IR 05000528/2014002

IR 05000528, 529, 530-14-002; 01/01/14 - 03/31/14; Palo Verde Nuclear Generating Station; Maintenance Risk Assessments/Emergent Work Control, Operability Determinations/Functionality Assessments, and Follow-up of Events and Notices of Enfor

ML14134A398
Person / Time
Site:	Palo Verde
Issue date:	05/14/2014
From:	Nick Taylor NRC/RGN-IV/DRP/RPB-D
To:	Edington R Arizona Public Service Co
References
IR-14-002
Download: ML14134A398 (50)

Text

UNITED STATES May 14, 2014

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION - NRC INTEGRATED INSPECTION REPORT 05000528/2014002, 05000529/2014002, AND 05000530/2014002

Dear Mr. Edington:

On March 31, 2014, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Palo Verde Nuclear Generating Station Units 1, 2, and 3. On April 4, 2014, the NRC inspectors discussed the results of this inspection with Mr. R. Bement and other members of your staff. Inspectors documented the results of this inspection in the enclosed inspection report.

The NRC inspectors documented four findings of very low safety significance (Green) in this report. All of these findings involved violations of the NRC requirements. Further, inspectors documented two licensee-identified violations, which were determined to be of very low safety significance in this report. The NRC is treating these violations as non-cited violations (NCVs)

consistent with Section 2.3.2.a of the NRC Enforcement Policy.

If you contest these violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the Palo Verde Nuclear Generating Station.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspectors at the Palo Verde Nuclear Generating Station.

In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390, Public Inspections, Exemptions, Requests for Withholding, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Nicholas H. Taylor, Chief Project Branch D Division of Reactor Projects Docket Nos.: 50-528, 50-529, 50-530 License Nos: NPF-41, NPF-51, NPF-74

Enclosure:

Inspection Report 05000528/2014002, 05000529/2014002, and 05000530/2014002 w/ Attachments:

1. Supplemental Information 2. Information Request for Inspection Report 05000528/2014002, 5000529/2014002, and 05000530/2014002

REGION IV==

Docket: 05000528, 05000529, 05000530 License: NPF-41, NPF-51, NPF-74 Report: 05000528/2014002, 05000529/2014002, 05000530/2014002 Licensee: Arizona Public Service Company Facility: Palo Verde Nuclear Generating Station, Units 1, 2, and 3 Location: 5951 South Wintersburg Road Tonopah, Arizona Dates: January 1 through March 31, 2014 Inspectors: T. Brown, Senior Resident Inspector M. Baquera, Resident Inspector L. Carson II, Senior Health Physicist G. Guerra, CHP, Emergency Preparedness Inspector J. ODonnell, Health Physicist B. Parks, Project Engineer D. Reinert, Resident Inspector Approved Nicholas H. Taylor, Chief By: Project Branch D Division of Reactor Projects-1- Enclosure

SUMMARY

IR 05000528, 529, 530/2014002; 01/01/2014 - 03/31/2014; Palo Verde Nuclear Generating

Station; Maintenance Risk Assessments/Emergent Work Control, Operability Determinations/Functionality Assessments, and Follow-up of Events and Notices of Enforcement Discretion.

The inspection activities described in this report were performed between January 1, 2014, and March 31, 2014, by the resident inspectors at Palo Verde Nuclear Generating Station and inspectors from the NRCs Region IV office. Four findings of very low safety significance (Green) are documented in this report. All of these findings involved violations of NRC requirements. Additionally, NRC inspectors documented in this report, two licensee-identified violations of very low safety significance. The significance of inspection findings is indicated by their color (Green, White, Yellow, or Red), which is determined using Inspection Manual Chapter 0609, Significance Determination Process. Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, Components Within the Cross-Cutting Areas. Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process.

Cornerstone: Mitigating Systems

Green.

The inspectors reviewed a Green self-revealing non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the failure of Projects personnel to follow station procedures which required obtaining permission from either the work control or operations department prior to performing work in the vicinity of protected train equipment. As a result, Projects personnel inadvertently tripped a breaker to the emergency diesel generator A essential fan, rendering the emergency diesel generator inoperable and requiring entry into Condition B of Technical Specification 3.8.1, AC Sources - Operating. Operations personnel subsequently reset the breaker, returned the emergency diesel generator to operable status and exited Condition B of Technical Specification 3.8.1. The licensee entered this issue in the corrective action program as Condition Report Disposition Request 4495126.

