was a failure to meet the requirements to inspect the ICW piping in accordance with license renewal commitment.


=====Analysis:=====
=====Analysis:=====
The team determined that the failure to meet the requirements to inspect the piping in accordance with license renewal commitments as required by 0-ADM-564, as set forth in FSAR section 16.2.15, and was a performance deficiency. The performance deficiency was determined to be more-than-minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the reliability of systems that respond to initiating events to prevent undesirable consequences. Specifically, unmonitored corrosion affects the reliability of the ICW systems. The team used Inspection Manual Chapter (IMC) 0609, Att. 4, "Initial Characterization of Findings," issued October 7, 2016, for mitigating systems, and IMC 0609 App. A, "The Significance Determination Process (SDP) for Findings At-Power," issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because it did not represent an actual loss of function of one or more non-Tech Spec Trains of equipment designated as high safety-significant in accordance with the licensee's maintenance rule program for >24 hrs.
The team determined that the failure to meet the requirements to inspect the piping in accordance with license renewal commitments as required by 0-ADM-564, as set forth in FSAR section 16.2.15, and was a performance deficiency. The performance deficiency was determined to be more-than-minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the reliability of systems that respond to initiating events to prevent undesirable consequences. Specifically, unmonitored corrosion affects the reliability of the ICW systems. The team used Inspection Manual Chapter (IMC) 0609, Att. 4, Initial Characterization of Findings, issued October 7, 2016, for mitigating systems, and IMC 0609 App. A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because it did not represent an actual loss of function of one or more non-Tech Spec Trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for >24 hrs.


Specifically, the licensee performed an evaluation of piping thickness at select location and determined that remaining wall thickness did not challenge minimum wall thickness limits or operability limits. The finding had a cross-cutting aspect in the area of Problem Identification and Resolution, Identification, because the licensee failed to implement a corrective action program with a low enough threshold for identifying issues.
Specifically, the licensee performed an evaluation of piping thickness at select location and determined that remaining wall thickness did not challenge minimum wall thickness limits or operability limits. The finding had a cross-cutting aspect in the area of Problem Identification and Resolution, Identification, because the licensee failed to implement a corrective action program with a low enough threshold for identifying issues.


Specifically, individuals routinely failed to identify corrosion issues on CCW system area walk downs that exceeded proceduralized acceptance criteria of "light surface rust" specified in 0-ADM-564, during the July 5, 2017, August 11, 2016, and April 11, 2016 CCW area walk downs.
Specifically, individuals routinely failed to identify corrosion issues on CCW system area walk downs that exceeded proceduralized acceptance criteria of light surface rust specified in 0-ADM-564, during the July 5, 2017, August 11, 2016, and April 11, 2016 CCW area walk downs.


=====Enforcement:=====
=====Enforcement:=====
Title 10 CFR 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," stated in part that activities affecting quality shall be prescribed by documented instructions and procedures and shall be accomplished in accordance with these instructions and procedures. Final Safety Analysis Report section 16.2.15, Existing Programs - Systems and Structures Monitoring states in part that "procedure 0-ADM-564, "Systems/Programs Monitoring" address inspection requirements to manage certain aging effects in accordance with 10 CFR 54."  Procedure 0-ADM-564, section 4.3.7.G established deficiency criteria for piping as "any corrosion greater than light surface corrosion."  Contrary to the above, on April 9, 2016, August 11, 2016, and July 5, 2017, the CCW area walk-down inspections Turkey Point failed to accomplish prescribed activities affecting quality in accordance with these instruction and procedures for license renewal scope components. Specifically, On August 2, 2017, the team identified the licensee did not identify corrosion that exceeded the procedures acceptance criteria that was greater than light surface corrosion.
Title 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, stated in part that activities affecting quality shall be prescribed by documented instructions and procedures and shall be accomplished in accordance with these instructions and procedures. Final Safety Analysis Report section 16.2.15, Existing Programs - Systems and Structures Monitoring states in part that procedure 0-ADM-564, Systems/Programs Monitoring" address inspection requirements to manage certain aging effects in accordance with 10 CFR 54. Procedure 0-ADM-564, section 4.3.7.G established deficiency criteria for piping as any corrosion greater than light surface corrosion. Contrary to the above, on April 9, 2016, August 11, 2016, and July 5, 2017, the CCW area walk-down inspections Turkey Point failed to accomplish prescribed activities affecting quality in accordance with these instruction and procedures for license renewal scope components. Specifically, On August 2, 2017, the team identified the licensee did not identify corrosion that exceeded the procedures acceptance criteria that was greater than light surface corrosion. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 02218430 and AR 02218437, planned to perform localized corrosion wall thickness measurements to ensure the ICW system remained operable. This violation is being treated as an NCV consistent with Section 2.3.2.a of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-07 and 05000251/2017007-07, Failure to Identify ICW Pipe Corrosion.


For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 02218430 and AR 02218437, planned to perform localized corrosion wall thickness measurements to ensure the ICW system remained operable. This violation is being treated as an NCV consistent with Section 2.3.2.a of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-07 and 05000251/2017007-07, "Failure to Identify ICW Pipe Corrosion."
===.8 Failure to Correct a Non-Conforming Condition Impacting Containment===
 
===.8 Failure to Correct a Non-Conforming Condition Impacting Containment


=====Introduction:=====
=====Introduction:=====
The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," for the licensee's failure to take timely corrective action to maintain the Unit 3 and 4 containment cathodic protection systems.===
The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, for the licensees failure to take timely corrective action to maintain the Unit 3 and 4 containment cathodic protection systems. These systems have been non-functional on both units since 2009. The cathodic protection system purpose is to protect the containments interconnected liner, reinforcing bars, and tendon trumplates.
These systems have been non-functional on both units since 2009. The cathodic protection system purpose is to protect the containment's interconnected liner, reinforcing bars, and tendon trumplates.


=====Description:=====
=====Description:=====
The team noted that the Unit 3 and Unit 4 containments' Cathodic Protection Systems (CPS) were non-functional since approximately 2009. The team reviewed the containments design bases to determine if this affected their long term structural integrity and operational capability. The team determined that the containment design bases described in the UFSAR credited the CPS to protect the containment metallic structures, and that the safety evaluation report, NUREG-1759, dated April 2002, for license renewal required the maintenance of the CPS as a condition of license  
The team noted that the Unit 3 and Unit 4 containments Cathodic Protection Systems (CPS) were non-functional since approximately 2009. The team reviewed the containments design bases to determine if this affected their long term structural integrity and operational capability. The team determined that the containment design bases described in the UFSAR credited the CPS to protect the containment metallic structures, and that the safety evaluation report, NUREG-1759, dated April 2002, for license renewal required the maintenance of the CPS as a condition of license renewal.


renewal. The UFSAR Subsection 5.1.7 "Containment Testing" specified, in part, the cathodic protection system is designed to protect the interconnected liner, reinforcing bars, and tendon trumplates. In addition, Subsection 8.2.2.1.1.2 "Specifics of the Onsite AC Power System" described the electrical design of the cathodic protection system, and specified, in part, the metallic portion of the containment to be protected includes the liner, the reinforcing bars and the tendon assemblies.
The UFSAR Subsection 5.1.7 Containment Testing specified, in part, the cathodic protection system is designed to protect the interconnected liner, reinforcing bars, and tendon trumplates. In addition, Subsection 8.2.2.1.1.2 Specifics of the Onsite AC Power System described the electrical design of the cathodic protection system, and specified, in part, the metallic portion of the containment to be protected includes the liner, the reinforcing bars and the tendon assemblies.


The safety evaluation report, NUREG-1759, stated, in part, that the licensee submittals did not credit the CPS for aging management for 10 CFR 50.54 License Renewal.
The safety evaluation report, NUREG-1759, stated, in part, that the licensee submittals did not credit the CPS for aging management for 10 CFR 50.54 License Renewal.


However, in the staff evaluations for the ASME Section Xl, Subsections IWE and IWL Inservice Inspection Programs, Sections 3.9.1.2 and 3.9.1.4, the staff specified, in part, it is the malfunction of cathodic protection system that could give rise to the degradation of the protected safety-related components. In a discussion on April 11, 2001, the applicant emphasized that the procedures for ensuring the effectiveness of the cathodic protection system were available at the plant site for a staff review. In the aging management review inspection during August 20-September 14, 2001, the inspectors verified that the operation procedures for the CPS were available at the plant site and were adequate. The licensee identified the non-functionality of the CPS, and issued a condition report on the CPS, AR 1920613, in October 2009, as a result of WO 3800925 (Unit 3, 10/2008)and WO 37017321(Unit 4, 02/2009). The AR was closed to the licensee's long term aging management program (LTAM), which is not their corrective action program. The degrading effects on the containment structure were not identified or evaluated. As a result of the inspection sample on July 14, 2017, the licensee issued AR 2216534, dated July 24, 2017 and evaluated the affects on the containment structure operability.  
However, in the staff evaluations for the ASME Section Xl, Subsections IWE and IWL Inservice Inspection Programs, Sections 3.9.1.2 and 3.9.1.4, the staff specified, in part, it is the malfunction of cathodic protection system that could give rise to the degradation of the protected safety-related components. In a discussion on April 11, 2001, the applicant emphasized that the procedures for ensuring the effectiveness of the cathodic protection system were available at the plant site for a staff review. In the aging management review inspection during August 20-September 14, 2001, the inspectors verified that the operation procedures for the CPS were available at the plant site and were adequate.
 
The licensee identified the non-functionality of the CPS, and issued a condition report on the CPS, AR 1920613, in October 2009, as a result of WO 3800925 (Unit 3, 10/2008)and WO 37017321(Unit 4, 02/2009). The AR was closed to the licensees long term aging management program (LTAM), which is not their corrective action program. The degrading effects on the containment structure were not identified or evaluated. As a result of the inspection sample on July 14, 2017, the licensee issued AR 2216534, dated July 24, 2017 and evaluated the affects on the containment structure operability.


=====Analysis:=====
=====Analysis:=====
The failure to take timely corrective actions to correct a condition adverse to quality was a failure to meet 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," and was a performance deficiency. The performance deficiency was determined to be more than minor, because it is associated with the Design Control attribute of the Barrier Integrity cornerstone and affected the cornerstone objective of maintaining the containment structural integrity and operational capability to provide reasonable assurance that the containment protects the public from radionuclide releases caused by accident or events. Specifically, the failure to implement timely corrective actions to maintain the protection of the containment's interconnected liner, reinforcing bars, and tendon trumplates affected the structural integrity and operational capability of the containment structure. The team used IMC 0609 Attachment 4, "Initial Characterization of Findings," issued October 7, 2016, for barrier integrity, and IMC 0609 Appendix A, "The Significance Determination Process (SDP) for Findings At-Power,"
The failure to take timely corrective actions to correct a condition adverse to quality was a failure to meet 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, and was a performance deficiency. The performance deficiency was determined to be more than minor, because it is associated with the Design Control attribute of the Barrier Integrity cornerstone and affected the cornerstone objective of maintaining the containment structural integrity and operational capability to provide reasonable assurance that the containment protects the public from radionuclide releases caused by accident or events. Specifically, the failure to implement timely corrective actions to maintain the protection of the containments interconnected liner, reinforcing bars, and tendon trumplates affected the structural integrity and operational capability of the containment structure. The team used IMC 0609 Attachment 4, Initial Characterization of Findings, issued October 7, 2016, for barrier integrity, and IMC 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was not a pressurized thermal shock issue, did not represent an actual open pathway in the physical integrity of the reactor containment, and did not involve an actual reduction in function of hydrogen igniters in the reactor containment. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.
issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was not a pressurized thermal shock issue, did not represent an actual open pathway in the physical integrity of the reactor containment, and did not involve an actual reduction in function of hydrogen igniters in the reactor containment. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.


=====Enforcement:=====
=====Enforcement:=====
10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," required, in part, that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and non-conformances are promptly identified and corrected. Contrary to the above, since July 2009, the licensee failed to establish measures to assure that this condition adverse to quality was corrected. Specifically, the licensee failed to implement timely corrective actions to maintain the cathodic protection of the containment's interconnected liner, reinforcing bars, and tendon trumplates. Allowing the cathodic protection system to remain non-functional could give rise to the degradation of the containment structure. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2216534 and performed a prompt operability determination. The licensee concluded the containment structure was operable but non-
10 CFR 50, Appendix B, Criterion XVI, Corrective Action, required, in part, that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and non-conformances are promptly identified and corrected. Contrary to the above, since July 2009, the licensee failed to establish measures to assure that this condition adverse to quality was corrected. Specifically, the licensee failed to implement timely corrective actions to maintain the cathodic protection of the containments interconnected liner, reinforcing bars, and tendon trumplates. Allowing the cathodic protection system to remain non-functional could give rise to the degradation of the containment structure. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2216534 and performed a prompt operability determination. The licensee concluded the containment structure was operable but non-conforming and established compensatory measures. The licensee is developing corrective actions to resolve the degraded and nonconforming condition. This violation is being treated as an NCV consistent with Section 2.3.2 of the Enforcement Policy.


conforming and established compensatory measures. The licensee is developing corrective actions to resolve the degraded and nonconforming condition. This violation is being treated as an NCV consistent with Section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-08 and 05000251/2017007-08, "Failure to Correct a Non-Conforming Condition Impacting Containment."
This violation is identified as NCV 05000250/2017007-08 and 05000251/2017007-08, Failure to Correct a Non-Conforming Condition Impacting Containment.


===.9 Failure to Update the UFSAR with the Latest Information Developed===
===.9 Failure to Update the UFSAR with the Latest Information Developed===


=====Introduction:=====
=====Introduction:=====
The NRC identified a SLIV NCV of 10 CFR 71(e), "Maintenance of Records, Making of Reports," for the failure to assure that the UFSAR contains the latest information developed, including all changes made in the facility or procedures as described in the UFSAR.
The NRC identified a SLIV NCV of 10 CFR 71(e), Maintenance of Records, Making of Reports, for the failure to assure that the UFSAR contains the latest information developed, including all changes made in the facility or procedures as described in the UFSAR.


=====Description:=====
=====Description:=====
Procedure LI-AA-101-1003, "Updated Final Safety Analysis Report (UFSAR) Revision," Revision 5, Section 4.1, required that the UFSAR be updated for changes made in the facility/procedures as described in the UFSAR. The team found several examples of design features described in the UFSAR associated with the turbine runback design features that were not installed or were removed by plant modifications. UFSAR section 14.1.10 states that the "loss of external electrical load may result from an abnormal increase in network frequency," which would cause a "rapid large load reduction by the action of the turbine control."  However, there is no design feature that would initiate this sequence of events as a result of a network over frequency condition. This section further states that, following opening of the main breaker from the generator, "offsite power is available for the continued operation of plant components such as the reactor coolant pumps."  However, the design is such that opening of the main breaker from the generator results in blocking of automatic transfer of the 4160V buses to offsite power, which would prevent continued operation of plant components from offsite power. Blocking of the automatic transfer is accomplished by time delay relays set for 0.167 seconds, such as the 162/3A2 relay shown on drawing 5613-E-28, Sheet 1A, "Electrical Auxiliaries, Auxiliary Transformer Breaker 3AA02," Revision 7.
Procedure LI-AA-101-1003, Updated Final Safety Analysis Report (UFSAR) Revision, Revision 5, Section 4.1, required that the UFSAR be updated for changes made in the facility/procedures as described in the UFSAR. The team found several examples of design features described in the UFSAR associated with the turbine runback design features that were not installed or were removed by plant modifications.
 
