IR 05000346/2016001

NRC Integrated Inspection Report 05000346/2016001, January 1, 2016, Through March 31, 2016, and Assessment Follow-up Letter

ML16118A435
Person / Time
Site:	Davis Besse
Issue date:	04/26/2016
From:	Jamnes Cameron Reactor Projects Region 3 Branch 4
To:	Boles B FirstEnergy Nuclear Operating Co
References
IR 2016001
Download: ML16118A435 (59)

Text

UNITED STATES ril 26, 2016

SUBJECT:

DAVIS-BESSE NUCLEAR POWER STATION NRC INTEGRATED INSPECTION REPORT 05000346/2016001 AND ASSESSMENT FOLLOWUP LETTER

Dear Mr. Boles:

On March 31, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed an integrated inspection at your Davis-Besse Nuclear Power Station. The enclosed report documents the results of this inspection, which were discussed on April 5, 2016, with Mr. Doug Saltz, the General Plant Manager, and other members of your staff.

Based on the results of this inspection, the NRC has identified four issues that were evaluated under the risk significance determination process as having very low safety significance (Green). The NRC has also determined that violations are associated with two of these issues.

Additionally, a licensee-identified violation is listed in Section 4OA7 of this report. These violations are being treated as Non-Cited Violations (NCVs), consistent with Section 2.3.2 of the Enforcement Policy. These NCVs are described in the subject inspection report.

The NRCs review of Davis-Besse performance identified that the Unplanned SCRAMS with Complications performance indicator has crossed the green-to-white threshold, effective the end of the first quarter of 2016. This was due to one trip with complications in the second quarter of 2015 and one trip with complications in the first quarter of 2016.

The NRC determined the performance at Davis-Besse was previously determined to be in the Regulatory Response Column of the Reactor Oversight Process Action Matrix beginning in the fourth quarter of 2015 due to one or more greater-than-green Security Cornerstone inputs as described in our March 2, 2016, Annual Assessment letter. The performance at Davis-Bess remains in the Regulatory Response Column with the addition of the White input for the Unplanned SCRAMS with Complications performance indicator.

Therefore, in addition to ROP baseline inspections, the NRC plans to conduct a supplemental inspection in accordance with Inspection Procedure 95001, Supplemental Inspection for One or Two White Inputs in a Strategic Performance Area, to be scheduled upon your notification to us that you are ready for that inspection. Your notification should specifically state which input (or both, if applicable) you are ready for the NRC to inspect. The purpose of the inspection is to provide assurance that: (1) the root causes and contributing causes of risk-significant performance issues are understood; (2) the extent of condition and extent of cause of risk-significant performance issues are identified; and (3) your corrective actions for risk-significant performance issues are sufficient to address the root and contributing causes and prevent recurrent.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to: (1) the Regional Administrator, Region III; (2) the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and (3) the NRC Resident Inspectors Office at the Davis-Besse Nuclear Power Station.

In addition, if you disagree with the cross-cutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region III, and the NRC Resident Inspectors Office at the Davis-Besse Nuclear Power Station.

In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records System (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA Karla Stoedter for/

Jamnes L. Cameron, Chief Branch 4 Division of Reactor Projects Docket No. 50-346 License No. NPF-3

Enclosure:

IR 05000346/2016001

REGION III==

Docket No: 50-346 License No: NPF-3 Report No: 05000346/2016001 Licensee: FirstEnergy Nuclear Operating Company (FENOC)

Facility: Davis-Besse Nuclear Power Station Location: Oak Harbor, OH Dates: January 1, 2016, through March 31, 2016 Inspectors: D. Kimble, Senior Resident Inspector T. Briley, Resident Inspector L. Alvarado, Inspector-in-Training N. Valos, Senior Reactor Analyst Approved by: J. Cameron, Chief Branch 4 Division of Reactor Projects Enclosure

SUMMARY

Inspection Report 05000346/2016001; 1/1/16-3/31/16; Davis-Besse Nuclear Power Station;

Maintenance Effectiveness; Follow-Up of Events and Notices of Enforcement Discretion.

This report covers a 3-month period of inspection by resident inspectors and announced baseline inspections by regional inspectors. Four Green findings were identified. Two of the findings were considered non-cited violations (NCVs) of NRC regulations. The significance of inspection findings is indicated by their color (i.e., greater than Green, or Green, White,

Yellow, Red) and determined using IMC 0609, Significance Determination Process dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310, Aspects Within the Cross-Cutting Areas effective date December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy dated February 4, 2015. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process Revision 5, dated February 201

NRC-Identified

and Self-Revealed Findings

Cornerstone: Mitigating Systems

Green.

A self-revealed finding of very low safety significance (Green), and an associated NCV of Title 10, Code of Federal Regulations (CFR), Part 50, Appendix B,

Criterion V, Instructions, Procedures, and Drawings, were identified for the licensees failure to incorporate applicable manufacturers limits into the operating procedures and instructions for the service water (SW) outlet isolation/throttle valves for Component Cooling Water (CCW) Heat Exchanger (HX) Nos. 1, 2, and 3 (SW36, SW38, and SW37).

Specifically, the licensees procedural guidance for the operation of these valves allowed them to be throttled beyond the manufacturers recommended limits, and repeated operation of the SW37 valve in this manner beyond its design contributed to its failure.

This issue was entered into the licensees corrective action program (CAP). Corrective actions by the licensee included repair of the SW37 valve.

This finding was of more than minor safety significance because it affected the attributes of design control and procedure quality of the Mitigating Systems cornerstone of reactor safety, and adversely impacted the cornerstone objective of ensuring the availability, reliability, and capability of the units CCW system. Specifically, the inspectors determined that the licensees failure to have incorporated the applicable design limits for SW37 throttle position and differential pressure across the valve into applicable operating procedures contributed to the degradation and ultimate inoperability of the valve. The finding was determined to be of very low safety significance since the finding did not result in a loss of operability of any system or component. The inspectors determined that the finding had a cross-cutting aspect in the area of human performance. The inspectors assigned the cross cutting aspect of Design Margins to the finding because the licensee had failed to ensure that the safety related SW37 butterfly valve was operated and maintained well within the manufacturers design limits.

(H.6) (Section 1R12.1)

Green.

A self-revealed finding of very low safety significance (Green) was identified for the licensees failure to include an adequate bench check for a replacement integrated control system (ICS) module that was installed into the system during the plants 2014 refueling outage (RFO) into the work package instructions for that activity. Specifically, a defeat switch on the replacement Module 5-2-8 for the ICS rapid feedwater reduction (RFR) circuit installed as preventative maintenance during the plants 18th RFO was incorrectly wired and not detected during pre-installation checks. The incorrectly wired module prevented the ICS RFR function from occurring during the unit trip on January 29, 2016, which contributed to the Steam Generator (SG) No. 1 high level condition and the resultant steam and feedwater rupture control system (SFRCS)actuation. This issue was entered into the licensees CAP. Corrective actions taken by the licensee included replacement of ICS Module 5-2-8 with a spare properly configured for the RFR defeat switch function. Additionally, a proper data package to enable bench checking ICS Module 5-2-8 to verify the capability of the module to perform its intended function was created. The licensee also created training and lessons learned from this event.

This finding was of more than minor safety significance because it affected the design control and procedure quality attributes of the Mitigating Systems cornerstone of reactor safety, and adversely impacted the cornerstone objective of ensuring the availability, reliability, and capability of the units main feedwater (MFW) system and main condenser for decay heat removal. The finding was determined to be of very low safety significance because it did not represent a deficiency affecting the design or qualification of a mitigating system, structure, or component (SSC); it did not, in and of itself, represent a loss of system and/or function; it did not represent an actual loss of function of at least a single train for greater than its Technical Specification (TS) allowed outage time, or two separate safety systems being out-of-service for greater than their TS allowed outage times; and it did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety significant in accordance with the licensees maintenance rule program. The inspectors determined that the finding had a cross-cutting aspect in the area of human performance. The inspectors assigned the cross-cutting aspect of Documentation to the finding because the licensee had failed to ensure that the instructions and other work package guidance available to maintenance personnel performing the ICS Module 5-2-8 replacement had contained provisions for an adequate bench check of the module prior to its installation. (H.7) (Section 4OA3.1)

Green.

A self-revealed finding of very low safety significance (Green) was identified for the licensees failure to implement a technically correct software change associated with the SG / Reactor Demand ICS control station. Specifically, a known logic error within the plants ICS would cause the SG / Reactor Demand control station to trip to manual from automatic coincident with a reactor trip. The licensee had instituted compensatory operator actions for this condition, but removed these actions in December 2015 when they implemented a software change to rectify the problem. However, the corrective actions were inadequate and the SG / Reactor Demand ICS control station unexpectedly tripped to manual from automatic when the unit tripped on January 29, 2016. The unexpected control station mode of operation change, combined with the absence of any compensatory operator actions, contributed to the SG No. 1 high level condition and the resultant SFRCS actuation. This issue was entered into the licensees CAP. Corrective actions taken by the licensee included initiating work on a new software change to rectify the issue of the SG / Reactor Demand ICS control station tripping from automatic to manual coincident with a reactor trip; reestablishing the operator workaround and associated compensatory actions for control room operators; and revising applicable procedures to incorporate current industry standards for controlling software life cycle changes to certain categories of software that interface with plant systems.

This finding was of more than minor safety significance because it affected the design control and procedure quality attributes of the Mitigating Systems cornerstone of reactor safety and adversely impacted the cornerstone objective of ensuring the availability, reliability, and capability of the units MFW system and main condenser for decay heat removal. The finding was determined to be of very low safety significance because it did not represent a deficiency affecting the design or qualification of a mitigating SSC; it did not, in and of itself, represent a loss of system and/or function; it did not represent an actual loss of function of at least a single train for greater than its TS allowed outage time, or two separate safety systems being out-of-service for greater than their TS allowed outage times; and it did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety significant in accordance with the licensees maintenance rule program. The inspectors determined that the finding had a cross-cutting aspect in the area of problem identification and resolution. The inspectors assigned the cross-cutting aspect of Evaluation to the finding because the licensee had failed to thoroughly evaluate the issue of the SG / Reactor Demand ICS control station unexpectedly tripping from automatic to manual to ensure that the software change intended to resolve the issue actually addressed its cause. (P.2) (Section 4OA3.1)

Green.