The failure of plant personnel to follow station procedures for protected equipment was a performance deficiency. The performance deficiency is more than minor and therefore is a finding, because it was associated with the Mitigating Systems Cornerstone attribute of equipment performance and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors evaluated the significance of the issue under the Significance Determination Process, as defined in Inspection Manual Chapter 0609.04,

Initial Characterization of Findings, and 0609 Appendix A, The Significance Determination Process (SDP) for Findings at-Power. The inspectors determined that the finding was of very low safety significance (Green) because all questions in Exhibit 2 could be answered in the negative. The inspectors determined the finding had a cross-cutting aspect in the area of human performance associated with the training aspect, because the station did not provide adequate training to supplemental workers to ensure an understanding of standards and work requirements, in that the workers did not recognize either the safety significance of the equipment located in the vicinity of the work area or the potential impact of their actions

[H.9]. (Section 1R13)

Green.

The inspectors identified a non-cited violation of Technical Specification Limiting Condition for Operation 3.7.2, Condition G, for the failure of plant personnel to follow the actions specified in Technical Specification 3.7.2 for one main steam isolation valve inoperable in Mode 1. Specifically, following the failure of main steam isolation valve 170 on November 6, 2013, Unit 1 operators exceeded the Technical Specification time requirement to place the Unit in Mode 2 before restoring operability of the equipment. The licensee entered this issue into the corrective action program as Action Request 4521714.

The failure of plant personnel to perform the actions specified in Technical Specification 3.7.2, Condition G, was a performance deficiency. The performance deficiency is more than minor and therefore is a finding, because it affected the human performance attribute of the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors performed the initial significance determination for the failed MSIV-170. For this evaluation, the valve was failed in the open position. The inspectors used NRC Inspection Manual Chapter 0609, Attachment 0609.04, Initial Characterization of Findings, and NRC Inspection Manual Chapter 0609, Appendix A,

Exhibit 2, Mitigating Systems Screening Questions, to determine that the finding screened to a detailed risk evaluation because it involved a potential loss of one train of safety-related equipment for longer than the technical specification allowed outage time. A Region IV senior reactor analyst performed the detailed risk evaluation, which determined that the finding was of very low safety significance. This finding had a cross-cutting aspect in the area of human performance, associated with the aspect of consistent process, because the licensee did not use a consistent, systematic approach to make decisions regarding the operability of main steam isolation valve 170 [H.13]. (Section 1R15).

Green.

The inspectors reviewed a self-revealing, non-cited violation of 10 CFR Part 50,

Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the licensees failure to prescribe activities affecting quality by documented procedures of a type appropriate to the circumstances. Specifically, the licensee failed to establish appropriate procedures for performing nitrogen pre-charge checks of the main steam isolation valve (MSIV)accumulators. As a result of the licensees failure to establish appropriate procedures, the Unit 1, main steam isolation valve 170 hydraulic oil reservoir catastrophically failed on November 6, 2013, rendering the main steam isolation valve and both of its accumulators inoperable. The licensee entered this issue in the corrective action program as Condition Report Disposition Request 474316.

The licensees failure to prescribe nitrogen precharge checks by documented procedures of a type appropriate to the circumstances was a performance deficiency. The performance deficiency is more than minor and therefore is a finding, because it affected the procedure quality attribute of the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors performed the initial significance determination for the failed main steam isolation valve 170. For this evaluation, the valve was failed in the open position. The inspectors used the NRC Inspection Manual Chapter 0609,

Attachment 0609.04, Initial Characterization of Findings. The inspectors used the NRC Inspection Manual Chapter 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions. The finding screened to a detailed risk evaluation because it involved a potential loss of one train of safety related equipment for longer than the technical specification allowed outage time. A Region IV senior reactor analyst performed the detailed risk evaluation, which determined that the finding was of very low safety significance. The inspectors determined this finding has a cross-cutting aspect in the area of problem identification and resolution, associated with the operating experience aspect, because the licensee did not effectively evaluate internal operating experience when establishing procedures for the main steam system [P.5]. (Section 4OA3)

Cornerstone: Emergency Preparedness

Green.