UFSAR section 14.1.10 states that the loss of external electrical load may result from an abnormal increase in network frequency, which would cause a rapid large load reduction by the action of the turbine control. However, there is no design feature that would initiate this sequence of events as a result of a network over frequency condition.
 
This section further states that, following opening of the main breaker from the generator, offsite power is available for the continued operation of plant components such as the reactor coolant pumps. However, the design is such that opening of the main breaker from the generator results in blocking of automatic transfer of the 4160V buses to offsite power, which would prevent continued operation of plant components from offsite power. Blocking of the automatic transfer is accomplished by time delay relays set for 0.167 seconds, such as the 162/3A2 relay shown on drawing 5613-E-28, Sheet 1A, Electrical Auxiliaries, Auxiliary Transformer Breaker 3AA02, Revision 7.


On February 3, 1993, the site issued PCM 92-181, Revision 1, which eliminated automatic turbine runback for a dropped rod or reactor axial flux imbalance. However, the licensee failed to update UFSAR Section 1.4.6 to reflect the removal of this feature.
On February 3, 1993, the site issued PCM 92-181, Revision 1, which eliminated automatic turbine runback for a dropped rod or reactor axial flux imbalance. However, the licensee failed to update UFSAR Section 1.4.6 to reflect the removal of this feature.


On October 5, 1993, the site issued PCM 93-005, Revision 0, which eliminated automatic turbine runback for reactor overpower and over temperature. However, the licensee failed to update UFSAR Sections 7.2.1 and 7.7 to reflect the removal of this  
On October 5, 1993, the site issued PCM 93-005, Revision 0, which eliminated automatic turbine runback for reactor overpower and over temperature. However, the licensee failed to update UFSAR Sections 7.2.1 and 7.7 to reflect the removal of this feature.
 
feature.


On December 23, 2011, the site issued EC-246849, Revision 1, which added an automatic turbine runback feature that responds to various losses of secondary system equipment. However, the licensee failed to update the UFSAR to describe this feature.
On December 23, 2011, the site issued EC-246849, Revision 1, which added an automatic turbine runback feature that responds to various losses of secondary system equipment. However, the licensee failed to update the UFSAR to describe this feature.


=====Analysis:=====
=====Analysis:=====
The team determined the failure to update the UFSAR in accordance with procedure LI-AA-101-1003 was a performance deficiency. The NRC determined this violation was associated with a minor performance deficiency in accordance with the screening criteria in IMC 612 Appendix E, "Examples of Minor Issues."  Because the failure to update the UFSAR impacted the NRC's ability to perform its regulatory process, the team evaluated the violation using the traditional enforcement process. The team determined that this met the criteria for a SLIV violation because not accurately describing turbine runback design features in the UFSAR could have a material impact on licensed activities, and met the SLIV violation criteria in 6.1.d.3 of the NRC Enforcement Policy. The violation represented a failure to update the UFSAR as required by Title 10 Code of Federal Regulations Part 50.71(e), but the lack of up-to-date information has not resulted in any unacceptable change to the facility or procedures. Cross-cutting aspects are not assigned to traditional enforcement violations.
The team determined the failure to update the UFSAR in accordance with procedure LI-AA-101-1003 was a performance deficiency. The NRC determined this violation was associated with a minor performance deficiency in accordance with the screening criteria in IMC 612 Appendix E, Examples of Minor Issues. Because the failure to update the UFSAR impacted the NRCs ability to perform its regulatory process, the team evaluated the violation using the traditional enforcement process.
 
The team determined that this met the criteria for a SLIV violation because not accurately describing turbine runback design features in the UFSAR could have a material impact on licensed activities, and met the SLIV violation criteria in 6.1.d.3 of the NRC Enforcement Policy. The violation represented a failure to update the UFSAR as required by Title 10 Code of Federal Regulations Part 50.71(e), but the lack of up-to-date information has not resulted in any unacceptable change to the facility or procedures. Cross-cutting aspects are not assigned to traditional enforcement violations.


=====Enforcement:=====
=====Enforcement:=====
10 CFR 50.71(e) stated, in part, that the UFSAR must contain the latest information developed. Contrary to the above, since February 1993, the licensee failed to update the UFSAR with the latest information developed for turbine runback design. Specifically, the UFSAR did not contain the latest information developed regarding turbine runback associated with grid over frequency, reactor axial flux imbalance, reactor unsafe operating conditions, and losses of secondary system equipment. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2218695 to update the UFSAR. This violation is SL-IV and is being treated as an
10 CFR 50.71(e) stated, in part, that the UFSAR must contain the latest information developed. Contrary to the above, since February 1993, the licensee failed to update the UFSAR with the latest information developed for turbine runback design.


NCV, consistent with Section 2.3.2.(a) of the NRC Enforcement Policy. This violation is identified as NCV 05000250/2017007-09 and 05000251/2017007-09, "Failure to Update the UFSAR with the Latest Information Developed."
Specifically, the UFSAR did not contain the latest information developed regarding turbine runback associated with grid over frequency, reactor axial flux imbalance, reactor unsafe operating conditions, and losses of secondary system equipment. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2218695 to update the UFSAR. This violation is SL-IV and is being treated as an NCV, consistent with Section 2.3.2.(a) of the NRC Enforcement Policy. This violation is identified as NCV 05000250/2017007-09 and 05000251/2017007-09, Failure to Update the UFSAR with the Latest Information Developed.


===.10 Potential failure of 125 Vdc Bus 3B Class 1E components===
===.10 Potential failure of 125 Vdc Bus 3B Class 1E components===
Line 387: Line 379:


=====Description:=====
=====Description:=====
UFSAR Section 8.2.2.3.1 stated that the emergency power for vital instrumentation and controls is supplied by a station DC power system which contains five safety related 125Vdc batteries and four DC distribution panels. 125 Vdc distribution panel 3B supplies safety related power to several safety-related equipment including sequencers, reactor trip switchgear, inverter 3Y06, and control power to 480Vac load centers 3B and 3D and 4160 Vac switchgears 3AB01 and 4AB20. UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968. Section 4.5 of IEEE 279-1968, "Channel Integrity," requires all protection system channels be designed to maintain necessary functional capability under extremes of conditions relating to malfunctions. During the review of calculation 5177-265-EG-22, "Circuit Breaker/Fuse Coordination Study," Rev. 8, the team questioned if there were instances where class 1E cables associated with DC Bus 3B (3D23) would not be adequately protected given a short circuit on the load side of the breakers. The failure to ensure the Class 1E protective devices would not allow the maximum available short circuit to permanently damage cabling to safety-related equipment associated with DC Bus 3B could result in additional loss of Class 1E equipment. Unresolved Item (URI)05000250/2017007-01 and 05000251/2017007-01, "Potential failure of 125 Vdc Bus 3B Class 1E components, ") is opened for additional review to determine if the Class 1E cables on DC Bus 3B can withstand the maximum possible short circuit and to determine if a performance deficiency exists.
UFSAR Section 8.2.2.3.1 stated that the emergency power for vital instrumentation and controls is supplied by a station DC power system which contains five safety related 125Vdc batteries and four DC distribution panels. 125 Vdc distribution panel 3B supplies safety related power to several safety-related equipment including sequencers, reactor trip switchgear, inverter 3Y06, and control power to 480Vac load centers 3B and 3D and 4160 Vac switchgears 3AB01 and 4AB20. UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968. Section 4.5 of IEEE 279-1968, Channel Integrity, requires all protection system channels be designed to maintain necessary functional capability under extremes of conditions relating to malfunctions. During the review of calculation 5177-265-EG-22, Circuit Breaker/Fuse Coordination Study, Rev. 8, the team questioned if there were instances where class 1E cables associated with DC Bus 3B (3D23) would not be adequately protected given a short circuit on the load side of the breakers. The failure to ensure the Class 1E protective devices would not allow the maximum available short circuit to permanently damage cabling to safety-related equipment associated with DC Bus 3B could result in additional loss of Class 1E equipment. Unresolved Item (URI)05000250/2017007-01 and 05000251/2017007-01, Potential failure of 125 Vdc Bus 3B Class 1E components, ) is opened for additional review to determine if the Class 1E cables on DC Bus 3B can withstand the maximum possible short circuit and to determine if a performance deficiency exists.


===.3 Operating Experience===
===.3 Operating Experience===


====a. Inspection Scope====
====a. Inspection Scope====
The team reviewed one operating experience issues for applicability at the Turkey Point Nuclear Plant. The team performed an independent review for these issues and, where applicable, assessed the licensee's evaluation and disposition of each item. The issues that received a detailed review by the team included:
The team reviewed one operating experience issues for applicability at the Turkey Point Nuclear Plant. The team performed an independent review for these issues and, where applicable, assessed the licensees evaluation and disposition of each item. The issues that received a detailed review by the team included:
* IN2009-11, Configuration Control Errors ML091240039
* IN2009-11, Configuration Control Errors ML091240039


Line 402: Line 394:
==4OA5 Other Activities==
==4OA5 Other Activities==


===.1 (Closed) Unresolved Item (URI) URI 05000250, 251/2017008-04, Potential Inadequate Design Control of Current Limiting Reactor.===
===.1 (Closed) Unresolved Item (URI) URI 05000250, 251/2017008-04, Potential Inadequate===
 
Design Control of Current Limiting Reactor.


====a. Inspection Scope====
====a. Inspection Scope====
The URI was documented on May 12, 2017, in NRC reactive inspection report 05000250/2017008 and 05000251/2017008. The URI was opened in order to review the design and configuration of the reactor coil located inside the 3A 4kV switchgear following the completion of the licensee's root cause evaluation. This was to determine whether any performance deficiencies exist in the area of design control. The potential concern with the design and installation inside the 3A 4kV switchgear was with exposed incoming and outgoing 4kV bussing. The 3A 4kV switchgear had thermoplastic insulated bussing throughout the gear except at the reactor coil.
The URI was documented on May 12, 2017, in NRC reactive inspection report 05000250/2017008 and 05000251/2017008. The URI was opened in order to review the design and configuration of the reactor coil located inside the 3A 4kV switchgear following the completion of the licensees root cause evaluation. This was to determine whether any performance deficiencies exist in the area of design control. The potential concern with the design and installation inside the 3A 4kV switchgear was with exposed incoming and outgoing 4kV bussing. The 3A 4kV switchgear had thermoplastic insulated bussing throughout the gear except at the reactor coil.
 
The team reviewed the design layout drawings, photographs of the interior of switchgear 3A, design specification, and industry quality standards to determine if adequate clearances were used in the design and installation of the reactor coil inside of the switchgear. The team reviewed American National Standard Institute (ANSI) C37.32-2002, "American National Standard for High Voltage Switches, Bus Supports, and Accessories Schedules of Preferred Ratings, Construction Guidelines, and Specifications," which specified clearance requirements for phase to phase and phase to


ground spacing. From the documentation reviewed, the team did not identify any discrepancies between the design of switchgear 3A and the specified clearance requirements, and therefore, no performance deficiency was identified.
The team reviewed the design layout drawings, photographs of the interior of switchgear 3A, design specification, and industry quality standards to determine if adequate clearances were used in the design and installation of the reactor coil inside of the switchgear. The team reviewed American National Standard Institute (ANSI) C37.32-2002, American National Standard for High Voltage Switches, Bus Supports, and Accessories Schedules of Preferred Ratings, Construction Guidelines, and Specifications, which specified clearance requirements for phase to phase and phase to ground spacing. From the documentation reviewed, the team did not identify any discrepancies between the design of switchgear 3A and the specified clearance requirements, and therefore, no performance deficiency was identified.


====b. Findings====
====b. Findings====
No findings of significance were identified; URI 05000250, 251/2017008-04 is closed.
No findings of significance were identified; URI 05000250, 251/2017008-04 is closed.
 
{{a|4OA6}}
{{a|4OA6}}
==4OA6 Meetings, Including Exit==
==4OA6 Meetings, Including Exit==


On August 18, 2017, the team presented the inspection results to Mr. Stamp and other members of the licensee's staff. On September 28, 2017, a re-exit meeting was conducted via teleconference to present the final inspection results to Mr. Summers and other members of the licensee's staff. Proprietary information that was reviewed during the inspection was returned to the licensee or destroyed in accordance with prescribed  
On August 18, 2017, the team presented the inspection results to Mr. Stamp and other members of the licensees staff. On September 28, 2017, a re-exit meeting was conducted via teleconference to present the final inspection results to Mr. Summers and other members of the licensees staff. Proprietary information that was reviewed during the inspection was returned to the licensee or destroyed in accordance with prescribed controls.


controls.
ATTACHMENT:  
 
ATTACHMENT:


=SUPPLEMENTARY INFORMATION=
=SUPPLEMENTARY INFORMATION=
Line 428: Line 417:


===Licensee personnel===
===Licensee personnel===
:  
:
: [[contact::P. Barnes]], System Engineering Manager
: [[contact::P. Barnes]], System Engineering Manager
: [[contact::D. Barrow]], Maintenance Director
: [[contact::D. Barrow]], Maintenance Director
: [[contact::H. Benitez]], Engineering Team Lead  
: [[contact::H. Benitez]], Engineering Team Lead
: [[contact::O. Carol]], System Engineer  
: [[contact::O. Carol]], System Engineer
: [[contact::C. Cashwell]], Training Manager
: [[contact::C. Cashwell]], Training Manager
: [[contact::P. Czaya]], Licensing Engineer  
: [[contact::P. Czaya]], Licensing Engineer
: [[contact::R. De La Torre]], Electrical Design Engineer  
: [[contact::R. De La Torre]], Electrical Design Engineer
: [[contact::M. Guth]], Licensing Manager
: [[contact::M. Guth]], Licensing Manager
: [[contact::G. Melin]], Operations Director
: [[contact::G. Melin]], Operations Director
: [[contact::J. Pallin]], Engineering Site Director
: [[contact::J. Pallin]], Engineering Site Director
: [[contact::C. Rossi]], Nuclear Assurance Supervisor
: [[contact::C. Rossi]], Nuclear Assurance Supervisor
: [[contact::B. Stamp]], Plant General Manager
: [[contact::B. Stamp]], Plant General Manager
: [[contact::R. Tomonto]], Design Engineering Manager  
: [[contact::R. Tomonto]], Design Engineering Manager
: [[contact::J. Vives]], Electrical Design Supervisor  
: [[contact::J. Vives]], Electrical Design Supervisor


==LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED==
==LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED==


===Opened===
===Opened===
: 05000250, 251/2017007-01 URI Potential failure of 125 Vdc Bus 3B Class 1E
: 05000250, 251/2017007-01             URI     Potential failure of 125 Vdc Bus 3B Class 1E components (Section 1R21.2.b.10)
components (Section 1R21.2.b.10)  