A self-revealed finding of very low safety significance (Green), and an associated NCV of TS 5.4.1(a) were identified for the licensees failure to establish and implement adequate procedural guidance for restoring MFW following a reactor trip.

Specifically, the guidance in licensee procedure DB-OP-06910, Trip Recovery Procedure, for restoring MFW to the SGs using the motor-driven feedwater pump (MDFP) did not ensure that the MFW piping had been sufficiently re-pressurized prior to opening the MFW to SG isolation valves. This lack of satisfactory procedural guidance allowed control room operators to prematurely open the MFW to SG No. 1 isolation valve, which resulted in a SFRCS actuation on the reverse delta pressure (P) function.

This issue was entered into the licensees CAP. Corrective actions planned by the licensee included changes to licensee procedure DB-OP-06910, Trip Recovery Procedure, to ensure that MFW header pressure is greater that SG pressure prior to opening the MFW to SG isolation valves.

This finding was of more than minor safety significance because it affected the design control and procedure quality attributes of the Mitigating Systems cornerstone of reactor safety, and adversely impacted the cornerstone objective of ensuring the availability, reliability, and capability of the units MFW system and main condenser for decay heat removal. The finding was determined to be of very low safety significance based on the results of a detailed risk evaluation conducted by the NRC Region III Senior Reactor Analyst (SRA). The inspectors determined that the finding had a cross-cutting aspect in the area of human performance. The inspectors assigned the cross-cutting aspect of Resources to the finding because the licensee had failed to ensure that the procedural instructions and guidance available to plant operators restoring MFW during reactor trip recovery actions took into account all relevant technical details (e.g., the differences between MFW piping runs, the amount of time needed to re-pressurize MFW piping, etc.) (H.1) (Section 4OA3.2)

Licensee-Identified Violation

Cornerstone: Barrier Integrity

• A violation of very low safety significance that was identified by the licensee has been reviewed by the NRC. Corrective actions taken or planned by the licensee have been entered into the licensees CAP. This violation and CAP tracking numbers are listed in Section 4OA7 of this report.

REPORT DETAILS

Summary of Plant Status

The unit began the inspection period operating at full power. While operating at full power on January 29, 2016, the reactor tripped during normal periodic nuclear instrument calibrations due to a blown fuse in the reactor protection system (RPS); the trip was complicated by the automatic isolation of the steam generators (see Section 4OA3.1). Following a brief forced maintenance outage to complete repairs, the unit was restarted and the reactor made critical on January 31, 2016 (see Section 1R20.2). The main generator was synchronized to the electrical power grid on February 2, 2016. The unit returned to operation at full power on February 5, 2016, and almost immediately entered end-of-cycle power coastdown operations.

On March 26, 2016, the unit shut down and began the plants 19th refueling outage (see Section 1R20.1).

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R04 Equipment Alignment

.1 Quarterly Partial System Alignment Verifications

a. Inspection Scope

The inspectors performed partial system physical alignment verifications of the following risk-significant systems:

• High Pressure Injection (HPI) Train No. 2 during the period when HPI Train No. 1 was out-of-service for planned maintenance during the week ending January 16, 2016;

• Low Pressure Injection (LPI) Train No. 1 during the period when LPI Train No. 2 was out-of-service for planned maintenance during the week ending January 23, 2016;

• The motor-driven feedwater pump (MDFP) when Auxiliary Feedwater (AFW)

Train No. 2 was out-of-service for planned surveillance testing during the week ending January 30, 2016; and

• Emergency Diesel Generator (EDG) No. 2 during the period when EDG No. 1 was out-of-service for planned surveillance testing during the week ending March 12, 2016.

The inspectors selected these systems based on their risk significance relative to the reactor safety cornerstones at the time they were inspected. The inspectors attempted to identify any discrepancies that could impact the function of the system, and therefore, potentially increase risk. The inspectors reviewed applicable operating procedures, system diagrams, Updated Safety Analysis Report (USAR), Technical Specification (TS)requirements, outstanding work orders (WOs), condition reports (CRs), and the impact of ongoing work activities on redundant trains of equipment in order to identify conditions that could have rendered the systems incapable of performing their intended functions.

The inspectors also walked down accessible portions of the systems to verify system components and support equipment were aligned correctly and operable. The inspectors examined the material condition of the components and observed operating parameters of equipment to verify that there were no obvious deficiencies. The inspectors also verified that the licensee had properly identified and resolved equipment alignment problems that could cause initiating events or impact the capability of mitigating systems or barriers and entered them into the Corrective Action Program (CAP) with the appropriate significance characterization. Documents reviewed are listed in the Attachment to this report.

These activities by the inspectors constituted four partial system alignment verification inspection samples as defined in IP 71111.04-05.

b. Findings

No findings were identified.

1R05 Fire Protection

.1 Quarterly Fire Protection Zone Inspections

a. Inspection Scope

The inspectors conducted fire protection zone inspection tours which were focused on availability, accessibility, and the condition of firefighting equipment in the following risk-significant plant areas:

• Cable Spreading Room; Elevation 613' 6 (Room 422A-Fire Area DD) during the weeks ending January 16, 2016, through February 27, 2016;

• Emergency Feedwater Building Construction Zone; Elevation 585' during the week ending March 12, 2016;

• No. 1 Mechanical Penetration Room and Pipeway Area; Elevation 565 (Rooms 202 and 208-Fire Area AB) during the week ending March 19, 2016; and

• Component Cooling Water (CCW) Heat Exchanger (HX) and Pump Room; Elevation 585 (Room 328-Fire Area T) during the week ending March 19, 2016.

• The inspectors reviewed areas to assess if the licensee had implemented a fire protection program that adequately controlled combustibles and ignition sources within the plant, effectively maintained fire detection and suppression capability, maintained passive fire protection features in good material condition, and implemented adequate compensatory measures for out-of-service, degraded or inoperable fire protection equipment, systems, or features in accordance with the licensees fire plan. The inspectors selected fire areas based on their overall contribution to internal fire risk as documented in the plants Individual Plant Examination of External Events with later additional insights, their potential to impact equipment which could initiate or mitigate a plant transient, or their impact on the plants ability to respond to a security event. The inspectors verified that fire hoses and extinguishers were in their designated locations and available for immediate use; that fire detectors and sprinklers were unobstructed; that transient material loading was within the analyzed limits; and fire doors, dampers, and penetration seals appeared to be in satisfactory condition. The inspectors also verified that minor issues identified during the inspection were entered into the licensees CAP. Documents reviewed are listed in the Attachment to this report.

These activities constituted four quarterly fire protection zone inspection tour samples as defined in IP 71111.05-05.

b. Findings

No findings were identified.

.2 Annual Fire Protection Drill Observation

a. Inspection Scope

The inspectors observed the licensees fire brigade respond to a simulated Class 'C' electrical fire associated with a heater drain pump in the station's turbine building on January 24, 2016. While the fire brigade was alerted to the possibility of a drill during their shift, the exact time of the drill and the nature and location of the simulated fire were unannounced. Based on their observations, the inspectors evaluated the readiness of the station's fire brigade to fight fires. The inspectors verified that the licensee staff identified deficiencies, openly discussed them in a self-critical manner during the drill debrief, and took appropriate corrective actions. Specific attributes evaluated included, but were not limited to:

• The proper wearing of turnout gear and self-contained breathing apparatus;

• The proper use and layout of fire hoses;

• The employment of appropriate firefighting techniques;

• That sufficient firefighting equipment was brought to the scene;

• The effectiveness of fire brigade leader communications, as well as command and control;

• The search for victims and propagation of the fire into other plant areas;

• Smoke removal operations;

• The utilization of pre-planned strategies;

• The adherence to the pre-planned drill scenario; and

• The satisfactory completion of the drill objectives.

Documents reviewed are listed in the Attachment to this report.

These activities constituted a single annual fire protection drill inspection sample as defined in IP 71111.05-05.

b. Findings

No findings were identified.

1R06 Flood Protection Measures

.1 Underground Bunkers/Manholes

a. Inspection Scope

During the weeks ending January 9, 2016, through March 31, 2016, the inspectors conducted a review of underground bunkers/manholes subject to flooding that contained electrical cables. The inspectors reviews included the following underground bunkers/manholes subject to flooding

• Electrical Manhole 3005; and

• Electrical Manhole 3045.

The inspectors checked for submerged cables, that splices were intact, and that appropriate cable support structures were in place. In those areas where dewatering devices were used, such as sump pumps, the inspectors verified that the devices were functional and that any level alarm circuits were set appropriately to ensure that the cables would not be submerged. In those areas without dewatering devices, the inspectors verified that drainage of the area was available, or that the cables were qualified for submergence conditions. The inspectors also reviewed the licensees corrective action documents with respect to past submerged cable issues to verify the adequacy of the corrective actions. Specific documents reviewed during this inspection are listed in the Attachment to this report.

The inspectors reviews of these underground bunkers/manholes constituted a single inspection sample as defined in IP 71111.06-05.

b. Findings

No findings were identified.

1R11 Licensed Operator Requalification Program

.1 Resident Inspector Quarterly Review of Licensed Operator Simulator Training

a. Inspection Scope

On March 23, 2016, the inspectors observed a crew of licensed operators in the plants simulator during training scenarios associated with the upcoming unit shutdown and entry into refueling outage (RFO) operations. The inspectors verified that operator performance was adequate, evaluators were identifying and documenting crew performance problems, and that training was being conducted in accordance with licensee procedures. In addition, the inspectors verified that the licensees personnel were observing NRC examination security protocols, as applicable. The inspectors evaluated the following areas:

• Licensed operator performance;

• The clarity and formality of communications;

• The ability of the crew to take timely and conservative actions;

• The crews prioritization, interpretation, and verification of annunciator alarms;

• The correct use and implementation of abnormal and emergency procedures by the crew;

• Control board manipulations;

• The oversight and direction provided by licensed Senior Reactor Operators (SROs); and

• The ability of the crew to identify and implement appropriate TS actions and Emergency Plan (EP) actions and notifications, as applicable.

The crews performance in these areas was compared to pre-established operator action expectations and successful critical task completion requirements. Documents reviewed are listed in the Attachment to this report.

These observations and activities by the inspectors constituted a single quarterly licensed operator requalification program simulator training inspection sample as defined in IP 71111.11-05.

b. Findings

No findings were identified.