The inspectors identified a non-cited violation of 10 CFR 50.54(q) for the failure of operations personnel to implement the emergency plan in response to a certain emergent event. Specifically, on November 6, 2013, after the hydraulic reservoir for main steam isolation valve 170 exploded during a nitrogen pre-charge pressure check, plant operators did not declare an Unusual Event as required by the emergency plan. The licensee entered the issue into the corrective action program as Action Request 4522120 and initiated an apparent cause evaluation to identify the cause and corrective actions.

The failure to implement the emergency plan and declare an Unusual Event is a performance deficiency. The performance deficiency is more than minor, and therefore is a finding, because not classifying an event potentially puts the public at risk and affected the Emergency Preparedness Cornerstone attribute of emergency response organization performance. The inspectors evaluated the finding using Manual Chapter 0609,

Appendix B, Emergency Preparedness Significance Determination Process, and determined to be of very low safety significance (Green). This finding was entered into the licensees corrective action program as Action Request 4522120. This finding has a cross-cutting aspect in the area of human performance associated with the aspect of consistent process, because the licensee did not use a consistent, systematic approach to make decisions [H.13]. (Section 4OA3)

Licensee-Identified Violations

Violations of very low safety significance that were identified by the licensee have been reviewed by the inspectors. Corrective actions taken or planned by the licensee have been entered into the licensees corrective action program. These violations and associated corrective action tracking numbers are listed in Section 4OA7 of this report.

PLANT STATUS

Units 1, 2, and 3 operated at essentially full power during the inspection period.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R04 Equipment Alignment

Partial Walkdown

a. Inspection Scope

The inspectors performed partial system walk-downs of the following risk-significant systems:

• January 30, 2014, Unit 1, Essential cooling water Train B

• January 30, 2014, Unit 3, Atmospheric dump valves Train B

• February 18, 2014, Unit 2, Emergency diesel generator Train A The inspectors reviewed the licensees procedures and system design information to determine the correct lineup for the systems. They visually verified that critical portions of the trains were correctly aligned for the existing plant configuration.

These activities constituted three partial system walk-down samples as defined in Inspection Procedure 71111.04.

b. Findings

No findings were identified.

1R05 Fire Protection

Quarterly Inspection

a. Inspection Scope

The inspectors evaluated the licensees fire protection program for operational status and material condition. The inspectors focused their inspection on four plant areas important to safety:

• January 13, 2014, Unit 3, Turbine building 100 and 140 feet elevations

• January 14, 2014, Unit 1, Emergency diesel generator building 100 feet elevation

• January 24, 2014, Unit 3, Emergency diesel generator building all elevations

• February 4, 2014, Unit 1, Unit 2, and Unit 3, Fire pump house For each area, the inspectors evaluated the fire plan against defined hazards and defense-in-depth features in the licensees fire protection program. The inspectors evaluated control of transient combustibles and ignition sources, fire detection and suppression systems, manual firefighting equipment and capability, passive fire protection features, and compensatory measures for degraded conditions.

These activities constituted four quarterly inspection samples, as defined in Inspection Procedure 71111.05.

b. Findings

No findings were identified.

1R11 Licensed Operator Requalification Program and Licensed Operator Performance

.1 Review of Licensed Operator Requalification

a. Inspection Scope

On February 18, 2014, the inspectors observed an evaluated simulator scenario performed by an operating crew. The inspectors assessed the performance of the operators and the evaluators critique of their performance. The inspectors also assessed the modeling and performance of the simulator during the requalification activities.

These activities constitute completion of one quarterly licensed operator requalification program sample, as defined in Inspection Procedure 71111.11.

b. Findings

No findings were identified.

.2 Review of Licensed Operator Performance

a. Inspection Scope

On March 17-18, 2014, the inspectors observed the performance of on-shift licensed operators in the Unit 1 main control room. At the time of the observations, the plant was in a period of heightened activity due to main turbine valve testing and nightshift duties.

The inspectors observed the operators performance of the following activities:

• Main turbine valve testing

• Containment venting

• Reactor coolant system dilution, including reactivity management brief

• Clearance coordination in preparation for dayshift maintenance activities

• Alarm responses In addition, the inspectors assessed the operators adherence to plant procedures, including 40DP-9OP02, Conduct of Shift Operations, and other operations department policies.