===Closed===
===Closed===
: 05000250, 251/2017008-04 URI Potential
: 05000250, 251/2017008-04             URI     Potential Inadequate Design Control of Current Limiting Reactor (Section 4OA5.1)
: Inadequate Design Control of Current Limiting Reactor (Section 4OA5.1)  
Opened &  
: Opened &  
===Closed===
===Closed===
: 05000250, 251/2017008-04 URI Potential
: 05000250, 251/2017008-04             NCV      Inadequate Verification of Electrical Protective Device Selective Coordination (Section 1R21.2.b.1)
: Inadequate Design Control of Current Limiting Reactor (Section 4OA5.1)  
: 05000250, 251/2017007-02            NCV      Failure to Perform Design Verification for Under Frequency Trip of the Main Generator Breakers (Section 1R21.2.b.2)
: Opened &
: 05000250, 251/2017007-03            NCV      Failure to Verify the Adequacy of CCW isolation from Supplemental Cooling System (SCS)
                                              (Section 1R21.2.b.3)
: 05000250, 251/2017007-04            NCV      Failure to Verify the Adequacy of Design for Component Protective Covers (Section 1R21.2.b.4)
: 05000250, 251/2017007-05 NCV    Failure to Adequately Perform Discharge Testing on Battery 3B (Section 1R21.2.b.5)
: 05000250, 251/2017007-06 NCV    Failure to Verify the Adequacy of Design for the ECC and CCW Systems (Section 1R21.2.b.6)
: 05000250, 251/2017007-07 NCV    Failure to Identify ICW Pipe Corrosion (Section 1R21.2.b.7)
: 05000250, 251/2017007-08 NCV    Failure to Correct a Non-Conforming Condition Impacting Containment (Section 1R21.2.b.8)
: 05000250, 251/2017007-09 SLIV  Failure to Update the UFSAR with the Latest Information Developed (Section 1R21.2.b.9)


==LIST OF DOCUMENTS REVIEWED==
==LIST OF DOCUMENTS REVIEWED==
Corrective Action Documents Written as a Result of the Inspection
: AR 2216534, Containment Cathodic Protection Non-Functional
: AR 2218279, 2017 DBAI - Housekeeping in U3 CCW Room
: AR 2218293, 2017 DBAI -
: PI-3-1095A Needle is Bent
: AR 2218296, 2017 DBAI -
: PI-3-1095B Needle is Bent
: AR 2218341, 2017 DBAI - 4P11C - Corroded Conduit Cover
: AR 2218363, 2017 DBAI - Update to CCW DBD Required
: AR 2218416, 2017 DBAI - Conduit Box for A-3H1477 is Corroded on Bottom
: AR 2218430, 2017 DBAI - Minor Rust on Header Piping U/S
: BS-3-1402
: AR 2218432, 2017 DBAI - 3A HHSI Pump Heater Light at Pump Room Out
: AR 2218437, 2017 DBAI - Minor Rust on Header Piping U/S
: BS-3-1403
: AR 2218448, 2017 DBAI - Item 126; Update UFSAR Table 6.2-9(A)
: AR 2218521, Calculation 5177-462-E-03 Needs to be Taken to History
: AR 2218654, Validation of Time Critical Action
: AR 2218695, 2017 DBAI - Turbine Runback Features Not Described in UFSAR
: AR 2218834, 2017 DBAI - Discrepancy Found in
: EC 283225 (Unit 3 and 4 CCW Supplemental 
: Cooling)
: AR 2219362, 2017 DBAI - Removed Bump Covers Not iaw FP Program
: AR 2219505, 2017 DBAI - Item of Concern in
: EC 273225 &
: 273226 FMEA
: AR 2219948, 2017 DBAI - 3B Battery Performance Test stopped after 120 min.
: AR 2220286, 2017 DBAI - Typo Found in 3/4-OSP-030.4 attachment 2
: AR 2220749, REVISE UNIT 3 AND UNIT 4 ETAP CALC
: AR 2220750, 2017 DBAI: Velcro Inadvertent Contact Protective Covers
: AR 2220874, 2017 DBAI - Generator Trip Feature Not Described In Ufsar
: AR 2220956, Update of
: PTN-BFJE-91-019 Required Breaker Coordination
: AR 2220993, 2017 DBAI - 10
: CFR 50.59 Review of Breaker Bump Protectors
: AR 2220994, 2017 DBAI: Discrepancy Found in
: EC 283225 (UNIT 3 AND 4 SCS)
: AR 2224998, 2017 DBAI - Plant Response to Generator Underfrequency Trip 
===Procedures===
: 0-ADM-016.1, Transient Combustible and Flammable Substances Program, Rev. 012
: 0-ADM-16, Fire Protection Program, Rev. 022A
: 0-ADM-216, PTN and PTF Shared System Work Control and Switchyard Access, Rev. 13
: 0-ADM-232, Turkey Point Time Critical Operator Action program, Rev. 006 0-ADM-502, In Service Test (IST) Program, Rev. 22 0-ADM-540, Motor Operated Valve Program, Rev. 3A
: 0-ADM-540, Motor Operated Valve Program, Rev. 3A
: 0-ADM-547, Gas Accumulation Management Program, Rev. 12A
: 0-ADM-564, Systems/Programs Monitoring, Rev. 3 0-NOP-019.01, Intake Cooling Water System Supplemental Cooling System, Rev. 0. 0-ONOP-004.6, Degraded Switchyard Voltage, 6/13/2010
: 0-PME-005.03, 4160 V General Electric Breaker Inspection and Cleaning, Rev. 2
: 0-PME-005.06 , 4160V A and B Bus Inspection and Cleaning, Rev. 3A
: 0-PME-80.07, Preventative Maintenance of Environmentally Qualified Limitorque Motor, Rev 6 0-SME-003.15, TS 3B Battery 60 Month Performance Test, dated 1/29/13 0-SME-003.15, TS 3B Battery 60 Month Performance Test, dated 10/26/11 0-SME-003.15, TS D52 Spare Battery 60 Month Performance Test, dated 3/6/10
: 0-SME-003.15, TS D52 Spare Battery 60 Month Performance Test, dated 4/29/15
: 3/4-ONOP-090, Abnormal Generator MW/MVAR Oscillation, Rev. 0A
: 3-ARP-097.CR.H, Control Room Response - Panel H, Rev. 11 3-ARP-097.CR.H, Turkey Point Unit 3 Annunciator Response Procedure Control Room Response - Panel H, Rev. 011 3-ARP-097.CR.I, Turkey Point Unit 3 Annunciator Response Procedure Control Room
: Response - Panel I, Rev. 018
: 3-EOP-E-0, Turkey Point Unit 3 Reactor Trip or Safety Injection, Rev. 013
: 3-EOP-E-1, Turkey Point Unit 3 Loss of Reactor or Secondary Coolant, Rev. 009
: 3-EOP-E-2, Turkey Point Unit 3 Faulted Steam Generator Isolation, Rev. 005
: 3-EOP-ES-1.1, Turkey Point Unit 3 SI Termination, Rev. 011 3-EOP-ES-1.3, Turkey Point Unit 3 Transfer to Cold Leg Recirculation, Rev. 005A 3-EOP-ES-1.4, Turkey Point Unit 3 Transfer to Hot Leg Recirculation, Rev. 004
: 3-NOP-005, 4kV Buses A, B, and D, Rev. 11
: 3-NOP-010.01, Cathodic Protection System, Rev. 2A
: 3-NOP-019, Intake Cooling Water System, Rev. 31. 3-NOP-019, Turkey Point Unit 3 Normal Operating Procedure Intake Cooling Water System, Rev. 031
: 3-NOP-030, Component Cooling Water System, Rev. 28A.
: 3-NOP-030, Turkey Point Unit 3 Normal Operating Procedure Component Cooling Water 
: System, Rev. 028A 3-NOP-074, Turkey Point Unit 3 Normal Operating Procedure Steam Generator Feedwater System, Rev. 032
: 3-ONOP-004.2, Loss of 3A 4KV Bus, Rev. 4A
: 3-ONOP-019, Turkey Point Unit 3 Off Normal Operating Procedure Intake Cooling Water Malfunction, Rev. 003
: 3-ONOP-030, Turkey Point Unit 3 Off Normal Operating Procedure Component Cooling Water System, Rev. 008A 3-ONOP-089, Turkey Point Unit 3 Off Normal Operating Procedure Turbine Runback, 
: Rev. 001A
: 3-OSP-019.4, Component Cooling Water Heat Exchanger Performance Monitoring, Rev. 7,
: Completed 6/12/17, 6/19/17, 6/26/17, and 7/3/17. 3-OSP-030.3, Component Cooling Water System Flowpath Verification, Re. 7A 3-OSP-030.4, Component Cooling Water Heat Exchanger Performance Test, Rev. 13.
: 3-OSP-062.2D, Safety injection Pump 3A Comprehensive Pump Test, Rev. 2
: 3-OSP-206,4, Inservice Valve Testing/Refueling, Rev.2
: 3-OSP-206.1 Inservice Valve Testing - Cold Shutdown, 02/08/2017
: 3-OSP-206.1, Inservice Valve Testing - Cold Shutdown, Rev. 11 4-EOP-E-0, Turkey Point Unit 4 Reactor Trip or Safety Injection, Rev. 012
: 4-EOP-E-1, Turkey Point Unit 4 Loss of Reactor or Secondary Coolant, Rev. 009
: 4-EOP-E-2, Turkey Point Unit 4 Faulted Steam Generator Isolation, Rev. 003
: 4-EOP-ES-1.1, Turkey Point Unit 3 SI Termination, Rev. 008
: 4-EOP-ES-1.3, Turkey Point Unit 3 Transfer to Cold Leg Recirculation, Rev. 005A 4-EOP-ES-1.4, Turkey Point Unit 3 Transfer to Hot Leg Recirculation, Rev. 004 4-NOP-010.01, Cathodic Protection System, Rev. 3
: EN-AA-100-1004, Calculations, Rev. 6
: EN-AA-101, Configuration Management program, Rev. 007
: EN-AA-203-1201, 10 CFR Applicability and 10
: CFR 50.59 Screening Reviews, Rev. 011
: EN-AA-205-1103, Equivalent Design Package, Rev. 003
: ER-AA-116, Motor Operated Valve Program, Rev. 2
: ER-AA-201-2001, System and Program Health Reporting, Rev. 11
: LI-AA-101-1003, Updated Final Safety Analysis Report (UFSAR), Rev. 5
: OP-AA-109, Control of Time Critical Operator Actions and Time Sensitive Actions, Rev. 001
: PTN-BFSM-11-020, MOV Program: NRC Generic Letter 89-10 MOV Design Basis Differential
: Pressure Determination - Post - EPU, Rev. 0
: PTN-BFSM-11-021, NRC Generic Letter 89-10 MOV Thrust Calculation-Post-EPU, Rev. 3
: PTN-BFSM-11-022, NRC Generic Letter 89-10 MOV Actuator Evaluation-Post-EPU, Rev.3
: PTN-ENG-LRAM-00-0025, ASME Section XI, Subsection IWL In-Service Inspection Program - 
: License Renewal Program Basis Document, Rev. 3
: PTN-ENG-LRAM-00-0026, ASME Section XI, Subsections IWE In-Service Inspection Program - 
: License Renewal Program Basis Document, Rev. 4
: PTN-ENG-LRAM-00-0042, Systems and Structures Monitoring Program - License Renewal
: Basis Document, Rev 9 
===Drawings===
: 5610-E-1 Sh 1, Main Single Line Unit 3, Rev. 44
: 5610-E-5-2, Indoor Metalclad Switchgear Bus No. 3A, Rev. 6 5610-E-5-22 Sh 1, Outline (General Electric - Current Limiting Reactor - dimensional drawing), Rev. 1
: 5610-E-5-41 Sh 2, Connection Diagram - Units 3AA07 Thru 3AA11, Rev. 8
: 5610-M-430-171 Sh 5, Elementary Diagram - Safeguard System, Rev. 28
: 5610-M-57, Unit 3 CCW Supplemental Cooling System Equipment Skid Layout, Sh. 5, Rev. 0. 5610-M-61A-10, Limitorque Valve Control, Rev. 3 5610-M-61A-10, Limitorque Valve Control, Rev. 3
: 5610-M-900-3, Pressurizer Safety Relief Valve Rv-3-551A,B, & C, Rv-4-551A,B, & C 5610-T-E-1591, Operating Diagram - Electrical Distribution, Rev. 79
: 5610-T-E-1592 Sh. 1, 125 VDC & 120 Instrument AC Electrical Distribution, Rev. 35
: 5610-T-L1 Sh 104B, Generator Trip Logic, Rev. 7 5610-T-L1 Sh 24D, Logic Diagram - Component Cooling Pumps 3A and 3B, Rev. 14 5610-T-L1 Sh 4A, Generator Trip Logic, Rev. 0
: 5610-T-L1 Sh 4B, Generator Trip Logic, Rev. 8
: 5613-E-12, 125 VDC & 120 Instrument AC, Rev. 12
: 5613-E-1605, Battery 3A and 3B Load Profiles, Rev. 17 5613-E-18 Sh 1, Aux. & Start-Up Transformer Metering & Relay Schematic Bus 3A, Rev. 17 5613-E-26, Feedwater & Condensate TPCW/ICW Isolation Valve
: POV-3-4882, Sh. 29C, Rev. 3.
: 5613-E-28 Sh 20A, Electrical Auxiliaries - 4160 Volt Bus 3A Bus Clearing, Rev. 5
: 5613-E-28 Sh 2A, Electrical Auxiliaries - Start-Up Transformer Breaker 3AA05, Rev. 8
: 5613-E-28 Sh 32A, Electrical Auxiliaries - 4KV Switchgear Breakers 3AA02 & 3AA05 Blowers, 
: Rev. 4 5613-E-28 Sh 32A1, Electrical Auxiliaries - 4KV Switchgear Breakers 3AA02 & 3AA05 Blowers, Rev. 0
: 5613-E-28 Sh 3A, Electrical Auxiliaries - Start-Up Transformer Breaker 3AA22, Rev. 4
: 5613-E-28 Sh 9A, Electrical Auxiliaries - Loss of Voltage Bus 3A, Rev. 4
: 5613-E-28 Sh 9A2, Electrical Auxiliaries - Loss of Voltage Bus 3A, Rev. 6 5613-E-3 Sh 1, 4KV Switchgear 3A & 3B, Rev. 8 5613-E-315 Sh 13B, Relay Settings - 4.16kV Switchgear 3AA04 Start-Up Transformer Unit 3, 
: Rev. 5
: 5613-E-41, Cathodic Protection System, Rev. 0
: 5613-E-5-1, 4.16 KV Switchgear Indoor Metal Clad SWGR Bus 3A, Rev. 2
: 5613-E-5-3, Indoor Metal Clad Switchgear Bus No. 3A, Rev. 2 5613-E-5-72 Sh 1, 4160V Switchgear Bus 3A Section Views, Rev. 0 5613-M-3019 SH1, Turkey Point Unit 3 Intake Cooling Water System, Rev. 040
: 5613-M-3019 SH2, Turkey Point Unit 3 Intake Cooling Water System, Rev. 029
: 5613-M-3019, Intake Cooling Water System, Sh. 1, Rev. 40. 5613-M-3030 SH1, Turkey Point Unit 3 Component Cooling Water System, Rev. 027
: 5613-M-3030, Component Cooling Water System, Sh. 1, EC283225, Rev. 0. 5613-M-3030, Component Cooling Water System, Sh. 1, Rev. 27. 5613-M-3030, Component Cooling Water System, Sh. 3, EC283225, Rev. 2.
: 5613-M-3030, Component Cooling Water System, Sh. 5, EC283225, Rev. 3.
: 5613-M-3030, Component Cooling Water System, Sh. 6, EC283225, Rev. 5.
: 5613-M-3041, Reactor Coolant System, Rev. 0
: 5613-M-3062 SH1, Turkey Point Unit 3 Safety Injection System, Rev. 044 5613-M-3062-SH1, Safety Injection System, Rev. 44 5613-M-313, Instrument Setpoint List, Rev. 84.
: 5613-M-4019 SH1, Turkey Point Unit 4 Intake Cooling Water System, Rev. 038
: 5613-M-4019 SH2, Turkey Point Unit 4 Intake Cooling Water System, Rev. 027
: 5613-M-4030 SH1, Turkey Point Unit 4 Component Cooling Water System, Rev. 032 5613-M-4062 SH1, Turkey Point Unit 4 Safety Injection System, Rev. 039 5613-T-L1 Sh 13A, Bus 3B Loss of Voltage and Bus Stripping, Rev. 6
: 5614-E-25 Sh. 11B, Reactor Auxiliaries Emergency Containment Cooling Fan 4A Breaker 
: 40805, Rev. 0
: 5614-E-25 Sh. 11D, Reactor Auxiliaries Emergency Containment Cooling Fan 4B Breaker 
: 40520, Rev. 0 5614-E-25 Sh. 11D1, Reactor Auxiliaries Reactor Emergency Clg. Discharge Intake & By-pass Sol. Vlv., Rev. 0
: 5614-E-25 Sh. 11F, Reactor Auxiliaries Emergency Containment Cooling Fan 4C Breaker 
: 40650, Rev. 0
: 5614-E-25 Sh. 11F1, Reactor Auxiliaries Reactor Emergency Clg. Discharge Intake & By-pass Sol. Vlv., Rev. 0 5614-M-3030, Component Cooling Water System,Rev. 0
: 5614-T-L1 Sh 21, Rod Stop, Rev. 0
: 8770-A-451-1000, St. Lucie Plant Unit No 1 Equipment Qualification Documentation Package, 
: Rev. 12 
===Calculations===
: 0113, Post LOCA Reactor Auxiliary Building ECCS Pump Area Temperature Transient Analysis, Rev. 0
: 18712-115-E-02, Spare Station Battery System Short Circuit Calculation, Rev. 1
: 18712-473, DC Voltage Drop for Safe Shutdown Components, Rev. 1 21701-523-E-01, Turkey Point Unit 3 Load Centers Undervoltage Relay Set Points, Rev. 3 32-9092400, Turkey Point Unit 4 CS Test Loop Hydraulic Analysis, Rev. 1.
: 2-9094394-000, Turkey Point Unit 3/4 Unit Aux Transformer Sizing Calculation for Power 
: Uprate, Rev. 0
: 5177-265-EG-22, Circuit Breaker/Fuse Coordination Study, Rev. 8 5610-T-D-16B, Pressurizer Pressure Control, Rev. 0 5613-M-3041, Reactor Coolant System, Rev. 0
: CN-CRA-09-1, Turkey Point EPU RETRAN Base Deck for Steamline Break Mass/Energy Release for Inside Containment, Rev.
: CN-SEE-I-11-15, Turkey Point RHR Cooldown with One CCW Heat Exchanger Out of Service, Rev. 0.
: CN-SEE-III-08-32, Calculation of Turkey Point Unit 3 & 4 ECCS Injection Flows for the
: Extended Power Uprate, 10/14/2008
: CN-SEE-III-09-4, Turkey Point EPU RHRS Cooldown, Rev. 0.
: EC-137, Adequacy of DC Panel Short Circuit Ratings due to Addition of Battery Chargers 3A2 
and 3B2, Rev. 2
: FLO 53-20.5005, Appendix R Circuit Breaker/Fuse Coordination Study, Rev. 6
: JPNS-PTN-88-2555, MOV Thrust Requirements, 11/09/1988
: M12-383-01, Vortex Design Evaluation of Refueling Water Storage Tank
: PTN-3FSE-07-001, Unit 3 Safety Related AC Electrical Distribution
: PSB-1 Short Circuit, Voltage Drop and Bus Loading Analysis--ETAP Program, Rev. 4
: PTN-BFJC-94-010, Containment Cathodic Protection Modifications, 07/21/1994
: PTN-BFJE-91-017, Turkey Point Units 3 & 4 Fast Transfer, Rev. 0
: PTN-BFJE-91-019, AC Emergency Power System Coordination Calculation, Rev. 11
: PTN-BFJE-92-021, Turkey Point Units 3 & 4 Load Centers - Under voltage Relay
: ITE-27H 
: Setpoints, Rev. 0
: PTN-BFJE-94-002, Battery Size and Voltage Drop Calculations for Station Batteries 3A 3B 4A
and 4B, Rev. 8
: PTN-BFJM-92-022, Crane - MOV Thrust Calculations, Rev. 3/90
: PTN-BFJM-96-004, CCW Hx Design Basis Case and Operability Curves, Rev. 4.
: PTN-BFJM-P2-022, Crane - MOV Thrust Calculations, Rev. 1
: PTN-BFSE-97-003,
: PSB-1 Voltage Analysis for Electrical Auxiliary System, Rev. 8
: PTN-BFSM-02-006, AOV Program - ICW to TPCW Isolation Valve/Actuator Capability, Rev. 0,    and CCN-1.
: PTN-BFSM-11-020, MOV Program:
: NRC Generic Letter 89-10 MOV Design Basis Differential Pressure Determination - Post-EPU, Rev. 0
: PTN-BFSM-11-021, NRC Generic Letter 89-10 MOV Thrust Calculation-Post-EPU, Rev. 3
: PTN-BFSM-11-022, NRC Generic Letter 89-10 MOV Actuator Evaluation-Post-EPU, Rev. 3
: PTN-BOSM-17-001, AOV Program CCW Supplemental Cooling System Isolation Valve/Actuator Capability, Rev. 0.
: PTN-BSHM-08-011, Feedwater & Condensate System Equipment Selection, Performance Evaluation and Operational Transients Review, Rev. 3
: PTN-BSHM-09-017, CCWS Hydraulic Evaluation for EPU, Rev. 4.
: PTN-BSHM-09-019, CCWS Thermal Performance Calculation for EPU, Rev. 4 and Rev. 4A.
: Self-Assessment Reports
: AR - L2A, Level 2 - DBAI Pre-Inspection Assessment
: 2209637, dated 6/12/2017
: Corrective Action Documents
: 00468265
: 00476123
: 01899159
: 1907650
: 01945309
: 01945309
: 1948876
: 1952026
: 01958068
: 01958590
: 01982999
: 01983255
: 01985630
: 2016985
: 2049414
: 02049824
: 2086033
: 2087133
: 2087203
: 2087429
: 2087525
: 2087699
: 2088151
: 2088180
: 2088651
: 02113436
: 2192198
: 2194719
: 2195420
: 2195725
: 2195778
: 02199229
: 2199502
: 200328
: 200714
: 2202592
: 02205475
: 218834
: 219505
===Work Orders===
: 38022804
: 38022804
: 38025835
: 40064980
: 40064981
: 40086736
: 40119493-02
: 40147199-12
: 40147202-23
: 40161161
: 40189575
: 40200509
: 40282737
: 40396305-01
: 40396325-01
: 40407146
: 40409985
: 40410813
: 40423937
: 40431779
: 40432107
: 40432107
: 40432445
: 40432445
: 40448178
: 40454857
: 40464340
: 40482587 01
: 40489552 01
: 40499351
: RWO 10-012 
===Miscellaneous Documents===
: 0-BD-ONOP-004.6, Design Basis Document, Degraded Switchyard Voltage, Rev. 1
: 5610-023-DB-001, Design Basis Document, Emergency Power System, Rev. 10
: 5610-023-DB-002, Design Basis Document, Emergency Power System Component Design Requirements, Rev. 10
: 5610-068-DB-002, Design Basis Documents, 4/17/2013 5610-E-5, Specification for 4.16kV Indoor Metal-Clad Switchgear, Rev. 7 ANSI/IEEE Std 279-1971, Criteria for Protection Systems for Nuclear Power Generating 
: Stations