.2 Resident Inspector Quarterly Observation of Control Room Activities

a. Inspection Scope

During the course of the inspection period, the inspectors performed several observations of licensed operator performance in the plants control room to verify that operator performance was adequate and that plant evolutions were being conducted in accordance with approved plant procedures. Specific activities observed that involved a heightened tempo of activities or periods of elevated risk included, but were not limited to:

• End-of-cycle axial power shaping rod withdrawals during the weeks ending January 9, 2016, and January 16, 2016;

• Post trip plant stabilization and decay heat removal operations following a reactor trip with steam and feedwater rupture control system (SFRCS) actuation on January 29, 2016;

• Transition to main feedwater (MFW) operations from AFW following SFRCS actuation on January 30, 2016;

• Reactor startup and approach to criticality following a forced maintenance outage on January 31, 2016;

• Low power reactor operations in support of balance of plant startup following a forced maintenance outage on February 1, 2016;

• Main turbine startup and main electrical generator synchronization to the grid on February 2, 2016;

• Unit shutdown and cooldown activities associated with entry into the plants 19th RFO during the period from March 25, 2016, through March 27, 2016; and

• Main turbine overspeed trip testing following removal of the main electrical generator from the grid on March 26, 2016.

• The inspectors evaluated the following areas during the course of the control room observations:

• Licensed operator performance;

• The clarity and formality of communications;

• The ability of the crew to take timely and conservative actions;

• The crews prioritization, interpretation, and verification of annunciator alarms;

• The correct use and implementation of normal operating, annunciator alarm response, and abnormal operating procedures by the crew;

• Control board manipulations;

• The oversight and direction provided by on-watch SROs and plant management personnel; and

• The ability of the crew to identify and implement appropriate TS actions and notifications.

The crews performance in these areas was compared to pre-established operator action expectations and successful critical task completion requirements. Documents reviewed are listed in the Attachment to this report.

These observation activities by the inspectors of operator performance in the stations control room constituted a single quarterly inspection sample as defined in IP 71111.11-05.

b. Findings

No findings were identified.

1R12 Maintenance Effectiveness

.1 Routine Quarterly Evaluations

a. Inspection Scope

The inspectors evaluated degraded performance issues involving the following risk-significant systems and components:

• The plant computer and safety parameter display system; and

• The service water (SW) outlet isolation/throttle valves for CCW HX Nos. 1, 2, and 3 (SW36, SW37, and SW38).

The inspectors reviewed events such as where ineffective equipment maintenance had or could have resulted in valid or invalid automatic actuations of engineered safeguards systems and independently verified the licensee's actions to address system performance or condition problems in terms of the following:

• implementing appropriate work practices;

• identifying and addressing common cause failures;

• scoping of systems in accordance with 10 CFR 50.65(b) of the maintenance rule;

• characterizing system reliability issues for performance;

• charging unavailability for performance;

• trending key parameters for condition monitoring;

• ensuring 10 CFR 50.65(a)(1) or (a)(2) classification or re-classification; and

• verifying appropriate performance criteria for systems, structures, and components (SSCs)/functions classified as (a)(2), or appropriate and adequate goals and corrective actions for systems classified as (a)(1).

The inspectors assessed performance issues with respect to the reliability, availability, and condition monitoring of the system. In addition, the inspectors verified maintenance effectiveness issues were entered into the CAP with the appropriate significance characterization.

For the inspection sample related to SW36, SW38, and SW37, the inspectors also performed a quality control review for the recent maintenance activities associated with these valves, as discussed in IP 71111.12, Section 02.02. This sample, together with the inspection samples documented in Sections 1R13, 1R15, and 1R19 of this report related to SW37 constituted a vertical slice review as discussed in IP 71111.12-03.

Documents reviewed are listed in the Attachment to this report.

These maintenance effectiveness review activities conducted by the inspectors constituted two inspection samples as defined in IP 71111.12-05.

b. Findings

(1) Operation of Safety-Related Butterfly Valves in a Manner Beyond Design Introduction A self-revealed finding of very low safety significance (Green) and an associated NCV of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, were identified for the licensees failure to incorporate applicable manufacturers limits into the operating procedures and instructions for the SW outlet isolation/throttle valves for CCW HX Nos. 1, 2, and 3 (SW36, SW38, and SW37). Specifically, the licensees procedural guidance for the operation of these valves allowed them to be throttled beyond the manufacturers recommended limits, and repeated operation of the SW37 valve in this manner beyond its design contributed to its failure.

Description During colder months of the year demand on the SW system is reduced. The reduced SW flow requirements tend to cause SW header pressure to rise. During these winter months, the licensee operates the system in a mode specifically intended to reduce header pressure to avoid any challenges to the SW header relief valves. In this header pressure control mode, the SW side of a spare HX is placed in service to allow flow to pass without cooling any loads; the increased SW system flow subsequently reduces SW header pressure back down to a more nominal value, as directed by the operating crew.

Frequently, it is the swing CCW HX No. 3 that is utilized to perform this function, and its associated outlet valve (SW37) is throttled by procedure to accomplish this. While all three SW outlet isolation/throttle valves for CCW HX Nos. 1, 2, and 3 (SW36, SW38, and SW37) have experienced issues, SW37 has had the most. Issues involving SW37 can be traced back to 2006. Recent issues have included:

• May 2014: SW37 noted as leaking by excessively. The valve had just undergone maintenance in March 2014 during the plants refuel outage and had its elastomer seating surface replaced. (CR 2014-09117);

• August 2014: the SW37 valve is replaced in total. Maintenance personnel noted that approximately half of the elastomer seat/liner was torn away and missing.

(CR 2014-13288);

• March 2015: SW37 leaking by excessively (CR 2015-03283); and

• March 2016: SW37 removed and disassembled for repair/replacement.

Maintenance personnel noted that approximately 40 percent of the elastomer seat/liner was torn away and missing. (CR 2016-03466)

In response to the March 2015 failure, the licensee conducted a formal causal analysis, which included detailed discussions with the SW36, SW38, and SW37 valve manufacturer (Fisher Flow Control Technologies). The manufacturer informed the licensee that based on the valves size (20-inch butterfly valve), the range of operation in the throttled position should be between 20 percent and 60 percent open.

Additionally, the manufacturer informed the licensee that the differential pressure across the valve should be limited to 50 psi. Based on this information, licensee engineering personnel performing the causal analysis concluded that the SW37 valve liner had been subjected to cavitation and flow conditions that were frequently beyond its design limits when CCW HX was operated in header pressure control mode. Specifically, SW37 was typically throttled down to a position of approximately 15 percent open, and calculations showed that the differential pressure across the valve was on the order of about 90 psi.

As discussed in Section 1R15.1 of this report (URI 05000346/2016001-02), the licensee discontinued using CCW HX No. 3 for SW header pressure control on February 25, 2016, after being challenged by the inspectors about the practice. The licensee had entered this event into their CAP as CR 2016-02667.

Analysis The inspectors reviewed this finding using the guidance contained in Appendix B, "Issue Screening," of IMC 0612, Power Reactor Inspection Reports. The inspectors determined that the licensees failure to adequately incorporate the manufacturers design limits for SW36, SW38, and SW37 into applicable operating procedures and instructions constituted a performance deficiency that was reasonably within the licensees ability to foresee and correct and should have been prevented. This finding was associated with the Mitigating Systems Cornerstone of Reactor Safety and was determined to be of more than minor significance because it was associated with cornerstone attributes of design control and procedure quality, and adversely affected the cornerstone objective: "To ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage)." Specifically, the inspectors determined that the licensees failure to have incorporated the applicable design limits for SW37 throttle position and differential pressure across the valve into applicable operating procedures contributed to the degradation and ultimate inoperability of the valve.

The inspectors evaluated the finding using IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power. Using Exhibit 2-Mitigating Systems Screening Questions, the inspectors determined the finding to be of very low safety significance (Green) because it did not represent a deficiency affecting the design or qualification of a mitigating SSC that resulted in the SSC maintaining its operability or functionality; it did not, in and of itself, represent a loss of system and/or function; it did not represent an actual loss of function of at least a single train for greater than its TS allowed outage time, or two separate safety systems being out-of-service for greater than their TS allowed outage times; and it did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety significant in accordance with the licensees maintenance rule program.

Using IMC 0310, "Aspects Within the Cross-Cutting Areas," the inspectors determined that the finding had a cross-cutting aspect in the area of human performance. The inspectors assigned the cross-cutting aspect of Design Margins to the finding because the licensee had failed to ensure that the safety-related SW37 butterfly valve was operated and maintained well within the manufacturers design limits. (H.6)

Enforcement Criterion V of 10 CFR Part 50, Appendix B, Instructions, Procedures, and Drawings, states:

Activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Instructions, procedures, or drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished.

Contrary to these requirements, the licensee failed to incorporate the manufacturers applicable design limits for SW36, SW38, and SW37 throttle position and differential pressure into applicable operating procedures for these components, such that the operation of SW37 in a manner contrary to its design contributed its degradation and ultimate inoperability. The licensee had operated these valves in this manner, periodically during colder weather months, for several years prior to February 25, 2016.

Because this finding was of very low safety significance, had been entered into the licensees CAP, and the licensee had taken or planned corrective actions under CRs 2015-03287 and 2016-02667, the associated violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy.

(NCV 05000346/2016001-01)

1R13 Maintenance Risk Assessments and Emergent Work Control

.1 Maintenance Risk Assessments and Emergent Work Control

a. Inspection Scope

The inspectors reviewed the licensee's evaluation and management of plant risk for the maintenance and emergent work activities affecting risk-significant and safety-related equipment listed below to verify that the appropriate risk assessments were performed prior to removing equipment for work:

• Planned maintenance activities associated with the cutting of multiple core bores in the Auxiliary Building in support of installation of the stations post-Fukushima FLEX modifications during the weeks ending January 16, 2016, through March 18, 2016;

• Planned maintenance activities associated with steam generator (SG) operating range level indications and alarms during the week ending January 23, 2016;

• Planned maintenance activities conducting the on-line replacement of the ICS pulser module for the main turbine during the week ending February 27, 2016;

• Planned ASME [American Society of Mechanical Engineers] Code repair and replacement activities associated with the No. 3 CCW HX SW Outlet Isolation Valve, SW37, and associated SW piping during the week ending March 26, 2016, through March 31, 2016; and

• Reactor vessel head lift and related activities as part of the licensees planned 19th RFO on March 31, 2016.