These activities constitute completion of one quarterly licensed operator performance sample, as defined in Inspection Procedure 71111.11.

b. Findings

No findings were identified.

1R12 Maintenance Effectiveness

a. Inspection Scope

The inspectors reviewed one instance of degraded performance or condition of safety-related structures, systems, or components (SSCs):

• March 19, 2014, Unit 3, Control element drive mechanism control system The inspectors reviewed the extent of condition of possible common cause structure, system, and component failures and evaluated the adequacy of the licensees corrective actions. The inspectors reviewed the licensees work practices to evaluate whether these may have played a role in the degradation of the SSCs. The inspectors assessed the licensees characterization of the degradation in accordance with 10 CFR 50.65 (the Maintenance Rule), and verified that the licensee was appropriately tracking degraded performance and conditions in accordance with the Maintenance Rule.

These activities constituted completion of one maintenance effectiveness sample, as defined in Inspection Procedure 71111.12.

b. Findings

No findings were identified.

1R13 Maintenance Risk Assessments and Emergent Work Control

a. Inspection Scope

The inspectors reviewed three risk assessments performed by the licensee prior to changes in plant configuration and the risk management actions taken by the licensee in response to elevated risk:

• January 7, 2014, Unit 1, Unit 2, and Unit 3, Station blackout generators 1 and 2 out of service for planned maintenance

• February 19, 2014, Unit 2, Re-term of emergency diesel generator B fuel oil transfer pump wiring and conduit

• March 10, 2014, Unit 2, Steam bypass control system pressure transmitter calibrations The inspectors verified that these risk assessments were performed timely and in accordance with the requirements of 10 CFR 50.65 (the Maintenance Rule) and plant procedures. The inspectors reviewed the accuracy and completeness of the licensees risk assessments and verified that the licensee implemented appropriate risk management actions based on the result of the assessments.

The inspectors also observed portions of three emergent work activities that had the potential to affect the functional capability of mitigating systems:

• January 31, 2014, Unit 1, Unplanned entry into Technical Specification 3.8.1 for emergency diesel generator A

• February 11, 2014, Unit 1, Emergent risk assessment following main steam isolation valve 170 over pressurization failure

• February 24, 2014, Number 2 station blackout generator failure The inspectors verified that the licensee appropriately developed and followed a work plan for these activities. The inspectors verified that the licensee took precautions to minimize the impact of the work activities on unaffected SSCs.

These activities constitute completion of six maintenance risk assessments and emergent work control inspection samples, as defined in Inspection Procedure 71111.13.

b. Findings

Introduction.

The inspectors reviewed a Green self-revealing non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the failure of Projects personnel to follow station procedures to obtain work control or operations permission prior to performing work in the vicinity of protected train equipment. As a result, Projects personnel inadvertently tripped a breaker to the emergency diesel generator A essential fan, rendering the emergency diesel generator inoperable, and requiring entry into Technical Specification 3.8.1, AC Sources -

Operating. Operations personnel subsequently reset the breaker, returned the emergency diesel generator to operable status and exited Technical Specification 3.8.1.

The licensee entered this issue in the corrective action program as Condition Report Disposition Request 4495126.

Description.

On January 16, 2014, Unit 1 operators received an alarm in the control room related to emergency diesel generator (EDG) A and dispatched an auxiliary operator to investigate. Upon arrival, the auxiliary operator discovered contract Projects personnel near the breaker for EDG A essential fan. A Projects electrician had inadvertently bumped the Ground Fault Interrupt on the breaker, which rendered EDG A inoperable, requiring entry into Technical Specification 3.8.1 Condition B. Operators subsequently reset the ground fault, restored power to the essential fan, declared EDG A operable, and exited Condition B of Technical Specification 3.8.1.

The licensees subsequent investigation revealed that contract Projects personnel had been preparing to recommence work on an unassociated plant modification. The team leader had unsuccessfully attempted to contact the work control staff for permission to proceed. While waiting to make contact for permission to proceed, the project leader directed project electricians to perform inspections in a cable tray above the essential fan breaker. The electricians placed a ladder in front of the panel and inadvertently bumped the Ground Fault Interrupt on the breaker during their inspections.