of AR#00468265
: CCW DBD 5610-030-DB-001-014.
: CCW
: DBD 5610-030-DB-002-016. CP Runback Response Curves CV2011 Runback Response Curves
: EC 246924, Pressurizer Safety Valve Setpoint Changes for Unit 3 and Unit 4, Rev. 2
: EC 270847, Replacement of 480V Load Centers 327T Inverse Time Characteristic Degraded Voltage Relays, Rev. 1
: EC 281955, Equivalent Design Package for
: EC 275627
: EC 289622, Engineering Technical Response for clarification of
: EDP 281955
: EC-242267. Replacement of the 3A High Head Safety Injection Pump, Rev. 0
: EC-283225 Units 3 & 4 CCW Supplemental Cooling, Rev. 9.
: EC-289598 CCW Temperature Switch Setpoint Adjustment, Rev. 0.
: Equipment Qualification Documentation Package 1001
: ER-AA113, Inservice Testing (IST) Program, Rev. 1
: ER-AA-116, Motor Operated Valve Program, Rev. 2
: FLO-53-20.5007, Emergency Diesel Generator Units Dynamic Loading Study, Rev. 0
: FPL-046-PR-01, Failure Modes and Effects Analysis for the Proposed Auto-Start Circuitry of the 
: 3B Emergency Containment Cooler, Rev. 0 HDP Response Curves ICW DBD 5610-019-DB-001-011.
: ICW DBD 5610-019-DB-002-016.
: IN 2009-11, Configuration Control Errors Inservice Testing Program Plan, Fifth 10-Year Interval, Rev. 2
: Issuance of Amendments Regarding Changes to Direct Current Sources Surveillance
: Requirements, dated 8/8/12
: IST Program Basis Document, 01/21/2015
: JPN-PTN-SECJ-93-001, Engineering Evaluation for Specification
: SPEC-C-013, Installation
: Guidelines for Misc. Non-System Related Items on Existing Structures, Rev. 002
: JPN-PTN-SECS-94-018, Evaluation of Bump Covers for the Reactor Trip Breakers in the U3 &
: 4 Reactor Control Rod Equipment Rooms, Rev. 002
: JPNS-PTN-88-2555, Turkey Point Units 3 & 4 MOV Thrust Requirements, 11/9/1988 L-2012-191, Responses to Request for Additional Information Related to
: LAR 210, DC Sources,    dated 4/30/12
: L-206-139, Inservice Testing Program Plan, 07/26/2016
: Letter, FPL to NRC, L-82-211, Adequacy of Station Electrical Distribution Voltages, 5/20/1982.
: Letter, FPL to NRC, L-82-389, Adequacy of Station Electrical Distribution Voltage, 9/1/1982.
: Letter, FPL to NRC, L-82-509, Adequacy of Station Electrical Distribution Voltage, 11/16/1982. Maintenance Rule Scope Evaluation for System 030 - Closed/Component Cooling Water
: System, 3/21/2017
: Maintenance Rule Scope Evaluation, Safety Injection System, 03/21/2017
: Maintenance Strategy:
: MOV3-1417, 11/02/15
: MRA 31018306-01, Request for Specification Change for
: SPEC-C-013
: MRA 32000183-01, Request for Specification Change for
: SPEC-C-013
: MRA 32018014-01, Request for Specification Change for
: SPEC-C-013
: MRA 34001277-01, Request for Specification Change for
: SPEC-C-013
: MRA 39017461-03, Request for Specification Change for
: SPEC-C-013
: NEI 96-07, Guidelines for 10
: CFR 50.59 Implementation, Rev. 001
: NP-6229, Technical Repair Guidelines for the Limitorque Model
: SMB-000 Valve Actuator,
: PCM 83-94, 4160 Volt Switchgear Additional Bracing, Rev. 0
: PCM 92-025, Change to Turbine Runback Setpoint for Overtemperature and Overpower Delta-
: T and High Delta-T Alarm Setpoint, Rev. 1
: PCM 92-181, Elimination of Turbine Runback on Dropped Rod, Rev. 1
: PCM 93-005, Turbine Runback Elimination, Rev. 0
: PTN 760202801 LOC17D, MSLB/CCW/TCA Scenario Guide PTN MOV Periodic Verification Test Margins
: PTN-C-(019-BI)-FN07, Maintenance Rule Function Scoping.
: PTN-C-(030-CC)-FN03, Maintenance Rule Function Scoping.
: PTN-C-003-EE-FN01, Non-vital AC/DC provides power to non-safety Related Loads
: Maintenance Rule Scoping
: PTN-C-003-EE-FN01, Vital DC System Maintenance Rule Scoping
: PTN-C-003-EE-FN05, Battery Chargers Maintenance Rule Scoping
: PTN-ENG-LRAM-00-0025, ASME Section XI, Subsection IWL Inservice Inspection Program License Renewal Program Basis Document, Rev. 3
: PTN-ENG-SEES-4-016, Engineering Evaluation: Address PTN Offsite Power System
: Operational Readiness Key Questions in NRC Regulatory Issue Summary (IS) 2004-05 and
: NRC Inspection Manual Temporary Instruction (TI) 2515/156, Rev. 1
: PTN-ENG-SENS-02-065, 10
: CFR 50.59 Evaluation to Demonstrate Compliance with Station Blackout Requirements, dated 8/18/05
: PWROG-16030-NP, Time Critical Action/Time Sensitive Action Program Standard, Rev. 001
: Rev. 1 SGFP Runback Response Curves
: SPEC-C-013, Installation Guidelines for Miscellaneous Non-System Related Items on Existing
: Structures, Rev. 004
: SPEC-M-207, Turkey Point Units 3 & 4 CCW Supplemental Cooling Heat Exchangers, Rev. 2.
: SPEC-M-208, Turkey Point Units 3 & 4 CCW Supplemental Cooling System Pump, Rev. 0.
: SPEC-M-209, Turkey Point Units 3 & 4 CCW Supplemental Cooling Air Operated Valves, Rev. 0.
: Standard
: IC-3.17, Instrument Setpoint Methodology for Nuclear Power Plants, Rev. 7.
: Temperature Switch
: TS-2216 Calibration Data Sheet.
: Temperature Switch
: TS-254 Calibration Data Sheet.
: Turkey Point 3 and 4 Technical Specifications Unit 3 CCW Walkwdown System IQ Report, 03/23/2016 Unit 3 CCW Walkwdown System IQ Report, 05/28/2017
: Unit 3 CCW Walkwdown System IQ Report, 06/13/2016
: Update Final Safety Analysis Report Turkey Point Units 3&4
: V000247, Vendor Manual - Operation & Maintenance Manual for Rubber Seated Butterfly 
: Valves, Rev. 15. V000263, Instruction Manuals for Switchgear Components, Rev. 18 V000872, Vendor Manual - Instruction Manual Auxiliary Heat Exchangers, Rev. 0. Valve Data Sheet for CV-2185.
: VTM No. AA550, Static Battery Charger Vendor Manual, dated 7/26/17
: VTM No. V000468, 60
: NCX-27 on Two-Rier Racks Vendor Manual, dated 5/20/10
: WG-86-168, Safety Related MOV Program Final Report, 04/07/198
}}
}}

Latest revision as of 10:31, 19 December 2019

NRC Design Bases Assurance Inspection (Team) Report No. 05000250/2017007 and 05000251/2017007
ML17277A837
Person / Time
Site: Turkey Point  NextEra Energy icon.png
Issue date: 10/02/2017
From: Bartley J
NRC/RGN-II/DRS/EB1
To: Nazar M
Florida Power & Light Co
References
IR 2017007
Download: ML17277A837 (39)
v • d • e


Text

UNITED STATES NUCLEAR REGULATORY COMMISSION ber 2, 2017

SUBJECT:

TURKEY POINT NUCLEAR GENERATING STATION - NRC DESIGN BASES ASSURANCE INSPECTION (TEAM) REPORT NUMBER 05000250/2017007 AND 05000251/2017007

Dear Mr. Nazar On August 18, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Turkey Point Nuclear Generating Station Units 3 and 4. On August 18, 2017, the NRC inspectors discussed the results of this inspection with Mr. Brian Stamp, Plant General Manager, and other members of your staff. The results of this inspection are documented in the enclosed report.