These activities were selected based on their potential risk significance relative to the Reactor Safety Cornerstones. As applicable for each activity, the inspectors verified that risk assessments were performed as required by 10 CFR 50.65(a)(4) and were accurate and complete. When emergent work was performed, the inspectors verified that the plant risk was promptly reassessed and managed. The inspectors reviewed the scope of maintenance work, discussed the results of the assessment with the licensee's probabilistic risk analyst or shift technical advisor, and verified plant conditions were consistent with the risk assessment. The inspectors also reviewed TS requirements and walked down portions of redundant safety systems, when applicable, to verify risk analysis assumptions were valid and applicable requirements were met. Specific documents reviewed during this inspection are listed in the Attachment to this report.

The inspectors' review of these maintenance risk assessments and emergent work control activities constituted five inspection samples as defined in IP 71111.13-05.

b. Findings

No findings were identified.

1R15 Operability Determinations and Functionality Assessments

.1 Operability Evaluations and Functionality Assessments

a. Inspection Scope

The inspectors reviewed the following issues:

• The guidance provided by licensee engineering and technical personnel for operation of the reactor with a non-zero temperature difference between reactor coolant system (RCS) cold legs ( Tc), as documented in CR 2015-17030;

• The calculation of the minimum RCS boron concentration required to support the end-of-cycle moderator temperature coefficient, as documented in CR 2016-01245;

• The inadvertent mispositioning of the test/operate switch associated with Source Range Nuclear Instrument (NI) No. 1 for RPS Channel No. 2, as documented in CR 2016-01528;

• The operability and potential loss of safety function for the stations shield building emergency ventilation system (EVS) with Door No. 108 inadvertently left open, as documented in CR 2016-03694;

• The impact of using a degraded SW37, the No. 3 CCW HX SW Outlet Isolation Valve, for SW header pressure control, as documented in CR 2016-00438; and

• The acceptability of using a temporary air conditioning unit to maintain makeup pump room temperatures within specifications, as documented in CR 2016-02865.

The inspectors selected these potential operability issues based on the risk significance of the associated SSCs. The inspectors examined the technical adequacy of the evaluations to ensure that TS operability was properly justified, and also to ensure that the applicable SSCs remained available such that no unrecognized increase in risk occurred. The inspectors compared the operability and design criteria in the appropriate sections of the TS and USAR to the licensees evaluations to determine whether the applicable SSCs were operable. Where compensatory measures were required to maintain operability, the inspectors determined whether the measures in place would function as intended and were appropriately controlled. The inspectors verified, where applicable, that the bounding limitations of the evaluations were valid. Additionally, the inspectors reviewed a sampling of corrective action documents to verify that the licensee was identifying and correcting any deficiencies associated with the operability evaluations and functionality assessments. Documents reviewed are listed in the to this report.

The review of these operability evaluations and functionality assessments by the inspectors constituted six inspection samples as defined in IP 71111.15-05.

b. Findings

(1) Service Water Header Operability While Using a Degraded No. 3 CCW HX SW Outlet Isolation Valve (SW37) for SW Header Pressure Control As discussed in Section 1R12.1 of this report, during the colder months of the year the demand on the SW system is reduced. During these winter months, the licensee operates the system in a mode specifically intended to reduce header pressure to avoid any challenges to the SW header relief valves, as the reduced SW flow requirements would otherwise tend to cause SW header pressure to rise. In this header pressure control mode, the SW side of a spare HX is placed in service to allow flow to pass without cooling any loads, and the increased SW system flow subsequently reduces SW header pressure back down to a more nominal value.

Licensee operating crews frequently utilize the swing CCW HX No. 3 to perform this function, and its associated outlet valve (SW37) is throttled by procedure to accomplish this. Again, as discussed in Section 1R12.1 of this report, SW37 has experienced a number of leakage issues, at least in part, as a result of this practice. Most recently, excessive through leakage on SW37 was identified in March of 2015 (CR 2015-03283).

Initially, the licensees evaluation of the condition only evaluated the impact of the through leakage on the valves isolation function. The evaluation concluded that the valve could be considered operable, but degraded, since an alternate means of isolation was available. The evaluation did not, however, assess the impact of the valve degradation on operation of the SW system if CCW HX No. 3 were to be placed in service or credited to be aligned to one of the CCW and SW headers in standby.

As licensee engineering and technical personnel were preparing for an upcoming SW system flow test, their analyses of the condition began to suggest that small changes in the resistance of SW37 as a result of continued valve degradation could impact SW flow and possibly challenge minimum SW design basis flow assumptions for certain accident scenarios. As a result, in January of 2016 the licensee prohibited use of CCW HX No. 3 as an in-service or standby HX (CR 2016-00438). However, the licensees evaluation of the condition continued to permit CCW HX No. 3 and SW37 to be used for SW header pressure control.

In reviewing the issue, the inspectors noted that the licensees evaluation, as documented in CR 2016-00438 and entered into their CAP, did not contain any technical justification for the continued use of SW37 in header pressure control mode.

Field observations by the inspectors revealed that the licensee operations staff had attached a plant information tag to the SW37 valve hand wheel warning personnel of the degraded condition of the valve and the potential for rendering SW Header No. 1 inoperable if the valve position were to be altered. Given the unknown condition of the SW37 valve internals, the unknown extent of the degradation of the valves liner/seat, and the unknown nature of the mechanism causing the degradation, the inspectors questioned how it could be possible for the licensee to conclude that use of SW37 in header pressure control mode would be acceptable.

On February 18, 2016, the inspectors raised their concerns on this matter to the licensees operations supervisory staff, and asked to be provided with the licensees technical basis for continued operability of the SW system with the degraded SW37 being utilized for header pressure control. After several days had passed without receiving an answer, the inspectors elevated the question to the Site Vice President on February 23, 2016. On February 24, 2016, licensee engineering and operations management informed the inspectors that CCW HX No. 3 and SW37 had been removed from SW header pressure control and would be precluded from further use in that manner pending additional licensee analysis.

The licensee entered this issue into their CAP as CR 2016-02667. Because the inspectors had not yet received the results of the licensees additional analysis concerning the use of CCW HX No. 3 and SW37 for SW header pressure control at the end of this inspection period, the issue is being treated as an unresolved item (URI)pending the inspectors review of the licensees completed evaluation.

(URI 05000346/2016001-02)

(2) Shield Building Emergency Ventilation System Operability with Watertight Door No. 108 Inadvertently Left Open The shield building EVS functions to collect and process potential leakage from the containment vessel to minimize environmental activity levels resulting from all sources of containment leakage following a design-basis accident. The EVS is required to maintain a negative pressure (a minimum of 1/4 inch water gauge), with respect to outside atmosphere, within the annular space between the shield building and the containment vessel and in the penetration rooms following an accident. In addition, it is required to provide a filtered exhaust path from the shield building annulus and the penetration and pump rooms following an accident.

The EVS consists of two independent and redundant trains. Each train consists of a prefilter, a high efficiency particulate air filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a fan. Ductwork, valves or dampers, and instrumentation also form part of the system. The EVS boundary, consisting of various walls and doors within the plants auxiliary building, must be intact and functional to ensure EVS operability. Door No. 108, Emergency Core Cooling System Pump Room No. 115 to Detergent Waste Drain Tank to Clean Waste Receiver Tank, is one such plant door.

At approximately 7:53 p.m. on March 21, 2016, with the unit in Mode 1 and operating at power, operations personnel discovered a plant watertight door, Door No. 108, open and unattended. The operations personnel immediately secured the door and informed operations on-watch management of the issue. The on-watch operations shift manager determined that because the door was fully functional and closed when he was informed of the issue that neither the door nor the shield building EVS was inoperable. He then contacted the licensees on-duty management team to discuss the issue. Collectively, the licensees personnel concurred with the shift managers operability decision and determined that the issue was not immediately reportable under 10 CFR 50.72(b)(3)(v)as an Event or Condition that Could Have Prevented Fulfillment of a Safety Function, since no SSCs had ever been declared inoperable. Subsequently, licensee engineering personnel reviewing the issue determined that based on exiting plant calculations and the area of the door that it was highly improbable that the EVS would be able to have met its specified safety function with Door No. 108 open and unattended. The licensee entered this issue into their CAP as CR 2016-03694. An investigation by the licensee into the issue identified that the door had been inadvertently left open by contractor workforce personnel approximately five minutes before it was discovered open by operations personnel.

During the next few days while conducting their routine review of the licensees CAP entries, the inspectors took note of this issue and questioned the licensee regarding their decision not to report the matter under 10 CFR 50.72(b)(3)(v). Licensee management subsequently decided to perform a special test of the EVS with Door No. 108 in the open position (under the administrative control of a designated individual) to empirically determine the capability of the EVS in this condition. The test was performed during the afternoon/evening hours on March 25, 2016. Preliminary results indicated that the EVS passed, albeit by only 0.08 seconds.

Because the licensee had not yet completed their analysis of the issue following the March 25, 2016, special EVS test at the end of the inspection period, the issue is being treated as a URI pending the inspectors receipt and review of the licensees completed CAP documents and evaluation. (URI 05000346/2016001-03)

1R18 Plant Modifications

.1 Permanent Plant Modification

a. Inspection Scope

The inspectors reviewed the following permanent change to the facility:

• ECP No. 13-0195 Emergency Feedwater Facility.

The inspectors reviewed the configuration changes and associated 10 CFR 50.59 safety evaluation documents against the design basis, the USAR, and the TS, as applicable, to verify that the permanent change to the facility did not affect the operability or availability of any safety-related systems, or systems important to safety. The inspectors observed ongoing and completed work activities to ensure that the modification was installed as directed and consistent with the design control documents; that the modification operated as expected; and that operation of the modification did not impact the operability of any interfacing systems. The inspectors verified that relevant procedure, design, and licensing documents were properly updated. Finally, the inspectors discussed the plant modification with operations, engineering, and training department personnel to ensure that the individuals were aware of how the operation with the modification in place could impact overall plant performance. Documents reviewed in the course of this inspection are listed in the Attachment to this report.

The inspectors review of this permanent plant modification constituted a single inspection sample as defined in IP 71111.18-05.

b. Findings

No findings were identified.