NRC inspectors documented nine findings of very low safety significance (Green) in this report.

Nine of these findings involved violations of NRC requirements; one of these violations was determined to be Severity Level IV under the traditional enforcement process. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region II; the Director, Office of Enforcement; and the NRC resident inspector at the Turkey Point Nuclear Plant..

If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement] in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region II; and the NRC resident inspector at the Turkey Point Nuclear Plant.

M. Nazar 2 This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Jonathan H. Bartley, Chief Engineering Branch 1 Division of Reactor Safety Docket Nos. 50-250, 50-251 License Nos. DPR-31 and DPR-41

Enclosure:

Inspection Report 05000250/2017007 and 05000251/2017007, w/Attachment:

Supplemental Information

REGION II==

Docket Nos.: 050000250, 05000251 License Nos.: DPR-31 and DPR-41 Report Nos.: 05000250/2017007, 05000251/2017007 Licensee: Florida Power and Light Facility: Turkey Point Nuclear Generating Station, Units 3 and 4 Location: Homestead, FL Dates: July 31, 2017 - August 18, 2017 Inspectors: T. Fanelli, Senior Reactor Inspector (Lead)

S. Bussey, Senior Reactor Technology Instructor M. Riley, Reactor Inspector N. Morgan, Reactor Inspector M. Jones, Reactor Inspector (RIII)

H. Leake, Contractor R. Waters, Contractor Approved by: Jonathan H. Bartley, Chief Engineering Branch 1 Division of Reactor Safety Enclosure

SUMMARY

IR 05000250/2017-007, 05000251/2017-007; 7/31/2017 - 8/18/2017; Turkey Point Nuclear

Generating Station Units 3 and 4; Design Bases Assurance Inspection (Team).

The inspection activities described in this report were performed between July 31, 2017 and August 18, 2017, by five Nuclear Regulatory Commission (NRC) inspectors and one trainee from Region II and one inspector from Region III. The significance of inspection findings are indicated by their color (i.e., greater than Green, or Green, White, Yellow, or Red) and determined using Inspection Manual Chapter (IMC) 0609, Significance Determination Process, (SDP) dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310, Aspects Within the Cross-Cutting Areas, dated December 4, 2014. All violations of NRC requirements were dispositioned in accordance with the NRCs Enforcement Policy dated November 1, 2016.

The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision

NRC-Identified and Self-Revealing Findings

Cornerstone: Initiating Events

  • Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, for failure to verify or check the adequacy of design of the under frequency trip feature of the main generator circuit breakers with regard to the effect of its operation on plant stability and the maintenance of critical safety functions. The licensee entered this issue into their corrective action program as AR 2220874 and AR 2224998.

The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions. Specifically, opening of the main generator breakers due to an under frequency condition on the offsite power system would cause the generator load to suddenly drop from full power to the level of the plant loads, and there was no verification that plant stability and critical safety functions would be maintained. The team evaluated the finding with Inspection Manual Chapter 0609,

Appendix A, and determined the finding met the Support System Initiators screening criteria for requiring a detailed risk evaluation. The team determined that this issue increased the likelihood of the support system initiator loss of offsite power (LOOP).

The regional senior risk analyst conducted a detailed risk evaluation with a one year exposure and determined the change in core damage frequency was less than 1E-6, which was of very low safety significance (Green). The team did not assign a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.2)

  • Green: The NRC identified a Green non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the adequacy of design for the non-safety related component protective covers attached to safety related equipment. For immediate corrective actions, the licensee entered this into their corrective action program as AR 02220993 and removed visibly degraded protective covers.

The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute and of the Initiating Events Cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the failure to ensure the quality and qualification of commercial components and assemblies to maintain adequate mounting to Class 1E equipment increased the likelihood of inadvertent component failures, and thus increased the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. The team determined the finding to be of very low safety significance because the finding did not cause a reactor trip and the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition (e.g. loss of condenser, loss of feedwater). This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.

(Section 1R21.2.b.4)

Cornerstone: Mitigating Systems

  • Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, for failure to verify that coordination exists between the protective devices on safety related switchgear in order to minimize the probability of losing a safety related power bus. For immediate corrective actions, the licensee entered this issue into their corrective action program as Action Request (AR) 2220956 and performed an operability determination, which determined the system was operable, and was performing a reevaluation of the calculation to determine adequate coordination.

The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, failing to verify short circuits in non-safety related SSCs downstream of the safety related switchgear would not cause a lockout of the safety-related bus affected its availability and reliability. The team determined the finding to be of very low safety significance because the finding was a deficiency affecting the design of a mitigating structure, system, or component (SSC), and the SSC maintained their operability or functionality. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.1)

  • Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the adequacy of design of temperature set points used for isolation of the Component Cooling Water (CCW) from the CCW supplemental cooling system (SCS) during an accident. For immediate corrective actions, the licensee entered this into their corrective action program as AR 2218834, performed an operability determination, which determined the system is operable but non-conforming, and issued engineering change (EC) 289598 to account for uncertainties in the CCW SCS temperature isolation setpoint.

The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, by not ensuring prompt isolation or adjusting the isolation setpoint to account for instrument uncertainties and temperature lag, the licensee failed to ensure that the SCS loop would be isolated at onset of an accident, which affected the reliability and capability of the CCW system when called upon. The determined the finding to be of very low safety significance because the findings were a deficiency affecting the design of a mitigating structure, system, or component (SSC), and the SSC maintained their operability or functionality. The finding had a cross-cutting aspect in the area of Human Performance because the licensee failed to ensure knowledge transfer to maintain a knowledgeable, technically competent workforce and instill nuclear safety values [H.9]. (Section 1R21.2.b.3)

  • Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion XI, Test Control, for the licensees failure to perform surveillance testing on station battery 3B in accordance with the requirements of Institute of Electrical and Electronic Engineers (IEEE) 450-1987. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2219948 and performed an extent of condition review, which determined that none of the station batteries were currently in a degraded condition, and placed surveillance procedure 0-SME-003.15 on administrative hold until the corrective actions are completed.

The performance deficiency was determined to be more than minor because if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern. Specifically, the performance deficiency could result in masking degradation of the battery on future performance discharge tests and adversely affect the ability to trend when the testing periodicity should be increased to once a year as required by Technical Specifications (TS). The team determined the finding to be of very low safety significance because the finding did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for greater than 24 hrs. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.5)

  • Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the Emergency Containment Cooler (ECC) unit 4A auto start circuitry would not result in exceeding the thermal limits of the CCW system during a design basis accident.

Specifically, the licensee failed to verify that a single active failure of the motor starter auxiliary contacts would not result in exceeding the design basis limits for CCW as described in updated final safety analysis report (UFSAR) Section 9.3. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2219505, performed a prompt determination of operability, and determined that the CCW system remained operable.

The performance deficiency was determined to be more than minor because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, three ECC fans running during a during a design basis accident would result in exceeding the design basis temperature of 158.6 °F for the

CCW supply and a significant reduction in margin for the SI pump lube oil cooler. The team determined the finding to be of very low safety significance because the finding was a deficiency affecting the design of a mitigating structure, system, or component (SSC) and the SSC maintained its operability. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.6)

Green.

The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the licensees failure to inspect Intake Cooling Water (ICW) piping in accordance with license renewal commitments. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 02218430 and AR 02218437, planned to perform localized corrosion wall thickness measurements to ensure the ICW system remained operable.

The performance deficiency was determined to be more-than-minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the reliability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, unmonitored corrosion affects the reliability of the ICW systems. The team determined the finding to be of very low safety significance because it did not represent an actual loss of function of one or more non-Tech Spec trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for

>24 hrs. The finding had a cross-cutting aspect in the area of Problem Identification and Resolution, Identification, because the licensee failed to implement a corrective action program with a low enough threshold for identifying issues [P.1]. Specifically, individuals routinely failed to identify corrosion issues on CCW system area walk downs that exceeded proceduralized acceptance criteria of light surface rust specified in 0-ADM-564, during the July 5, 2017, August 11, 2016, and April 11, 2016 CCW area walk downs. (Section 1R21.2.b.7)

Cornerstone: Barrier Integrity

  • Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion XVI, Corrective Action, for the licensees failure to take timely corrective action to maintain the unit 3 and 4 containment cathodic protection systems. These systems have been non-functional on both units since 2009. The cathodic protection systems purpose is to protect the containments interconnected liner, reinforcing bars, and tendon trumplates. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2216534 and performed a prompt operability determination. The licensee concluded that the containment structure was operable but non-conforming and established plans to monitor the potentially impacted inaccessible areas through continued performance of the American Society of Mechanical Engineers (ASME) IWL and IWE programs until actions are taken to restore the Cathodic Protection System.

The performance deficiency was determined to be more than minor, because it is associated with the Design Control attribute of the Barrier Integrity cornerstone and affected the cornerstone objective of maintaining the containment structural integrity and operational capability to provide reasonable assurance that the containment protects the public from radionuclide releases caused by accident or events. Specifically, the failure to implement timely corrective actions to maintain the protection of the containments interconnected liner, reinforcing bars, and tendon trumplates affected the structural integrity and operational capability of the containment structure. The team determined the finding to be of very low safety significance because the finding was not a pressurized thermal shock issue, did not represent an actual open pathway in the physical integrity of the reactor containment, and did not involve an actual reduction in function of hydrogen igniters in the reactor containment. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.

(Section 1R21.2.b.8)

Traditional Enforcement

  • SLIV: The NRC identified a Severity Level-IV non-cited violation of Title 10 Code of Federal Regulations 71(e), Maintenance of Records, Making of Reports, for the failure to assure that the Updated Final Safety Analysis Report (UFSAR) contained the latest information developed, including all changes made in the facility or procedures as described in the UFSAR. The team determined that the licensee failed to update the UFSAR to include the latest information regarding several design features associated with turbine runback. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2218695 to update the UFSAR.

The NRC determined this violation was associated with a minor performance deficiency in accordance with the screening criteria in IMC 0612, Appendix E. Because the failure to update the UFSAR impacted the NRCs ability to perform its regulatory process, the team evaluated the violation using the traditional enforcement process. The team determined that this met the criteria for a SLIV violation because not accurately describing turbine runback design features in the UFSAR could have a material impact on licensed activities, and met the SLIV violation criteria in 6.1.d.3 of the NRC Enforcement Policy. The violation represented a failure to update the UFSAR as required by Title 10 Code of Federal Regulations Part 50.71(e), but the lack of up-to-date information has not resulted in any unacceptable change to the facility or procedures. Cross-cutting aspects are not assigned to traditional enforcement violations. (Section 1R21.2.b.9)

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

1R21 Design Bases Assurance Inspection (Team)

Main article: IP 71111.21M

.1 Inspection Sample Selection Process

The team selected risk-significant samples and related operator actions for review using information contained in the licensees probabilistic risk assessment. In general, this included risk significant structures, systems, and components (SSCs) that had a risk achievement worth factor greater than 1.3 or Birnbaum value greater than 1E-6. The sample included seven components selected based on risk significance, one component associated with containment large early release frequency (LERF), four modifications to mitigation SSCs, and two operating experience (OE) items.

The team performed a margin assessment and a detailed review of the selected risk-significant components and associated operator actions to verify that the design bases had been correctly implemented and maintained. Where possible, this margin was determined by the review of the design basis and Updated Final Safety Analysis Report (UFSAR). This margin assessment also considered original design issues, margin reductions due to modifications, or margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for a detailed review. These reliability issues included items related to failed performance test results, significant corrective action, repeated maintenance, maintenance rule status, Inspection Manual Chapter 0326 conditions, NRC Resident Inspector input regarding problem equipment, system health reports, industry OE, and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, OE, and the available defense-in-depth margins. An overall summary of the reviews performed and the specific inspection findings identified is included in the following sections of the report.

.2 Component Reviews

a. Inspection Scope

Components Selected Based on Risk Significance

  • Unit 3 CCW Heat Exchangers
  • TPCW isolation valve for CCW POV-4882, POV-4883
  • MOV-3-1417
  • Unit 3/4 HHSI System, Pumps
  • 3A 4160V Switchgear
  • 3B DC Bus Components with LERF Implications
  • Enable Auto start of 3B Emergency Containment Cooling (EC) EC273226
  • EHC and Turbine Controls digital upgrade Various ECs 246849 and 246896
  • Pressurizer set point change EC246924 For the seven components listed above, the team reviewed the plant technical specifications (TS), UFSAR, design bases documents, and drawings to establish an overall understanding of the design bases of the components. Design calculations and procedures were reviewed to verify that the design and licensing bases had been appropriately translated into these documents and that the most limiting parameters and equipment line-ups were used. Logic and wiring diagrams were also reviewed to verify that operation of electrical components conformed to design requirements. Test procedures and recent test results were reviewed against design bases documents to verify the adequacy of test methods and that acceptance criteria for tested parameters were supported by calculations or other engineering documents, and that individual tests and analyses served to validate component operation under accident conditions.

Maintenance procedures were reviewed to ensure components were appropriately included in the licensees preventive maintenance program, that components or sub-components were being replaced before the end of their intended service life, and that the licensee has appropriate controls in place for components that are beyond vendor recommended life. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action program documents were reviewed (as applicable) in order to verify that the performance capability of the component was not negatively impacted, and that potential degradation was monitored or prevented.

Maintenance Rule information was reviewed to verify that the component was properly scoped, and that appropriate preventive maintenance was being performed to justify current Maintenance Rule status. Component walk downs and interviews were conducted to verify that the installed configurations would support their design and licensing bases functions under accident conditions, and had been maintained to be consistent with design assumptions.

For the four modifications listed above, the team reviewed design bases, licensing bases, and performance capability of components to ensure they have not been degraded through modifications. In addition, post-modification testing was reviewed to ensure operability was established by verifying unintended system interactions will not occur, SSC performance characteristic continue to meet the design bases, modification design assumptions are appropriate, and modification test acceptance criteria have been met. The team also verified design basis documentation was updated consistent with the design change, verified other design basis features were not adversely impacted, verified procedures and training plans affected by the modification were updated, and verified that affected test documentation was updated or initiated as required by applicable test programs. Walk downs and interviews were conducted as necessary to verify that the modifications were adequately implemented. Documents reviewed are listed in the Attachment.

Additionally, the team performed the following specific reviews:

  • For the selected operator actions, the inspectors performed a margin assessment and detailed review of the operator actions listed below. Where possible, margins were determined by the review of the assumed design basis and UFSAR response times and performance times. The team observed time critical operator actions performed during simulator evaluated scenarios in accordance with the station annunciator response procedures, emergency operating procedures, and the off normal operating procedures for the following conditions:

1) During the onset of a main steam line break (MSLB) inside containment, stop AFW flow to the faulted steam generator to limit mass and energy releases into containment.

2) During the onset of a main steam line break (MSLB) inside containment, limit high head safety injection (HHSI) pump operating time at shutoff head on minimum recirculation flow to prevent pump overheating.

3) During a residual heat removal (RHR) pump start with operation at shutoff head, secure RHR pump to prevent pump overheating.

4) During a component cooling water (CCW) 50 gpm out-leakage, initiate makeup to prevent emptying the CCW surge tank.

  • The team observed a field simulated performance of restoring intake cooling water (ICW) flow at least the minimum allowable value during a basket strainer backwash evolution.

b. Findings

.1 Inadequate Verification of Electrical Protective Device Selective Coordination

Introduction:

The NRC identified a Green non-cited violation (NCV) of Title 10 Code of Federal Regulations Part 50 (10 CFR 50), Appendix B, Criterion III, Design Control, for failure to correctly verify that coordination exists between the protective devices on safety related switchgear in order to minimize the probability of losing a safety related power bus.

Description:

The team reviewed Calculation PTN-BFJE-91-019, AC Emergency Power System Coordination, revision 11, to determine if the licensee had established adequate breaker coordination to minimize the probability of losing electric power to safety related 4160 volt-alternating-current (Vac) switchgear. The team noted that the two trains of safety related switchgear supplied both non-safety and safety-related components. The UFSAR Section 7.2 stated, that the reactor protection system was designed in accordance with Institute of Electrical and Electronic Engineers (IEEE) 279-1968, IEEE Standard Criteria for Protection Systems for Nuclear Power Generating Stations. The criteria in Section 4.7 Control and Protection System Interaction, specified, in part, that where a plant condition that requires protective action can be brought on by a failure or malfunction of the control system, and the same failure or malfunction prevents proper action of a protection system channel or channels designed to protect against the resultant unsafe condition, the remaining portion of the protection system shall independently meet the General Functional Requirement for precision and reliability (Section 4.1), and the Single Failure Criterion (Section 4.2).

The calculation, PTN-BFJE-91-019, concluded that coordination existed between all the electrical protective devices. The team determined that this conclusion was not supported because the calculation did not consider:

(1) uncertainties for the response protective device as an assembly including current transformers and other components in the loop etc., including the tolerances allowed in calibration procedures: (2)asymmetrical short circuit currents that would occur at the inception of a fault; and (3)the responses of overcurrent relays in the range of 100 to 115% of their amp setting.

The team determined that if a downstream fault was postulated on the non-safety related control system components, the lack of coordination could cause the safety related switchgears protection devices (lockout relays) to lockout the entire safety related switchgear. This would disable one of the two trains of the protection system components, trip the reactor coolant pumps perturbing the system flows, and trip the reactor. The team determined the remaining portion of the protection system could not meet Section 4.1 and 4.2 of IEEE 279-1968. A single failure in the remaining protection train could prevent it from performing its safety function.

Analysis:

The team determined the failure to verify that the design of control and protection system interactions were in accordance with the specifications of with IEEE 279-1968 Section 4.7, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, failing to verify that faults on control system SSCs (e.g. reactor coolant pumps) downstream of the safety related switchgear would not cause a lockout of the safety-related bus affected its availability and reliability. The team evaluated the finding with Inspection Manual Chapter (IMC) 0609, Att. 4, Initial Characterization of Findings, issued October 7, 2016, for Initiating Events, and IMC 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the findings were a deficiency affecting the design of a mitigating structure, system, or component (SSC),and the SSC maintained their operability or functionality. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, Design Control, required, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Contrary to the above, since March 4, 2004, the licensee failed to provide design control measures for verifying or checking the adequacy of design. Specifically, calculation PTN-BFJE-91-019, AC Emergency Power System Coordination, did not correctly verify that control and protection system interactions would not create the possibility of losing both trains of engineered safety features required to mitigate design basis accidents.

For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2220956 and performed an operability determination, which determined the system was operable, and was performing a reevaluation of the calculation to determine adequate coordination. This violation is identified as NCV 05000250/2017007-01 and 05000251/2017007-01, Inadequate Verification of Electrical Protective Device Selective Coordination.

.2 Failure to Perform Design Verification for Under Frequency Trip of the Main Generator

Breakers

Introduction:

The NRC identified a Green NCV of 10 CFR 50, Appendix B, Criterion III, Design Control, for failure to verify or check the adequacy of design of the under frequency trip feature of the main generator circuit breakers with regard to the effect of its operation on plant stability and the maintenance of critical safety functions.

Description:

UFSAR Section 1.1.4, Regulatory Guide Application, identified that the licensee was committed to Regulatory Guide 1.28, Quality Assurance Program Requirements (Design and Construction), June 1972, and thus to ANSI N45.2-1971, Quality Assurance Program Requirements for Nuclear Power Plants. The standard ANSI N45.2-1971 required that Design control measures shall be applied to verify or check the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Prior to receiving the operating license for Unit 3 in July 1972, the licensee installed a new design feature without submitting the design as part of the original FSAR for licensing review nor later in 1982, as part their evaluation of the site electrical system design for their licensing submittal for General Design Criteria (GDC)17 (Reference: FPL letter L-82-509, November 16, 1982). The UFSAR section 8.1.1 Principal Design Criteria for Electrical Systems, stated, in part, that Turkey Point complied with the requirements of GDC 17. The team determined that the licensee neither verified and validated the as installed design nor evaluated this design feature as part of the safety analysis. The design opened the main generator circuit breakers feeding power to the switchyard in the event of a transmission grid under frequency of 57 Hertz or less. The specification for the design placed the unit in an islanding mode where the main generator provided power to the plant instead of the grid or emergency diesel generators.

The under frequency design was specified on Logic diagrams 5610-T-L1, Sheet 4B, Generator Trip Logic, Revision 8, and 5613-T-L1, Sheet 4A, Generator Trip Logic, Revision 3, which showed under frequency relays UF1, UF2, UF3, and UF4 that trip the main generator output circuit breakers in the event of a frequency less than 57 Hz. Logic diagram 5610-T-L1, Sheet 4C, Generator Trip Logic, Revision 7, stated, regarding these relays, Operation at other than synchronous speed, at load, results in excessive turbine blade stress. Only a limited total lifetime operation is allowed at approximately 57 Hz. The switchyard bkrs [circuit breakers] are opened after 12 seconds but not the field breaker and the unit acts as a house generator. Opening of the main generator circuit breakers would cause the generator load to suddenly drop from full power to the level of the plant loads, approximately 5%, resulting in a 95%

system runback. This would result in the main generator powering plant house loads including the reactor coolant pumps, steam generator feed pumps, and the Class 1E AC loads. The team determined that the UFSAR Section 7.3, Regulating System, specified that the reactor could automatically reduce to approximately 15% power without tripping the turbine and reactor making this unanalyzed under frequency design possible. However, the plants licensing basis only allows a 50% runback, which does not require the reactor to reduce power to 15%.

UFSAR Section 14.1.10, Loss of External Electrical Load, discusses the analysis for a complete loss of load but assumes a turbine and reactor trip at the start of the event. There is no discussion whether the analysis described in 14.1.10 bounds the generator breaker under frequency trip event, which does not involve a trip.

The team determined that the licensee did not perform analysis or testing of this design feature to determine its impact on the plants electrical systems and the design requirements of GDC 17. The GDC specified the design to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies. The team reached their conclusion for the following reasons:

  • AC system degradation would be certain because the under frequency event would be electrically unstable and unpredictable,
  • the buses connected to the auxiliary transformer prevents their subsequent fast transfer to the startup transformer when the instability occurs,
  • the large non- Class 1E loads would continue to operate connected to the safety bus,
  • Class 1E and non- Class 1E loads share a common bus, and
  • the design has never been tested or analyzed
Analysis:

The team determined the failure to perform design verification for the main generator breaker under frequency trip feature, as required by ANSI N45.2, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions. Specifically, opening of the main generator breakers due to an under frequency condition on the offsite power system would cause the generator load to suddenly drop from full power to the level of the plant loads, and there was no verification that plant stability and critical safety functions would be maintained and would cause a loss of offsite power. The team evaluated the finding with Inspection Manual Chapter (IMC) 0609, Att. 4, Initial Characterization of Findings, issued October 7, 2016, for Initiating Events, and IMC 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding met the Support System Initiators screening criteria for requiring a detailed risk evaluation. The team determined that this issue increased the likelihood of the support system initiator loss of offsite power (LOOP). A regional senior risk analyst (SRA) conducted a detailed risk evaluation with a one year exposure and determined the change in core damage frequency was less than 1E-6, which was of very low safety significance (Green). The SRA modelled the effect of the performance deficiency as a potential loss of offsite power without the ability to recover the offsite power. This was based on the assumptions that, given a grid under frequency condition as described by the performance deficiency, all switchyard breakers would trip and lockout, except those feeding the unit auxiliary transformers and would not be recoverable in a timely manner because of the effort needed to reset the lockouts. The dominating sequence, (95% of the change) was an under frequency grid condition combined with failure of all emergency diesel generators (EDGs) leading to a station blackout. If one EDG were not recovered, core damage would result. The team did not assign a cross-cutting aspect because the issue did not reflect current licensee performance.

Enforcement:

10 CFR 50, Appendix B, Criterion III, Design Control, required, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, since July 1972, the licensee failed to provide design control measures for verifying or checking the adequacy of design of the main generator breaker under frequency trip feature. Specifically, the licensee failed to verify or check the adequacy of the design to assure that an under frequency trip of the main generator breakers would not cause an unplanned series of events and conditions leading up to a reactor trip, loss of offsite power, or damage to Class 1E equipment due to frequency transients. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2220874. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-02 and 05000251/2017007-02, Failure to Perform Design Verification for Under Frequency Trip of the Main Generator Breakers.

.3 Failure to Verify the Adequacy of CCW isolation from Supplemental Cooling System

(SCS)

Introduction:

The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the adequacy of design of temperature set points used for isolation of the CCW from the non-safety related SCS during an accident.

Description:

On September 14, 2015, the site completed modification EC 283225 that integrated the newly installed SCS to the CCW system. The SCS must be isolated during an accident to ensure adequate CCW flow to CCW components performing an accident function and to ensure the integrity of the CCW system on potential failure of non-safety related portions of the SCS. The UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968. The criteria specified in Section 4.1 General Functional Requirement, required that the protection system shall, with precision and reliability, automatically initiate appropriate protective action whenever a plant condition monitored by the system reaches a preset level.

The isolation signal used a temperature threshold at SCS discharge of 104oF. The licensee assumed that this temperature would be indication of an accident in progress.

Safety related trip circuitry including cables and temperature switches (TS-254 and TS-2216) facilitated isolation. The team noted that the 104oF setpoint did not ensure that the SCS would be isolated at the beginning of an accident because of the delay for any temperature increase to reach the SCS discharge. In addition, the installation did not account for instrument and loop uncertainty. Given a three year calibration frequency established by the licensee, the instrument uncertainty alone could account for approximately 14oF of uncertainty before isolation would occur. The team determined that interaction between non-safety related and safety related SCS components did not ensure isolation of the CCW system at the onset of applicable accident sequences.

When not isolated, the most limiting failure modes of the SCS chillers could affect the operation of the CCW (i.e. adverse thermal hydraulic conditions or shock). The team noted that accounting for instrument uncertainty was required by NextEra Standard IC-3.17, Instrument Setpoint Methodology for Nuclear Power Plants, and Institute of Electrical and Electronic Engineers (IEEE) 279 Section 4.1.

Analysis:

The failure to verify the SCS would isolate from the CCW at the onset of an accident was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, by not ensuring prompt isolation or adjusting the isolation setpoint to account for instrument uncertainties and temperature lag, the licensee failed to ensure that the SCS loop would be isolated at onset of an accident, which affected the reliability and capability of the CCW system when called upon. The team used IMC 0609 Attachment 4, Initial Characterization of Findings, issued October 7, 2016, for Mitigating Systems, and IMC 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the findings were a deficiency affecting the design of a mitigating structure, system, or component (SSC), and the SSC maintained their operability or functionality. The finding had a cross-cutting aspect in the area of Human Performance because the licensee failed to ensure knowledge transfer to maintain a knowledgeable, technically competent workforce and instill nuclear safety values [H.9].

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, Design Control, stated, in part, that design control measures shall provide for verifying or checking the adequacy of design. Contrary to the above, since September 14, 2015, the licensees design control measures failed to provide for verifying or checking the adequacy of the SCS design to ensure it isolated from CCW at the onset of an accident. Specifically, failing to verify that the CCW was isolated from the SCS at the onset of an accident created the possibility that the CCW would not be able to meet the accident analysis. For immediate corrective actions, the licensee entered this into their corrective action program as AR 02218834, performed an operability determination, which determined the system is operable but non-conforming, and issued EC 289598 to account for uncertainties in the CCW temperature switch setpoint adjustment. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-03 and 05000251/2017007-03, Failure to Verify the Adequacy of CCW isolation from Supplemental Cooling System (SCS).

.4 Failure to Verify the Adequacy of Design for Component Protective Covers

Introduction:

The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the adequacy of design for the non-safety related component protective covers onto safety related equipment.

Description:

On May 7, 1993, the licensee issued specification SPEC-C-013 Installation Guidelines for Miscellaneous Non-System Related Items on Existing Structures. The specification was non-safety related and applied to non-safety related SSCs. On May 16, 1994, engineering evaluation JPN-PTN-SECS-94-018, Revision 2 Engineering Evaluation of Bump Covers for the Reactor Trip Breakers in the Unit 3 & Unit 4 Reactor Control Rod Equipment Room was issued. The engineering evaluation justified the use of the SPEC-C-013 to install the protective covers on Class 1E SSCs. The UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968. The criteria specified in Section 4.3 Quality of Components and Modules, required that components and modules shall be of a quality that is consistent with minimum maintenance requirements and low failure rates, and this quality shall be achieved through the specification of requirements known to promote high quality, such as requirements for design, for manufacturing, and quality control. The criteria specified in Section 4.4 Equipment Qualification, required that type test data or reasonable engineering extrapolation based on test data shall be available to verify that equipment that must operate to provide protection system action will meet, on a continuing basis, the performance requirements determined to be necessary for achieving the system requirements.