1R19 Post-Maintenance Testing

.1 Quarterly Resident Inspector Observation and Review of Post-Maintenance Testing

Activities

a. Inspection Scope

The inspectors reviewed the following post-maintenance testing (PMT) activities to verify that procedures and test activities were adequate to ensure system operability and functional capability:

• LPI Train No. 2 comprehensive testing following completion of planned maintenance during the weeks ending January 23, 2016, and January 30, 2016;

• Operational and functional testing of the Train No. 1 Decay Heat Pump Discharge to HPI Suction Motor-Operated Valve, DH64, following planned maintenance during the week ending March 5, 2016;

• Operational, functional, and load testing of the east D-Ring (No. 2) Palfinger containment crane (PK26002-EH) following repairs to the mounting plate attachment bolts during the week ending March 12, 2016; and

• ASME Code non-destructive testing following repair/replacement of the No. 3 CCW HX SW Outlet Isolation Valve (SW37) during the week ending March 26, 2016, through March 31, 2016.

These activities were selected based upon the SSC's ability to impact risk. The inspectors evaluated these activities for the following (as applicable): the effect of testing on the plant had been adequately addressed; testing was adequate for the maintenance performed; acceptance criteria were clear and demonstrated operational readiness; test instrumentation was appropriate; tests were performed as written in accordance with properly reviewed and approved procedures; equipment was returned to its operational status following testing (temporary modifications or jumpers required for test performance were properly removed after test completion); and test documentation was properly evaluated. The inspectors evaluated the activities against TSs, the USAR, 10 CFR Part 50 requirements, licensee procedures, and various NRC generic communications to ensure that the test results adequately ensured that the equipment met the licensing basis and design requirements. In addition, the inspectors reviewed corrective action documents associated with the PMTs to determine whether the licensee was identifying problems and entering them in the CAP and that the problems were being corrected commensurate with their importance to safety. Documents reviewed are listed in the Attachment to this report.

The inspectors reviews of these activities constituted four PMT inspection samples as defined in IP 71111.19-05.

b. Findings

No findings were identified.

1R20 Outage Activities

.1 Refueling Outage Activities

a. Inspection Scope

The inspectors reviewed the licensee's comprehensive outage plan, shutdown defense-in-depth plan, and contingencies for the plant's 19th RFO, which began on March 26, 2016, and continued through the end of the inspection period. These reviews were performed to confirm that the licensee had appropriately considered risk, industry experience, and previous site-specific problems in developing and implementing a plan that assured maintenance of defense-in-depth. During the RFO, the inspectors observed portions of the shutdown and RCS cool down and depressurization, and monitored licensee controls over the outage activities listed below:

• Licensee configuration management, including maintenance of defense-in-depth commensurate with the shutdown defense-in-depth plan for key safety functions and compliance with the applicable TS when taking equipment out of service;

• Implementation of clearance activities and confirmation that tags were properly hung and equipment appropriately configured to safely support the work or testing;

• Installation and configuration of RCS pressure, level, and temperature instruments to provide accurate indication, accounting for instrument error;

• Controls over the status and configuration of electrical systems to ensure that TS and shutdown defense-in-depth plan requirements were met, and controls over switchyard activities;

• Monitoring of decay heat removal processes, systems, and components;

• Controls to ensure that outage work was not impacting the ability of the operators to operate the spent fuel pool cooling system;

• Reactor water inventory controls including flow paths, configurations, and alternative means for inventory addition, and controls to prevent inventory loss;

• Controls over activities that could affect reactivity;

• Maintenance of containment and associated ventilation systems, as required by TS;

• Licensee fatigue management, as required by 10 CFR 26, Subpart I;

• Refueling activities, including fuel handling, spent fuel assembly inspections, and fuel assembly reconstitution; and

• Licensee identification and resolution of problems related to RFO activities.

Documents reviewed are listed in the Attachment to this report.

Because the RFO was still ongoing at the end of the inspection period, these RFO review activities constituted only a partial RFO inspection sample as defined in IP 71111.20-05.

b. Findings

No findings were identified.

.2 January-February 2016 Forced Maintenance Outage

a. Inspection Scope

The inspectors evaluated outage activities for a forced maintenance outage that began with an automatic reactor trip at approximately 1:21 p.m. on January 29, 2016, as a result of a blown RPS fuse. (See Section 4OA3.1 for event details.) Following completion of various plant repairs associated with the event, the reactor was restarted on January 31, 2016, and the unit returned to full power on February 5, 2016.

The inspectors reviewed activities to ensure that the licensee considered risk in developing, planning, and implementing the outage schedule. The inspectors reviewed plant records associated with the reactor trip and RPS actuation. Outage equipment configuration, risk management, electrical lineups, selected clearances, control and monitoring of decay heat removal, personnel fatigue management, startup activities, and identification and resolution of problems associated with the outage were also reviewed and selectively observed by the inspectors. Documents reviewed are listed in the to this report.

These observations and reviews by the inspectors constituted a single other (i.e.,

non-refueling) outage sample as defined in IP 71111.20-05.

b. Findings

No findings were identified.

1R22 Surveillance Testing

.1 Surveillance Testing

a. Inspection Scope

The inspectors reviewed the results for the following testing activities to determine whether risk-significant systems and equipment were capable of performing their intended safety function and to verify testing was conducted in accordance with applicable procedural and TS requirements:

• Planned monthly surveillance testing of the Station Blackout Diesel Generator (SBODG) during the week ending January 23, 2016 [Routine];

• Planned quarterly inservice pump and valve testing of HPI Train No. 2 during the week ending February 27, 2016 [Inservice Testing (IST)];

• Planned quarterly inservice pump and valve testing of Containment Spray Train No. 1 during the week ending March 5, 2016 [IST]; and

• Planned periodic main turbine overspeed trip testing during the week ending March 26, 2016 [Routine].

The inspectors observed in-plant activities and reviewed procedures and associated records to determine the following:

• Did preconditioning occur;

• The effects of the testing were adequately addressed by control room personnel or engineers prior to the commencement of the testing;

• Acceptance criteria were clearly stated, demonstrated operational readiness, and were consistent with the system design basis;

• Plant equipment calibration was correct, accurate, and properly documented;

• As-left setpoints were within required ranges; and the calibration frequency was in accordance with TSs, the USAR, procedures, and applicable commitments;

• That measuring and test equipment calibration was current;

• That test equipment was used within the required range and accuracy;

• That applicable prerequisites described in the test procedures were satisfied;

• That test frequencies met TS requirements to demonstrate operability and reliability; tests were performed in accordance with the test procedures and other applicable procedures; jumpers and lifted leads were controlled and restored where used;

• That test data and results were accurate, complete, within limits, and valid;

• That test equipment was removed after testing;

• Where applicable for IST activities, testing was performed in accordance with the applicable version of Section XI, American Society of Mechanical Engineers code, and reference values were consistent with the system design basis;

• Where applicable, that test results not meeting acceptance criteria were addressed with an adequate operability evaluation or the system or component was declared inoperable;

• Where applicable for safety-related instrument control surveillance tests, that reference setting data were accurately incorporated in the test procedure;

• Where applicable, that actual conditions encountering high resistance electrical contacts were such that the intended safety function could still be accomplished;

• That prior procedure changes had not provided an opportunity to identify problems encountered during the performance of the surveillance or calibration test;

• That equipment was returned to a position or status required to support the performance of its safety functions; and

• That all problems identified during the testing were appropriately documented and dispositioned in the CAP.

Documents reviewed are listed in the Attachment to this report.

These activities conducted by the inspectors constituted two routine surveillance testing inspection samples and two IST inspection sample as defined in IP 71111.22, Sections-02 and-05.

b. Findings

No findings were identified.

OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Security

4OA1 Performance Indicator Verification

.1 Unplanned Scrams per 7000 Critical Hours

a. Inspection Scope

The inspectors sampled licensee submittals for the Unplanned Scrams per 7000 Critical Hours Performance Indicator (PI) for the period from January 2015 to December 2015.

To determine the accuracy of the PI data reported during those periods, PI definitions and guidance contained in the Nuclear Energy Institute (NEI) Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, dated August 31, 2013, were used. The inspectors reviewed the licensees operations narrative logs, CRs, event reports and NRC integrated IRs for the period to validate the accuracy of the submittals. The inspectors also reviewed the licensees CAP to determine if any problems had been identified with the PI data collected or transmitted for this indicator. Documents reviewed are listed in the Attachment to this report.

These reviews by the inspectors constituted a single unplanned scrams per 7000 critical hours inspection sample as defined in IP 71151-05.

b. Findings

No findings were identified.

.2 Unplanned Scrams with Complications

a. Inspection Scope

The inspectors sampled licensee submittals for the Unplanned Scrams with Complications PI for the period from January 2015 to December 2015. To determine the accuracy of the PI data reported during those periods, PI definitions and guidance contained in the NEI Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, dated August 31, 2013, were used. The inspectors reviewed the licensees operator narrative logs, CRs, event reports and NRC integrated IRs for the period to validate the accuracy of the submittals. The inspectors also reviewed the licensees CAP to determine if any problems had been identified with the PI data collected or transmitted for this indicator. Documents reviewed are listed in the to this report.

These reviews by the inspectors constituted a single unplanned scrams with complications inspection sample as defined in IP 71151-05.

b. Findings

No findings were identified.

.3 Unplanned Transients per 7000 Critical Hours

a. Inspection Scope

The inspectors sampled licensee submittals for the Unplanned Transients per 7000 Critical Hours PI for the period from January 2015 through December 2015. To determine the accuracy of the PI data reported during those periods, PI definitions and guidance contained in the NEI Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, dated August 31, 2013, were used. The inspectors reviewed the licensees operator narrative logs, CRs, maintenance rule records, event reports and NRC integrated IRs for the period to validate the accuracy of the submittals.

The inspectors also reviewed the licensees CAP to determine if any problems had been identified with the PI data collected or transmitted for this indicator. Documents reviewed are listed in the Attachment to this report.

These reviews by the inspectors constituted a single unplanned transients per 7000 critical hours inspection sample as defined in IP 71151-05.

b. Findings

No findings were identified.

4OA2 Identification and Resolution of Problems

.1 Routine Review of Items Entered into the Corrective Action Program

a. Inspection Scope

As part of the various baseline IPs discussed in previous sections of this report, the inspectors routinely reviewed issues during baseline inspection activities and plant status reviews to verify they were being entered into the licensees CAP at an appropriate threshold, that adequate attention was being given to timely corrective actions, and that adverse trends were identified and addressed. Attributes reviewed included: identification of the problem was complete and accurate; timeliness was commensurate with the safety significance; evaluation and disposition of performance issues, generic implications, common causes, contributing factors, root causes, extent-of-condition reviews, and previous occurrences reviews were proper and adequate; and that the classification, prioritization, focus, and timeliness of corrective actions were commensurate with safety and sufficient to prevent recurrence of the issue.