The plant used two designs for their protective covers (bump covers) both used non-safety related commercial components. The first design consisted of two pieces of fire treated two by four wood, one on each side of the mechanism to be protected, with a piece of Plexiglas attached to the wood with screws. Velcro attached the wood to the SSC cabinet face. The second design utilized molded Plexiglas with neodymium magnets as the mounting mechanism. These protective covers were installed on Class 1E components, which are protection system components and modules within the scope of IEEE 279-1968.

The team conducted walk downs and observed that the protective covers were installed on trip sensitive Class 1E equipment throughout Units 3 and 4. These included Reactor trip breakers, Class 1E MCCs, Class 1E Load Centers, Fire Panels C286 and C288, Vital Battery Chargers, Vital Inverters, and various other Class 1E 4160Vac switchgear cabinets. On each of three separate walk downs spanning the two weeks spent onsite, the team observed numerous examples where the mounting of the protective covers was degraded. In some cases, the covers were stacked on top of one another and the column of covers was separating from the cabinets. The Velcro and adhesive showed signs of separation (adhesive failure), and the Velcro showed signs of hook and loop connection failure. Falling covers would contact trip sensitive equipment and other degraded covers, which could cause failures of Class 1E components. The team determined that the design and manufacturing processes did not ensure that the commercial components maintained adequate quality nor did the processes ensure that the assembled protective covers would maintain adequate quality on a continuing basis.

The protective covers were not qualified to meet the required performance requirements of maintaining secure mounting on a continuous basis to prevent inadvertent Class 1E component failure. The licensee generated AR 2220750 in their corrective action program to address the potential adverse effect of the degraded protective covers. In addition, the team questioned whether the magnetic field produced by the neodymium magnet covers would interfere with the electrical characteristic of the Class 1E components. Magnetic fields in the presence of large currents could produce physical forces, eddy currents, and inductive heating not evaluated by the licensee. The team determined that these protective covers were not shown to be qualified as required by IEEE 279-1968.

The team determined that the design of the protective covers degraded the quality and qualification of the Class 1E components, on which they were mounted. Title 10 CFR 50, Appendix B criterion III Design Control, required that the design of Class 1E equipment must be verified and checked, and that changes, including field changes, shall be subject to design control measures commensurate with those applied to the original design. The licensee initiated AR 02220993 on August 17, 2017, to address the performance deficiency and removed degraded covers.

Analysis:

The licensees failure to meet the criteria specified in IEEE 279-1968 to maintain the quality and qualification of Class 1E components was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute and of the Initiating Events Cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations.

Specifically, the failure to ensure the quality and qualification of commercial components and assemblies to maintain adequate mounting to Class 1E equipment increased the likelihood of inadvertent component failures, and thus increased the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. The team used IMC 0609 Attachment 4, Initial Characterization of Findings, issued October 7, 2016, for initiating events, and IMC 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding did not cause a reactor trip and the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition (e.g. loss of condenser, loss of feedwater). Because the design of the protective covers was from 1993, the team determined the finding was not indicative of current licensee performance

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, Design Control, required, in part, that design changes, including field changes, shall be subject to design control measures commensurate with those applied to the original design. Contrary to the above, since 1994, the licensee failed to use design control measures commensurate with those applied to the original design for design changes, including field changes.

Specifically, the licensee did not maintain the quality and qualification requirements from IEEE 279-1968 for Class 1E equipment when applying filed changes. Degraded protective covers could fall and trip protection system components challenging the protection system reliability and availability. For immediate corrective actions, the licensee entered this into their corrective action program as AR 2220993 and removed the visibly degraded protective covers. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-04 and 05000251/2017007-04, Failure to Verify the Adequacy of Design for Component Protective Covers.

.5 Failure to adequately perform discharge testing on 3B Battery

Introduction:

The NRC identified a Green NCV of Title 10 CFR Part 50, Appendix B, Criterion XI, Test Control, for the licensees failure to perform surveillance testing on station battery 3B in accordance with the requirements of IEEE 450-1987.

Description:

Surveillance testing requirements for Technical Specification (TS) limiting condition for operation 3.4.8.2, DC Sources, required the verification that station battery 3B be at least equal to or greater than 80% of the manufacturers rating when subjected to a performance discharge test every 5 years. The surveillance testing requirements also required that the frequency of this discharge test be increased to once a year if the battery showed signs of degradation or reached 85% of its expected service life. TS defined the station battery as degraded when the battery capacity drops by more than 10% of rated capacity from its previous average of performance tests or when capacity is below 90% of the manufacturers rating. Surveillance procedure 0-SME-003.15, Station Battery 60 Month Maintenance, Rev. 2, stated that the battery performance test was performed in accordance with IEEE 450-1987. The team noted that section 6.4 of IEEE 450 stated that the performance test be ended when battery terminal voltage reached 105V.

During the review of the previous two performance tests performed for station battery 3B, in 2011 and 2013 respectively, the team identified that both tests were ended based on time and not based on when voltage reached 105Vdc as required by IEEE 450. The team noted that both performance tests were ended at 122 minutes, when voltage was approximately 107V-direct-current (Vdc). The inspectors determined that the failure to end the surveillance test when the station battery terminal voltage reached 105Vdc resulted in an inaccurate battery capacity determination of 101% for station battery 3B. The team also determined that running the test longer until the battery terminal voltage reached 105Vdc would show more capacity for station battery 3B than currently recorded. The team concluded that the failure to perform the surveillance test in accordance with IEEE 450 would create an inaccurate baseline for battery capacity and mask the degradation of the battery on future performance tests that ensure that the battery capacity has not dropped by more than 10% of rated capacity from the average of previous capacity tests. The failure to detect a degraded battery would result in a failure to increase the frequency of performance testing as required by TS 3.4.8.2. The team noted that this deficiency affected the performance tests for all of the licensees other safety-related station batteries.

On August 11, 2017, the licensee entered this issue into their corrective action program as AR 2219948, performed an extent of condition review, and determined that none of the station batteries were currently in a degraded condition. The licensee also placed surveillance procedure 0-SME-003.15 on administrative hold until the corrective actions are completed.

Analysis:

The licensees failure to perform surveillance testing on station battery 3B in accordance with IEEE 450-1987, as required by Title 10 CFR Part 50, Appendix B, Criterion XI, Test Control, was a performance deficiency. The performance deficiency was determined to be more than minor because if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern. Specifically, the performance deficiency could result in masking degradation of the battery on future performance discharge tests and adversely affect the ability to trend when the testing periodicity should be increased to once a year as required by TS. The team used Inspection Manual Chapter (IMC) 0609, Att. 4, Initial Characterization of Findings, issued October 7, 2016, for mitigating systems, and IMC 0609 App. A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was not a deficiency affecting the design or qualification of a mitigating SSC, did not represent a loss of system and/or function, did not represent an actual loss of function of a single train for greater than its TS allowed outage time or two separate safety systems out-of-service for greater than their TS allowed outage time, and did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for greater than 24 hrs. Since the last performance test on station battery 3B was performed in 2013, the team determined the finding was not indicative of current licensee performance.

Enforcement:

Title 10 CFR Part 50, App. B, Criterion XI, Test Control, required in part, a test program be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Section 6.4 of IEEE 450-1987 required performance discharge testing be terminated when battery terminal voltage reached 105Vdc. Contrary to the above, since at least 2011, the licensee failed to incorporate the requirements and acceptance limits contained in IEEE 450-1987 for battery performance discharge testing. Specifically, Surveillance procedure 0-SME-003.15 did not adequately specify that the battery performance discharge test not be terminated until voltage reached 105Vdc. The failure to perform surveillance testing in accordance with IEEE 450-1987 could result in masking degradation of the battery on future capacity tests and adversely affect the ability to trend when the testing periodicity would be required to be increased to once a year as required by TS 3.4.8.2. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2219948 and performed an extent of condition review, which determined that none of the station batteries were currently in a degraded condition, and placed surveillance procedure 0-SME-003.15 on administrative hold until the corrective actions are completed. This violation is being treated as an NCV consistent with Section 2.3.2.a of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-05 and 05000251/2017007-05, Failure to Adequately Perform Discharge Testing on Battery 3B

.6 Failure to verify the adequacy of design for the Emergency Containment Cooler (ECC)

and CCW systems

Introduction:

The NRC identified a Green NCV of Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the ECC unit 4A auto start circuitry would not result in exceeding the thermal limits of the CCW system during a design basis accident. Specifically, the licensee failed to verify that a single active failure of the motor starter auxiliary contacts would not result in exceeding the design basis limits for CCW as described in UFSAR Section 9.3.

Description:

UFSAR Section 6.3 stated that the emergency containment cooling system was designed to remove sufficient heat from the reactor containment following a design basis accident to keep the containment pressure from exceeding design pressure. The system consists of three forced-air cooling units that used the CCW as the heat sink.

UFSAR Section 9.3 stated that to restrict CCW system post-accident temperatures to within acceptable limits, a design basis change remains in effect at expended power uprate (EPU) conditions to limit the maximum number of ECCs automatically starting to no more than two, assuming when only two CCW heat exchangers are in operation.

As a result of the Unit 4 EPU, the licensee performed EC 273226 to ensure that only two ECC units were operable within 60 seconds of a safety injection signal and to ensure that the swing ECC 4A started automatically within one minute of an SI signal given a failure of one of the other two ECC units. The licensee stated in EC 273226 that only two of the containment cooling systems ECCs could operate simultaneously and that the operation of three ECCs was not acceptable because it would result in the transfer of too much heat load to the CCW system, exceeding the CCW design. During the review of the control logic for swing ECC 4A, the team identified the modification introduced the potential for a single failure of an auxiliary motor starter contact to cause the simultaneous operation of all three ECCs units, placing the plant in an unanalyzed condition at the time of identification. The team noted that this condition was also applicable to Unit 3. The licensee performed a prompt operability determination and determined that three ECC fans running would result in a CCW supply temperature of approximately 164ºF, exceeding the design basis temperature of 158.6ºF for the CCW supply as described in UFSAR Section 9.3.2 and UFSAR Table 9.3.1. The team also noted that this left approximately 1ºF of margin for the safety injection pump lube oil cooler, which reduced the available margin by ~80%. UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968, IEEE Standard Criteria for Protection Systems for Nuclear Power Generating Stations.

Criterion 4.5 Channel Integrity, of IEEE 279 required, that all protection system channels shall be designed to maintain necessary functional capability under extremes of conditions, as applicable, relating to environment, energy supply, malfunctions, and accidents.

Analysis:

The failure to ensure the channel integrity of the ECCs and CCW in accordance with IEEE 279, as required by 10 CFR Part 50, Appendix B, Criterion III, Design Control, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, three ECC fans running during a during a design basis accident would result in exceeding the design basis temperature of 158.6 degrees F for the CCW supply and a significant reduction in margin for the SI pump lube oil cooler. The team used Inspection Manual Chapter (IMC)0609, Att. 4, Initial Characterization of Findings, issued October 7, 2016, for mitigating systems, and IMC 0609 App. A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was a deficiency affecting the design of a mitigating structure, system, or component (SSC) and the SSC maintained its operability. Since EC 273226 was completed in 2012, the team determined the finding was not indicative of current licensee performance.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, required in part, that the design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews. Contrary to the above, since 2012, the licensee failed to verify and check the adequacy of the design of the ECC motor starter logic circuitry. Specifically, the failure of an auxiliary contact would result in automatically starting three ECC fans, thus exceeding the design bases temperature limits of the CCW supply system. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2219505, performed a prompt determination of operability, and determined that the CCW system remained operable. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-06 and 05000251/2017007-06, Failure to Verify the Adequacy of Design for the ECC and CCW Systems

.7 Failure to Identify ICW Pipe Corrosion

Introduction:

The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the licensees failure to inspect ICW piping in accordance with license renewal commitments.

Description:

On August 2, 2017, during CCW system walk-downs, the team identified multiple instances of notable corrosion, including approximately 0.25 thick metallic flakes, on unit 4 ICW riser piping to the CCW heat exchanger. The team determined that this corrosion met the deficiency criteria established in licensee procedure 0-ADM-564, Systems/Programs Monitoring.

The team reviewed License Renewal (LR) Basis Document, PTN-ENG-LRAM-00-0042, Systems and Structures Monitoring Program - License Renewal Basis Document, and determined per attachment 11.1, Systems/Component Groups Requiring inspection for License Renewal, outdoor ICW piping susceptible to loss of material due to general corrosion and pitting (external), required visual inspection. Section 5 of the LR Bases stated, in part, that 0-ADM-561, Structures Monitoring Program and 0-ADM-564, Systems/Programs Monitoring have been generated to include those inspections and related attributes required to manage the aging effects identified in the License Renewal Aging Management Reviews and listed in Attachments 11.1 and 11.2.

Inspection requirements were translated into Final Safety Analysis Report section 16.2.15, Existing Programs - Systems and Structures Monitoring, by stating The Systems and Structures Monitoring Program (SSMP) has been enhanced via issuance of procedures 0-ADM-561, "Systems and Structures Monitoring Program", and 0-ADM-564, "Systems/Programs Monitoring." These procedures address inspection requirements to manage certain aging effects in accordance with 10 CFR 54, modifying the scope of specific inspections, and improving documentation requirements.

Procedure 0-ADM-564, section 4.3.7 stated, The following is a list of items [that] shall be used for performing walk-downs for License Renewal scope listed on Attachment 2, System/Component Groups Requiring Inspection for License Renewal. Attachment 2 directly referenced Section 11.1 from the LR Bases document, to identify LR scope.

Section 4.3.7.A stated, For system commodities and components, the parameters monitored include corrosion, flaking, pitting, gouges, cracking, fouling, loss of material, loss of seal, change in material properties by visual inspection of external surfaces for leakage and defects, other surface irregularities, protective coating degradation on select stainless steel pipe welds, leakage at limited locations, and missing parts (LR commitment). Section 4.3.7.G stated Deficiency Criteria: Piping: Any corrosion greater than uniform light surface corrosion (LR commitment).

The team reviewed inspection records for three inspections dated, April 9, 2016; August 8, 2016; and July 5, 2017. The inspectors determined that the license failed to identify any corrosion in excess of the deficiency criteria documented in Procedure 0-ADM-564.

The team determined that this oversight was a failure to meet the requirements to inspect the ICW piping in accordance with license renewal commitment.

Analysis:

The team determined that the failure to meet the requirements to inspect the piping in accordance with license renewal commitments as required by 0-ADM-564, as set forth in FSAR section 16.2.15, and was a performance deficiency. The performance deficiency was determined to be more-than-minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the reliability of systems that respond to initiating events to prevent undesirable consequences. Specifically, unmonitored corrosion affects the reliability of the ICW systems. The team used Inspection Manual Chapter (IMC) 0609, Att. 4, Initial Characterization of Findings, issued October 7, 2016, for mitigating systems, and IMC 0609 App. A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because it did not represent an actual loss of function of one or more non-Tech Spec Trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for >24 hrs.

Specifically, the licensee performed an evaluation of piping thickness at select location and determined that remaining wall thickness did not challenge minimum wall thickness limits or operability limits. The finding had a cross-cutting aspect in the area of Problem Identification and Resolution, Identification, because the licensee failed to implement a corrective action program with a low enough threshold for identifying issues.

Specifically, individuals routinely failed to identify corrosion issues on CCW system area walk downs that exceeded proceduralized acceptance criteria of light surface rust specified in 0-ADM-564, during the July 5, 2017, August 11, 2016, and April 11, 2016 CCW area walk downs.

Enforcement:

Title 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, stated in part that activities affecting quality shall be prescribed by documented instructions and procedures and shall be accomplished in accordance with these instructions and procedures. Final Safety Analysis Report section 16.2.15, Existing Programs - Systems and Structures Monitoring states in part that procedure 0-ADM-564, Systems/Programs Monitoring" address inspection requirements to manage certain aging effects in accordance with 10 CFR 54. Procedure 0-ADM-564, section 4.3.7.G established deficiency criteria for piping as any corrosion greater than light surface corrosion. Contrary to the above, on April 9, 2016, August 11, 2016, and July 5, 2017, the CCW area walk-down inspections Turkey Point failed to accomplish prescribed activities affecting quality in accordance with these instruction and procedures for license renewal scope components. Specifically, On August 2, 2017, the team identified the licensee did not identify corrosion that exceeded the procedures acceptance criteria that was greater than light surface corrosion. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 02218430 and AR 02218437, planned to perform localized corrosion wall thickness measurements to ensure the ICW system remained operable. This violation is being treated as an NCV consistent with Section 2.3.2.a of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-07 and 05000251/2017007-07, Failure to Identify ICW Pipe Corrosion.

.8 Failure to Correct a Non-Conforming Condition Impacting Containment

Introduction:

The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, for the licensees failure to take timely corrective action to maintain the Unit 3 and 4 containment cathodic protection systems. These systems have been non-functional on both units since 2009. The cathodic protection system purpose is to protect the containments interconnected liner, reinforcing bars, and tendon trumplates.

Description:

The team noted that the Unit 3 and Unit 4 containments Cathodic Protection Systems (CPS) were non-functional since approximately 2009. The team reviewed the containments design bases to determine if this affected their long term structural integrity and operational capability. The team determined that the containment design bases described in the UFSAR credited the CPS to protect the containment metallic structures, and that the safety evaluation report, NUREG-1759, dated April 2002, for license renewal required the maintenance of the CPS as a condition of license renewal.

The UFSAR Subsection 5.1.7 Containment Testing specified, in part, the cathodic protection system is designed to protect the interconnected liner, reinforcing bars, and tendon trumplates. In addition, Subsection 8.2.2.1.1.2 Specifics of the Onsite AC Power System described the electrical design of the cathodic protection system, and specified, in part, the metallic portion of the containment to be protected includes the liner, the reinforcing bars and the tendon assemblies.

The safety evaluation report, NUREG-1759, stated, in part, that the licensee submittals did not credit the CPS for aging management for 10 CFR 50.54 License Renewal.

However, in the staff evaluations for the ASME Section Xl, Subsections IWE and IWL Inservice Inspection Programs, Sections 3.9.1.2 and 3.9.1.4, the staff specified, in part, it is the malfunction of cathodic protection system that could give rise to the degradation of the protected safety-related components. In a discussion on April 11, 2001, the applicant emphasized that the procedures for ensuring the effectiveness of the cathodic protection system were available at the plant site for a staff review. In the aging management review inspection during August 20-September 14, 2001, the inspectors verified that the operation procedures for the CPS were available at the plant site and were adequate.

The licensee identified the non-functionality of the CPS, and issued a condition report on the CPS, AR 1920613, in October 2009, as a result of WO 3800925 (Unit 3, 10/2008)and WO 37017321(Unit 4, 02/2009). The AR was closed to the licensees long term aging management program (LTAM), which is not their corrective action program. The degrading effects on the containment structure were not identified or evaluated. As a result of the inspection sample on July 14, 2017, the licensee issued AR 2216534, dated July 24, 2017 and evaluated the affects on the containment structure operability.

Analysis:

The failure to take timely corrective actions to correct a condition adverse to quality was a failure to meet 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, and was a performance deficiency. The performance deficiency was determined to be more than minor, because it is associated with the Design Control attribute of the Barrier Integrity cornerstone and affected the cornerstone objective of maintaining the containment structural integrity and operational capability to provide reasonable assurance that the containment protects the public from radionuclide releases caused by accident or events. Specifically, the failure to implement timely corrective actions to maintain the protection of the containments interconnected liner, reinforcing bars, and tendon trumplates affected the structural integrity and operational capability of the containment structure. The team used IMC 0609 Attachment 4, Initial Characterization of Findings, issued October 7, 2016, for barrier integrity, and IMC 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was not a pressurized thermal shock issue, did not represent an actual open pathway in the physical integrity of the reactor containment, and did not involve an actual reduction in function of hydrogen igniters in the reactor containment. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.

Enforcement:

10 CFR 50, Appendix B, Criterion XVI, Corrective Action, required, in part, that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and non-conformances are promptly identified and corrected. Contrary to the above, since July 2009, the licensee failed to establish measures to assure that this condition adverse to quality was corrected. Specifically, the licensee failed to implement timely corrective actions to maintain the cathodic protection of the containments interconnected liner, reinforcing bars, and tendon trumplates. Allowing the cathodic protection system to remain non-functional could give rise to the degradation of the containment structure. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2216534 and performed a prompt operability determination. The licensee concluded the containment structure was operable but non-conforming and established compensatory measures. The licensee is developing corrective actions to resolve the degraded and nonconforming condition. This violation is being treated as an NCV consistent with Section 2.3.2 of the Enforcement Policy.

This violation is identified as NCV 05000250/2017007-08 and 05000251/2017007-08, Failure to Correct a Non-Conforming Condition Impacting Containment.

.9 Failure to Update the UFSAR with the Latest Information Developed

Introduction:

The NRC identified a SLIV NCV of 10 CFR 71(e), Maintenance of Records, Making of Reports, for the failure to assure that the UFSAR contains the latest information developed, including all changes made in the facility or procedures as described in the UFSAR.

Description:

Procedure LI-AA-101-1003, Updated Final Safety Analysis Report (UFSAR) Revision, Revision 5, Section 4.1, required that the UFSAR be updated for changes made in the facility/procedures as described in the UFSAR. The team found several examples of design features described in the UFSAR associated with the turbine runback design features that were not installed or were removed by plant modifications.

UFSAR section 14.1.10 states that the loss of external electrical load may result from an abnormal increase in network frequency, which would cause a rapid large load reduction by the action of the turbine control. However, there is no design feature that would initiate this sequence of events as a result of a network over frequency condition.

This section further states that, following opening of the main breaker from the generator, offsite power is available for the continued operation of plant components such as the reactor coolant pumps. However, the design is such that opening of the main breaker from the generator results in blocking of automatic transfer of the 4160V buses to offsite power, which would prevent continued operation of plant components from offsite power. Blocking of the automatic transfer is accomplished by time delay relays set for 0.167 seconds, such as the 162/3A2 relay shown on drawing 5613-E-28, Sheet 1A, Electrical Auxiliaries, Auxiliary Transformer Breaker 3AA02, Revision 7.

On February 3, 1993, the site issued PCM 92-181, Revision 1, which eliminated automatic turbine runback for a dropped rod or reactor axial flux imbalance. However, the licensee failed to update UFSAR Section 1.4.6 to reflect the removal of this feature.

On October 5, 1993, the site issued PCM 93-005, Revision 0, which eliminated automatic turbine runback for reactor overpower and over temperature. However, the licensee failed to update UFSAR Sections 7.2.1 and 7.7 to reflect the removal of this feature.

On December 23, 2011, the site issued EC-246849, Revision 1, which added an automatic turbine runback feature that responds to various losses of secondary system equipment. However, the licensee failed to update the UFSAR to describe this feature.

Analysis:

The team determined the failure to update the UFSAR in accordance with procedure LI-AA-101-1003 was a performance deficiency. The NRC determined this violation was associated with a minor performance deficiency in accordance with the screening criteria in IMC 612 Appendix E, Examples of Minor Issues. Because the failure to update the UFSAR impacted the NRCs ability to perform its regulatory process, the team evaluated the violation using the traditional enforcement process.

The team determined that this met the criteria for a SLIV violation because not accurately describing turbine runback design features in the UFSAR could have a material impact on licensed activities, and met the SLIV violation criteria in 6.1.d.3 of the NRC Enforcement Policy. The violation represented a failure to update the UFSAR as required by Title 10 Code of Federal Regulations Part 50.71(e), but the lack of up-to-date information has not resulted in any unacceptable change to the facility or procedures. Cross-cutting aspects are not assigned to traditional enforcement violations.

Enforcement:

10 CFR 50.71(e) stated, in part, that the UFSAR must contain the latest information developed. Contrary to the above, since February 1993, the licensee failed to update the UFSAR with the latest information developed for turbine runback design.

Specifically, the UFSAR did not contain the latest information developed regarding turbine runback associated with grid over frequency, reactor axial flux imbalance, reactor unsafe operating conditions, and losses of secondary system equipment. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2218695 to update the UFSAR. This violation is SL-IV and is being treated as an NCV, consistent with Section 2.3.2.(a) of the NRC Enforcement Policy. This violation is identified as NCV 05000250/2017007-09 and 05000251/2017007-09, Failure to Update the UFSAR with the Latest Information Developed.

.10 Potential failure of 125 Vdc Bus 3B Class 1E components

Introduction:

The team identified an unresolved item pertaining to the verification of the integrity of Class 1E components on DC Bus 3B in accordance with the requirements of IEEE 279-1968.

Description:

UFSAR Section 8.2.2.3.1 stated that the emergency power for vital instrumentation and controls is supplied by a station DC power system which contains five safety related 125Vdc batteries and four DC distribution panels. 125 Vdc distribution panel 3B supplies safety related power to several safety-related equipment including sequencers, reactor trip switchgear, inverter 3Y06, and control power to 480Vac load centers 3B and 3D and 4160 Vac switchgears 3AB01 and 4AB20. UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968. Section 4.5 of IEEE 279-1968, Channel Integrity, requires all protection system channels be designed to maintain necessary functional capability under extremes of conditions relating to malfunctions. During the review of calculation 5177-265-EG-22, Circuit Breaker/Fuse Coordination Study, Rev. 8, the team questioned if there were instances where class 1E cables associated with DC Bus 3B (3D23) would not be adequately protected given a short circuit on the load side of the breakers. The failure to ensure the Class 1E protective devices would not allow the maximum available short circuit to permanently damage cabling to safety-related equipment associated with DC Bus 3B could result in additional loss of Class 1E equipment. Unresolved Item (URI)05000250/2017007-01 and 05000251/2017007-01, Potential failure of 125 Vdc Bus 3B Class 1E components, ) is opened for additional review to determine if the Class 1E cables on DC Bus 3B can withstand the maximum possible short circuit and to determine if a performance deficiency exists.

.3 Operating Experience

a. Inspection Scope

The team reviewed one operating experience issues for applicability at the Turkey Point Nuclear Plant. The team performed an independent review for these issues and, where applicable, assessed the licensees evaluation and disposition of each item. The issues that received a detailed review by the team included:

b. Findings

No findings of significance were identified

OTHER ACTIVITIES

4OA5 Other Activities

.1 (Closed) Unresolved Item (URI) URI 05000250, 251/2017008-04, Potential Inadequate

Design Control of Current Limiting Reactor.

a. Inspection Scope

The URI was documented on May 12, 2017, in NRC reactive inspection report 05000250/2017008 and 05000251/2017008. The URI was opened in order to review the design and configuration of the reactor coil located inside the 3A 4kV switchgear following the completion of the licensees root cause evaluation. This was to determine whether any performance deficiencies exist in the area of design control. The potential concern with the design and installation inside the 3A 4kV switchgear was with exposed incoming and outgoing 4kV bussing. The 3A 4kV switchgear had thermoplastic insulated bussing throughout the gear except at the reactor coil.

The team reviewed the design layout drawings, photographs of the interior of switchgear 3A, design specification, and industry quality standards to determine if adequate clearances were used in the design and installation of the reactor coil inside of the switchgear. The team reviewed American National Standard Institute (ANSI) C37.32-2002, American National Standard for High Voltage Switches, Bus Supports, and Accessories Schedules of Preferred Ratings, Construction Guidelines, and Specifications, which specified clearance requirements for phase to phase and phase to ground spacing. From the documentation reviewed, the team did not identify any discrepancies between the design of switchgear 3A and the specified clearance requirements, and therefore, no performance deficiency was identified.

b. Findings

No findings of significance were identified; URI 05000250, 251/2017008-04 is closed.

4OA6 Meetings, Including Exit

On August 18, 2017, the team presented the inspection results to Mr. Stamp and other members of the licensees staff. On September 28, 2017, a re-exit meeting was conducted via teleconference to present the final inspection results to Mr. Summers and other members of the licensees staff. Proprietary information that was reviewed during the inspection was returned to the licensee or destroyed in accordance with prescribed controls.

ATTACHMENT:

SUPPLEMENTARY INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

P. Barnes, System Engineering Manager
D. Barrow, Maintenance Director
H. Benitez, Engineering Team Lead
O. Carol, System Engineer
C. Cashwell, Training Manager
P. Czaya, Licensing Engineer
R. De La Torre, Electrical Design Engineer
M. Guth, Licensing Manager
G. Melin, Operations Director
J. Pallin, Engineering Site Director
C. Rossi, Nuclear Assurance Supervisor
B. Stamp, Plant General Manager
R. Tomonto, Design Engineering Manager
J. Vives, Electrical Design Supervisor

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000250, 251/2017007-01 URI Potential failure of 125 Vdc Bus 3B Class 1E components (Section 1R21.2.b.10)

Closed

05000250, 251/2017008-04 URI Potential Inadequate Design Control of Current Limiting Reactor (Section 4OA5.1)

Opened &

Closed

05000250, 251/2017008-04 NCV Inadequate Verification of Electrical Protective Device Selective Coordination (Section 1R21.2.b.1)
05000250, 251/2017007-02 NCV Failure to Perform Design Verification for Under Frequency Trip of the Main Generator Breakers (Section 1R21.2.b.2)
05000250, 251/2017007-03 NCV Failure to Verify the Adequacy of CCW isolation from Supplemental Cooling System (SCS)

(Section 1R21.2.b.3)

05000250, 251/2017007-04 NCV Failure to Verify the Adequacy of Design for Component Protective Covers (Section 1R21.2.b.4)
05000250, 251/2017007-05 NCV Failure to Adequately Perform Discharge Testing on Battery 3B (Section 1R21.2.b.5)
05000250, 251/2017007-06 NCV Failure to Verify the Adequacy of Design for the ECC and CCW Systems (Section 1R21.2.b.6)
05000250, 251/2017007-07 NCV Failure to Identify ICW Pipe Corrosion (Section 1R21.2.b.7)
05000250, 251/2017007-08 NCV Failure to Correct a Non-Conforming Condition Impacting Containment (Section 1R21.2.b.8)
05000250, 251/2017007-09 SLIV Failure to Update the UFSAR with the Latest Information Developed (Section 1R21.2.b.9)

LIST OF DOCUMENTS REVIEWED

Retrieved from "https://kanterella.com/w/index.php?title=IR_05000250/2017007&oldid=2281885"