Minor issues entered into the licensees CAP as a result of the inspectors observations are included in the Attachment to this report.

These routine reviews for the identification and resolution of problems did not constitute any additional inspection samples. Instead, by procedure they were considered an integral part of the inspections performed during the quarter and documented in Section 1 of this report.

b. Findings

No findings were identified.

.2 Daily Corrective Action Program Reviews

a. Inspection Scope

In order to assist with the identification of repetitive equipment failures and specific human performance issues for follow-up, the inspectors performed a daily screening of items entered into the licensees CAP. This review was accomplished through inspection of the stations daily CR packages.

These daily reviews were performed by procedure as part of the inspectors daily plant status monitoring activities and, as such, did not constitute any separate inspection samples.

b. Findings

No findings were identified.

4OA3 Follow-Up of Events and Notices of Enforcement Discretion

.1 Event Notification No. 51696: Automatic Unit Trip Due to Reactor Protection System

Actuation

a. Inspection Scope

On January 29, 2016, the licensee was performing normal periodic power range nuclear instrument calibration activities. Each of the four reactor RPS channels receives input from one of four separate and independent power range nuclear instruments. A manual bypass feature is provided on each RPS channel to remove that channel from the coincidence reactor trip logic in order to facilitate on line maintenance, such as periodic nuclear instrument calibration. The RPS design precludes bypassing more than one RPS channel at a time.

Earlier in the current reactor operating cycle, the RCS hot leg temperature detector for RPS Channel No. 1 failed, and the licensee was required to declare RPS Channel No. 1 inoperable. Plant TS permit continued operation with one inoperable RPS channel indefinitely; however, TS Limiting Condition for Operation (LCO) 3.3.1, Condition A, required the licensee to place the channel into the trip or bypassed condition. Since replacement of the temperature detector can only be done with the unit in the cold shutdown condition, the licensee had been operating with RPS Channel No. 1 bypassed during most normal operating conditions. However, during maintenance conditions requiring any of the other three remaining RPS channels to be bypassed, the licensee was forced to place RPS Channel No. 1 into the trip condition in order to allow the manual bypass to be used elsewhere. This was the case on January 29, 2016, at the time of the event.

At approximately 12:14 p.m., plant technicians completed calibration of the power range nuclear instrument for RPS Channel No. 1 (NI-6), and the channel was manually tripped by plant operators to set up conditions for calibrations on the remaining three power range nuclear instruments. From approximately 12:20 p.m. to 1:03 p.m., RPS Channel No. 3 was bypassed to support calibration of its associated power range nuclear instrument (NI-8). At approximately 1:09 p.m., plant operators restored RPS Channel No. 3 to normal operation and placed RPS Channel No. 2 into the bypass condition to support calibration of its associated power range nuclear instrument (NI-5).

At approximately 1:21 p.m., a blown fuse associated with a power supply for RPS Channel No. 4 caused that channel to trip on the flux / flux / flow protective function.

With RPS Channel No. 1 already in the tripped condition to support the maintenance activities being performed, reactor trip coincidence logic was satisfied and a reactor trip ensued.

There were several anomalies associated with the plant trip. One of the two main generator electrical output circuit breakers (ACB 34561) failed to open rapidly enough (on the order of a tenth of a second, and a generator exciter lockout resulted. This subsequently caused one of the sites four 345 KV offsite lines (the Bayshore Line) to be isolated due to protective relaying. Additionally, unrelated failures in the plants ICS caused SG No. 1 to experience a high water level condition, which resulted in a SFRCS actuation. This complicated the response of control room operators to the trip by removing MFW and initiating AFW to supply both SGs, and by removing the main condenser as the plants heat sink and forcing operators to vent steam to atmosphere.

NRC inspectors responded to the site immediately following the reactor trip and remained on station in the sites control room providing independent assessment of the event until it was determined that the plant was stable and that the licensee was able to move forward with recovery operations. The inspectors observed and reviewed the licensees response to the event, operator logs, computer and recorder data, and procedural requirements. Specific items associated with this event that were reviewed included, but were not limited to:

• Mitigating systems and fission product barriers performance and integrity;

• The realignment of plant equipment in response to the trip and SFRCS actuation;

• The performance of plant operators in the control room and in the field;

• Event notifications made pursuant to 10 CFR 50.72;

• The potential for any generic issues, including those potentially requiring reporting under 10 CFR Part 21;

• The licensee's termination from their trip response procedures and transition to normal shutdown plant operations; and

• The licensee's completed root cause reports and corrective actions associated with the event.

Documents reviewed as part of this inspection are listed in the Attachment.

This event follow-up review by the inspectors constituted a single inspection sample as defined in IP 71153-05.

b. Findings

(1) Less than Sufficient Work Package Documentation and Instructions Resulted in an Inadequate Part Being Installed into the Plants Integrated Control System Introduction A self-revealed finding of very low safety significance (Green) was identified for the licensees failure to include an adequate bench check for a replacement ICS module that was installed into the system during the plants 2014 RFO into the work package instructions for that activity. Specifically, a defeat switch on the replacement Module 5-2-8 for the ICS rapid feedwater reduction (RFR) circuit installed as preventative maintenance during the plants 18th RFO was incorrectly wired and not detected during pre-installation checks. The incorrectly wired module prevented the ICS RFR function from occurring during the unit trip on January 29, 2016, which contributed to the SG No.

1 high level condition and the resultant SFRCS actuation.

Description During the plant's 18th RFO in 2014, the licensee replaced a number of modules within the plants ICS as part of a general preventative maintenance refurbishment. Module 5-2-8 was replaced under WO 200352105 as part of this effort and contained a defeat switch for the RFR ICS function. The RFR circuit within the plants ICS functions, as the name implies, to rapidly reduce plant feedwater (FW) flow under certain reactor trip conditions to prevent overfilling the SGs. The replacement module was itself a previously used part that had been returned to the licensees warehouse as a replacement/spare in 1990 following removal from another part of system where it had performed a different function. Unbeknownst to the licensee, the toggle switch on the module was wired incorrectly for the RFR defeat switch application, such that on was actually off and off was actually on.

As discussed in the Inspection Scope section above, with the reactor operating at full power on January 29, 2016, at approximately 1:21 p.m. the reactor tripped due to a blown fuse associated with a power supply for RPS Channel No. 4. The RFR circuit within the plants ICS should have actuated to reduce FW and prevented the SGs from being overfilled, but did not. A high level condition was reached on SG No. 1, and the safety-related SFRCS actuated as designed.

An investigation following the event revealed the wiring discrepancy associated with the toggle switch on ICS Module 5-2-8. Additionally, the investigation concluded that the bench check contained in WO 200352105 for the replacement module was a simple continuity check followed by toggling the switch on/off ten times and re-checking continuity to ensure switch resistance had not increased. This bench check prior to installation did not adequately test the module for its intended function. The replacement of ICS Module 5-2-8 was the only module replacement in the preventative maintenance activity that replaced 100 modules that did not refer to a vendor manual and data package for its bench check. Had the continuity check contained the correct pins to validate the toggle switch function, licensee technicians performing the preventative maintenance likely would have identified that the module was wired incorrectly for the RFR defeat switch function. This could have been accomplished by validating switch position with contact state of the output pins per the vendor manual/drawings.

Corrective actions taken by the licensee included replacement of ICS Module 5-2-8 with a spare properly configured for the RFR defeat switch function. Additionally, a proper data package to enable bench checking ICS Module 5-2-8 to verify the capability of the module to perform its intended function was created. The licensee also created training and lessons learned from this event, with the target audiences being operations, maintenance, and engineering personnel. The licensee had entered this event into their CAP as CRs 2016-01365 and 2016-01432.

Analysis The inspectors reviewed this finding using the guidance contained in Appendix B, "Issue Screening," of IMC 0612, Power Reactor Inspection Reports. The inspectors determined that the licensees failure to provide an adequate work package that enabled a proper bench check for the replacement of ICS Module 5-2-8 during the plant's 18th RFO in 2014 constituted a performance deficiency that was reasonably within the licensees ability to foresee and correct and should have been prevented. This finding was associated with the Mitigating Systems Cornerstone of Reactor Safety and was determined to be of more than minor significance because it was associated with cornerstone attributes of design control and procedure quality, and adversely affected the cornerstone objective: "To ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage)."

In consultation with the NRC Region III Senior Reactor Analyst (SRA), the inspectors evaluated the finding using IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power. Using Exhibit 2-Mitigating Systems Screening Questions, the inspectors determined the finding to be of very low safety significance (Green) because it did not represent a deficiency affecting the design or qualification of a mitigating SSC; it did not, in and of itself, represent a loss of system and/or function; it did not represent an actual loss of function of at least a single train for greater than its TS allowed outage time, or two separate safety systems being out-of-service for greater that their TS allowed outage times; and it did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program.

Using IMC 0310, "Aspects Within the Cross-Cutting Areas," the inspectors determined that the finding had a cross-cutting aspect in the area of human performance. The inspectors assigned the cross-cutting aspect of Documentation to the finding because the licensee had failed to ensure that the instructions and other work package guidance available to maintenance personnel performing the ICS Module 5-2-8 replacement had contained provisions for an adequate bench check of the module prior to its installation.

(H.7)

Enforcement The quality of work instructions and component replacement parts intended for use in safety-related applications is regulated under Appendix B of 10 CFR Part 50, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants." Because neither ICS Module 5-2-8 nor the ICS RFR circuit as a whole is safety-related or used for a safety-related application, the inspectors determined that the finding did not involve any corresponding violation of regulatory requirements. (FIN 05000346/2016001-04)

(2) Lack of Software Change Controls and Inadequate Corrective Action for an Operator Workaround Contributes to Complications Experienced During a Reactor Trip Introduction A self-revealed finding of very low safety significance (Green) was identified for the licensees failure to implement a technically correct software change associated with the SG / Reactor Demand ICS control station. Specifically, a known logic error within the plants ICS would cause the SG / Reactor Demand control station to trip to manual from automatic coincident with a reactor trip. The licensee had instituted compensatory operator actions for this condition but removed these actions in December 2015 when they implemented a software change to rectify the problem. However, the corrective actions were inadequate, and the SG / Reactor Demand ICS control station unexpectedly tripped to manual from automatic when the unit tripped on January 29, 2016. The unexpected control station mode of operation change, combined with the absence of any compensatory operator actions, contributed to the SG No. 1 high level condition and the resultant SFRCS actuation.

Description While conducting operations simulator training in August of 2014, the licensee had identified that recent software changes to the ICS Unit Load Demand (ULD) subsystem introduced an error that would cause the SG / Reactor Demand ICS control station to trip to manual from automatic coincident with a reactor trip. The licensee classified the unintended control station mode of operation change as an operator workaround and instituted compensatory actions for control room operators to take in the event of a reactor trip. At the same time, the licensee began work on permanent corrective actions to rectify the issue.

On December 2, 2015, the licensee implemented software changes to the ICS under WO 200615984 that were intended to resolve the issue. The operator workaround was cleared; and the control room operator compensatory actions, which had called for the operator to manually dial the SG / Reactor Demand ICS control station signal to zero in a controlled manner, were removed.

As discussed in the Inspection Scope section above, with the reactor operating at full power on January 29, 2016, at approximately 1:21 p.m., the reactor tripped due to a blown fuse associated with a power supply for RPS Channel No. 4. At the same time, the SG/Reactor Demand ICS control station unexpectedly tripped from automatic to manual. Had the control station remained in automatic, its demand signal to the ICS FW subsystem would have rapidly and automatically lowered to zero, and this automatic control action would have also been accelerated by a cross limit (i.e., feedback designed into the ICS) from the Reactor Control subsystem. By design, the automatic lowering of the SG / Reactor Demand ICS control station output would have been sufficient to reduce FW flow quickly enough to have prevented the SFRCS high SG water level actuation.

An investigation following the event revealed that the licensees procedural guidance for making changes to some plant software applications was less than adequate. In certain cases involving software changes generated by the licensee in house, the licensees process failed to ensure that the changes did not introduce new failure modes and did not adequately document the bases for design and testing to confirm that the changes would correct the initial issue. Specifically for the software changes implemented under WO 200615984, the investigation concluded that the testing did not look for unintended adverse effects or encompass the applicable functions of the ICS ULD subsystem.

Additionally, contrary to test objectives and acceptance criteria, there was no recorded documentation of plant simulator testing included in the software change package; and the licensee failed to utilize several established industry standards and best practices for ensuring software change quality.

Corrective actions taken by the licensee included, but were not limited to:

• Initiating work on a new software change to rectify the issue of the SG/Reactor Demand ICS control station tripping from automatic to manual coincident with a reactor trip;

• Reestablishing the operator workaround and associated compensatory actions for control room operators; and

• Revising applicable procedures to incorporate current industry standards for controlling software life cycle changes to certain categories of software that interface with plant systems.

The licensee had entered this event into their CAP as CRs 2016-01365 and 2016-01387.

Analysis The inspectors reviewed this finding using the guidance contained in Appendix B, "Issue Screening," of IMC 0612, Power Reactor Inspection Reports. The inspectors determined that the licensees failure to have established adequate procedural guidance for making changes to some plant software applications, specifically the ICS ULD subsystem, constituted a performance deficiency that was reasonably within the licensees ability to foresee and correct and should have been prevented. This finding was associated with the Mitigating Systems Cornerstone of Reactor Safety and was determined to be of more than minor significance because it was associated with cornerstone attributes of design control and procedure quality, and adversely affected the cornerstone objective: "To ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage)."

In consultation with the NRC Region III SRA, the inspectors evaluated the finding using IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power.

Using Exhibit 2-Mitigating Systems Screening Questions, the inspectors determined the finding to be of very low safety significance (Green) because it did not represent a deficiency affecting the design or qualification of a mitigating SSC; it did not, in and of itself, represent a loss of system and/or function; it did not represent an actual loss of function of at least a single train for greater than its TS allowed outage time, or two separate safety systems being out-of-service for greater that their TS allowed outage times; and it did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program.

Using IMC 0310, "Aspects Within the Cross-Cutting Areas," the inspectors determined that the finding had a cross-cutting aspect in the area of problem identification and resolution. The inspectors assigned the cross-cutting aspect of Evaluation to the finding because the licensee had failed to thoroughly evaluate the issue of the SG/Reactor Demand ICS control station unexpectedly tripping from automatic to manual to ensure that the software change intended to resolve the issue actually addressed its cause. (P.2)

Enforcement Procedure quality and the quality of work instructions and software changes intended for use in safety-related applications is regulated under Appendix B of 10 CFR Part 50, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants."

Because neither the ICS ULD subsystem nor the SG / Reactor Demand ICS control station is safety-related, the inspectors determined that the finding did not involve any corresponding violation of regulatory requirements. (FIN 05000346/2016001-05)

.2 Event Notification No. 51702: Unanticipated SFRCS Actuation While Restoring Main

Feedwater to Steam Generators

a. Inspection Scope

On January 30, 2016, the licensee was performing recovery actions from the reactor trip that had occurred on January 29, 2016 (see Section 4OA3.1). With the reactor shutdown and in the hot standby condition, control room operators had restored the main condenser as the plants heat sink and were preparing to restore MFW to the SGs with the MDFP to permit shutdown of AFW. At approximately 1:23 a.m., control room operators received an unexpected SFRCS actuation on a reverse delta pressure (P)signal for the No. 1 SG while attempting to restore MFW to that SG. This actuation isolated MFW and removed the main condenser as the plants heat sink, once again forcing operators to vent steam to atmosphere to remove nuclear decay heat.

NRC inspectors responded to the site following the event and provided independent assessment of the plants response and operator actions. The inspectors observed and reviewed the licensees response to the event, operator logs, computer and recorder data, and procedural requirements. Specific items associated with this event that were reviewed included, but were not limited to:

• Mitigating systems and fission product barriers performance and integrity;

• The realignment of plant equipment in response to the unplanned SFRCS actuation;

• The performance of plant operators in the control room and in the field;

• Event notifications made pursuant to 10 CFR 50.72;

• The potential for any generic issues, including those potentially requiring reporting under 10 CFR Part 21;

• The licensee's continued recovery actions from the reactor trip on January 29, 2016, via their trip response procedures and continued transition to normal shutdown plant operations; and

• The licensee's completed root cause reports and corrective actions associated with the event.

Documents reviewed as part of this inspection are listed in the Attachment.

This event follow-up review by the inspectors constituted a single inspection sample as defined in IP 71153-05.

b. Findings

(1) Less than Adequate Procedural Instructions for Restoring Main Feedwater Following a Reactor Trip Introduction A self-revealed finding of very low safety significance (Green) and an associated NCV of TS 5.4.1(a) were identified for the licensees failure to establish and implement adequate procedural guidance for restoring MFW following a reactor trip. Specifically, the guidance in licensee procedure DB-OP-06910, Trip Recovery Procedure, for restoring MFW to the SGs using the MDFP did not ensure that the MFW piping had been sufficiently re-pressurized prior to opening the MFW to SG isolation valves. This lack of satisfactory procedural guidance allowed control room operators to prematurely open the MFW to SG No. 1 isolation valve, which resulted in a SFRCS actuation on the reverse P function.

Description As discussed in the Inspection Scope section above, with the reactor shutdown and in the hot standby condition on January 30, 2016, at approximately 1:23 a.m., the SFRCS actuated as designed when a reverse P signal was received for No. 1 SG coincident with control room operators trying to restore MFW to the SGs with the MDFP. Within the SFRCS, the reverse P actuation signal is generated when, among other conditions, the system senses a sufficiently higher pressure on the SG side of the MFW header check valve than on the pump side of the check valve. Since under normal MFW flow conditions this improper pressure difference could be indicative of a faulted MFW header, a SFRCS actuation signal is generated to isolate the SGs.

An investigation following the event revealed that the licensees procedural guidance for restoring MFW to the SGs with the MDFP following a reactor trip did not take into account the time needed for the MDFP to initially re-pressurize the MFW header prior to attempting to open the MFW to SG isolation valves. Additionally, the licensees procedural guidance did not account for the fact that the MFW piping run to the No. 1 SG is significantly longer than the length of MFW piping associated with the No. 2 SG. As a result, when operators tried to restore MFW flow to the SGs in the early morning hours of January 30, 2016, the MFW piping to the No. 1 SG was still partially voided and a SFRCS actuation on reverse P resulted.

Licensee corrective actions in response to this event included planned changes to licensee procedure DB-OP-06910, Trip Recovery Procedure, to ensure that MFW header pressure is greater that SG pressure prior to opening the MFW to SG isolation valves. The licensee had entered this event into their CAP as CR 2016-01397.

Analysis The inspectors reviewed this finding using the guidance contained in Appendix B, "Issue Screening," of IMC 0612, Power Reactor Inspection Reports. The inspectors determined that the licensees failure to have provided adequate procedural instructions to plant operators for recovering MFW following a reactor trip constituted a performance deficiency that was reasonably within the licensees ability to foresee and correct and should have been prevented. This finding was associated with the Mitigating Systems Cornerstone of Reactor Safety and was determined to be of more than minor significance because it was associated with cornerstone attributes of procedure quality, and adversely affected the cornerstone objective: "To ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage)."

The inspectors evaluated the finding using IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power. Using Exhibit 2-Mitigating Systems Screening Questions, the inspectors determined that because the finding in and of itself had resulted in the loss of function for a mitigating system (i.e., MFW), a detailed risk evaluation and the assistance of the NRC Region III SRA would be necessary.

The SRA used the Davis-Besse Standardized Plant Analysis Risk Model, Version 8.19 and Systems Analysis Programs for Hands-on Integrated Reliability Evaluations (SAPHIRE), Version 8.1.3, for the calculation of the delta core damage frequency (CDF) for the issue.

The following assumptions were made in the analysis:

• The MFW to SG No. 1 Isolation Valve (FW612) and MFW to SG No. 2 Isolation Valve (FW601) were assumed to be in the failed-closed position; and.

• The exposure time for the finding was assumed to be a single day, since during the event MFW was restored within twelve hours.

The result was a CDF of 3.2E-9 per year. The dominant core damage sequence involved a failure of AFW, MFW, and RCS feed and bleed.

Based on the results of this detailed risk evaluation, the inspectors determined that the finding was of very low safety-significance (Green).

Using IMC 0310, "Aspects Within the Cross-Cutting Areas," the inspectors determined that the finding had a cross-cutting aspect in the area of human performance. The inspectors assigned the cross-cutting aspect of Resources to the finding because the licensee had failed to ensure that the procedural instructions and guidance available to plant operators restoring MFW during reactor trip recovery actions took into account all relevant technical details (e.g., the differences between MFW piping runs, the amount of time needed to re-pressurize MFW piping, etc.) (H.1)

Enforcement Technical Specification 5.4.1(a) requires the licensee to establish, implement, and maintain applicable written procedures for the safety-related systems and activities recommended in RG 1.33, Revision 2, Appendix A. Section 2(c) of RG 1.33, Revision 2, Appendix A, requires procedures for the recovery of the plant from a reactor trip.

Similarly, Sections 3(k) and 3(l) of RG 1.33, Revision 2, Appendix A, require procedures governing the proper operation of the MFW and AFW systems. Contrary to these requirements, the licensee failed to properly prepare and implement technically adequate written procedures for the recovery of MFW following a reactor trip, such that the on-watch control room crew lacked sufficient procedural guidance to effectively transfer SG No. 1 from AFW to MFW on January 30, 2016, and a SFRCS actuation on the reverse P function ensued.

Because this finding was of very low safety significance, had been entered into the licensees CAP, and the licensee had taken or planned corrective actions under CR 2016-01397, the associated violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy. (NCV 05000346/2016001-06)

4OA5 Other Activities

.1 Winter 2015-2016 Groundwater Sampling Results

a. Inspection Scope

The inspectors reviewed the results of a series of expanded groundwater samples taken from wells in the plant owner-controlled area. The sampling of wells was completed as part of the licensees voluntary groundwater monitoring initiative and in response to the results obtained earlier, as discussed in Section 4OA5 of NRC IRs 05000346/2015001 (ADAMS Accession No. ML15113B387), 05000346/2015002 (ADAMS Accession No. ML15202A203), 05000346/2015003 (ADAMS Accession No. ML15295A107), and 05000346/2015004 (ADAMS Accession No. ML16034A366). Several of the monitoring well locations sampled as part of the licensee's ongoing investigations indicated tritium levels above the 2,000 picocuries per liter (pCi/L) groundwater monitoring program threshold requiring courtesy notifications to state and local government officials and the NRC resident inspectors. The highest tritium concentration, approximately 10,527 pCi/L from a sample obtained on February 10, 2015, was located in a monitoring well, designated MW-22S, on the west side of the plant near the borated water storage tank (BWST). The formal reporting limit threshold for tritium in groundwater samples is 30,000 pCi/L, as documented in the licensees Offsite Dose Calculation Manual.

The licensee continues to monitor wells in accordance with their groundwater monitoring program as tritium concentrations continue to lower. The inspectors have reviewed the licensees compliance with their stated offsite agency reporting requirements and continue to track the licensees corrective actions.

These routine reviews for samples to detect tritium in groundwater did not constitute any additional inspection samples. Instead, they were considered as part of the inspectors daily plant status monitoring activities.

b. Findings

No findings were identified.

4OA6 Management Meetings

.1 Exit Meeting Summary

On April 5, 2016, the inspectors presented the inspection results to the General Plant Manager, Mr. Doug Saltz, and other members of the licensee staff. The licensee acknowledged the issues presented. The inspectors confirmed with the licensee the scope of material reviewed that was considered to be proprietary. All proprietary information reviewed by the inspectors was controlled in accordance with appropriate NRC policies regarding sensitive unclassified information, and, as applicable, has been denoted as proprietary in the Attachment.

4OA7 Licensee-Identified Violation

The following violation of very low significance (Green) was identified by the licensee and is a violation of NRC requirements; it meets the criteria of the NRC Enforcement Policy for being dispositioned as an NCV.

.1 Operating Limitation Omitted from the Reactor Engineering Guidance Provided to

Operating Crews Licensee engineering and operations personnel performed surveillance test DB-NE-03214, Moderator Temperature Coefficient Measurement by Rod Swap, on October 31, 2015, to meet the requirements of TS Surveillance Requirement 3.1.3.2.

Following completion of the test and analysis of the test data, licensee engineering personnel initiated CR 2015-14893 to document that the extrapolated moderator temperature coefficient was more negative than the limit specified in the plants Core Operating Limits Report (COLR). While licensee personnel correctly evaluated that operation of the unit could continue for the time being since the current moderator temperature coefficient value was within specifications, they failed to correctly interpret the entire Note associated with TS Surveillance Requirement 3.1.3.2. This Note required, in part, that the licensee calculate the minimum boron concentration at which the moderator temperature coefficient was projected to exceed its lower limit, and shutdown the unit prior to reaching this boron value.

On January 27, 2016, licensee engineering and operations personnel identified that they had misinterpreted the Note associated with TS Surveillance Requirement 3.1.3.2, and a minimum RCS boron concentration value should have been established. With measurement uncertainties, a minimum RCS boron value of approximately 9.8 ppm

[parts per million] was calculated by licensee engineering personnel and provided to plant operators as the minimum RCS boron limit. At that time, RCS boron had been reduced to just 16 ppm as the unit approached the normal end of the current operating cycle.

Technical Specification 5.4.1(a) requires the licensee to establish, implement, and maintain applicable written procedures for the safety-related systems and activities recommended in RG 1.33, Revision 2, Appendix A. Section 2(g) of RG 1.33, Revision 2, Appendix A, requires procedures for operation of the reactor at power and process monitoring. Contrary to these requirements, the licensee failed to properly prepare and implement technically adequate written procedures and instructions for the management of RCS boron concentration. Specifically, from October 31, 2015, through January 27, 2016, operational guidance provided to the on-watch operating crews contained no minimum RCS boron value, and during this time crews were effectively attempting to reduce RCS boron concentration to zero ppm, if possible, in preparation for the units 2016 RFO.

The objective of the Barrier Integrity Cornerstone of Reactor Safety is to provide reasonable assurance that physical design barriers (fuel cladding, RCS, and containment) protect the public from radionuclide releases caused by accidents or events. A key attribute of this objective involves maintaining design control parameters to protect the integrity of the plants nuclear fuel (e.g., core design analysis parameters associated with the COLR and Cycle 19 Reload Analysis, etc.) In accordance with NRC IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Screening, the inspectors determined that the violation was of more than minor significance in that it had a direct impact on this cornerstone objective. Specifically, the failure to have established a minimum RCS boron concentration as directed by the Note associated with TS Surveillance Requirement 3.1.3.2 could have resulted in operations personnel reducing boron concentration to the point where the plant was operating in an unanalyzed condition, possibly outside of established accident and safety analyses.

Using NRC IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 3, Barrier Integrity Screening Questions, the inspectors determined that consultation with the NRC Region III SRA was necessary to establish the violations safety significance. Following discussions with the SRA, the inspectors determined that the violation was of very low safety significance (Green), since the RCS boron concentration never was decreased below the 9.8 ppm limit.

The licensee had entered this issue into their CAP as CR 2016-01245. Licensee corrective actions included the immediate cessation of all RCS boron dilution/removal activities, the establishment of a minimum RCS boron concentration as an operational limit, and the performance of a formal causal evaluation.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

B. Boles, Site Vice President

K. Byrd, Director, Site Engineering

D. Blakely, Supervisor, Reactor Engineering

G. Cramer, Manager, Site Protection

J. Cuff, Manager, Training

J. Cunnings, Manager, Site Maintenance

A. Dawson, Manager, Chemistry

D. Hartnett, Superintendent, Operations Training

T. Henline, Manager, Site Projects

J. Hook, Manager, Design Engineering

B. Howard, Manager, Site Outage Management

D. Imlay, Director, Site Performance Improvement

B. Kremer, Manager, Site Operations

G. Laird, Manager, Technical Services Engineering

B. Matty, Manager, Plant Engineering

P. McCloskey, Manager, Site Regulatory Compliance

D. Noble, Manager, Radiation Protection

G. Nordlund, Superintendent, Radiation Protection

W. OMalley, Manager, Nuclear Oversight

R. Oesterle, Superintendent, Nuclear Operations

R. Patrick, Manager, Site Work Management

D. Saltz, General Plant Manager

J. Sturdavant, Regulatory Compliance

L. Thomas, Manager, Nuclear Supply Chain

J. Vetter, Manager, Emergency Response

G. Wolf, Supervisor, Regulatory Compliance

Nuclear Regulatory Commission

J. Cameron, Chief, Reactor Projects Branch 4

LIST OF ITEMS

Opened

05000346/2016001-01 NCV Operation of Safety Related Butterfly Valves in a Manner Beyond Design {Section 1R12.1(1)}

05000346/2016001-02 URI Service Water Header Operability While Using a Degraded No. 3 CCW HX SW Outlet Isolation Valve (SW37) for SW Header Pressure Control

{Section 1R15.1(1)}

05000346/2016001-03 URI Shield Building Emergency Ventilation System Operability with Watertight Door No. 108 Inadvertently Left Open

{Section 1R15.1(2)}

05000346/2016001-04 FIN Less than Sufficient Work Package Documentation and Instructions Resulted in an Inadequate Part Being Installed into the Plants Integrated Control System

{Section 4OA3.1(1)}

05000346/2016001-05 FIN Lack of Software Change Controls and Inadequate Corrective Action for an Operator Workaround Contributes to Complications Experienced During a Reactor Trip

{Section 4OA3.1(2)}

05000346/2016001-06 NCV Less than Adequate Procedural Instructions for Restoring Main Feedwater Following a Reactor Trip {Section 4OA3.2(1)}

Closed

05000346/2016001-01 NCV Operation of Safety Related Butterfly Valves in a Manner Beyond Design {Section 1R12.1(1)}

05000346/2016001-04 FIN Less than Sufficient Work Package Documentation and Instructions Resulted in an Inadequate Part Being Installed into the Plants Integrated Control System

{Section 4OA3.1(1)}

05000346/2016001-05 FIN Lack of Software Change Controls and Inadequate Corrective Action for an Operator Workaround Contributes to Complications Experienced During a Reactor Trip

{Section 4OA3.1(2)}

05000346/2016001-06 NCV Less than Adequate Procedural Instructions for Restoring Main Feedwater Following a Reactor Trip {Section 4OA3.2(1)}

Discussed

None