The inspectors identified that the contract Projects personnel had failed to comply with the requirements of Procedure 40DP-9AP21, Protected Equipment, as the station had identified Train A as the protected train for that work week. Specifically, step 4.5.4 requires either Shift Manager authorization or continuous work group supervisory oversight for work within two feet of protected equipment. In this case, the team leader did not obtain work control or shift manager authorization to proceed and did not provide oversight of the teams activities near the protected equipment.

The inspectors determined that the most significant contributor to this issue was the licensees failure to provide adequate training to these supplemental workers to ensure an adequate understanding of standards and work requirements. The workers did not recognize the safety significance of the equipment located in the vicinity of the work area or the potential impact of their actions. The licensee conducted a stand down with appropriate personnel to reinforce procedure requirements and expectations, and also entered the issue into the corrective action program as Condition Report Disposition Request 4495126.

Analysis.

The failure of plant personnel to follow station procedures for protected equipment was a performance deficiency. The performance deficiency is more than minor, and therefore is a finding, because it was associated with the Mitigating Systems Cornerstone attribute of equipment performance and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors evaluated the significance of the issue under the Significance Determination Process, as defined in Inspection Manual Chapter 0609.04, Initial Characterization of Findings, and 0609 Appendix A, The Significance Determination Process (SDP) for Findings at-Power.

The inspectors concluded the finding was of very low safety significance (Green)because all questions in Exhibit 2 could be answered in the negative. The inspectors determined the finding had a cross-cutting aspect in the area of human performance because the station failed to provide adequate training to supplemental workers to ensure an understanding of standards and work requirements, in that the workers did not recognize either the safety significance of the equipment located in the vicinity of the work area or the potential impact of their actions [H.9].

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and be accomplished in accordance with these instructions, procedures, or drawings. Procedure 40DP-9AP21, Protected Equipment, required plant personnel to obtain shift manager permission prior to work within two feet of protected equipment and provide continuous work group supervisory oversight of the work. Contrary to the above, on January 16, 2014, plant personnel failed to accomplish an activity affecting quality in accordance with the prescribed procedures. Specifically, prior to work within two feet of protected equipment, Projects personnel did not obtain shift manager permission, and did not provide continuous work group supervisory oversight. As a result, Projects personnel inadvertently tripped a breaker to the emergency diesel generator A essential fan, rendering the emergency diesel generator inoperable, and requiring entry into Condition B of Technical Specification 3.8.1, AC Sources -

Operating. Operations personnel subsequently reset the breaker, returned the emergency diesel generator to operable status and exited Condition B of Technical Specification 3.8.1. This finding is of very low safety significance and has been entered into the licensees corrective action program as Condition Report Disposition Request 4495126, this violation is being treated as a non-cited violation in accordance with Section 2.3.2.a of the Enforcement Policy: NCV 05000528/2014002-01, Failure to Follow Protected Equipment Procedure.

1R15 Operability Determinations and Functionality Assessments

a. Inspection Scope

The inspectors reviewed seven operability determinations that the licensee performed for degraded or nonconforming SSCs:

• January 2, 2014, Unit 1, Operability determination of emergency diesel generator A alarm issues

• January 15, 2014, Unit 3, Operability determination of containment spray, Train A, piping voids exceeding surveillance acceptance criteria

• January 29, 2014, Unit 1, Operability determination of essential chiller B low oil level

• February 3, 2014, Unit 2, Operability determination of essential chilled water pumps A and B seal leakage

• February 18, 2014, Unit 2, Operability determination of unexpected concrete found encapsulating diesel fuel oil piping

• March 7, 2014, Unit 1, Operability determination of main steam isolation valve 170 over pressurization failure

• March 18, 2014, Unit 3, Operability determination of dropped control element assembly The inspectors reviewed the timeliness and technical adequacy of the licensees evaluations. Where the licensee determined the degraded structure, system, or component to be operable, the inspectors verified that the licensees compensatory measures were appropriate to provide reasonable assurance of operability. The inspectors verified that the licensee had considered the effect of other degraded conditions on the operability of the degraded structure, system, or component.

These activities constitute completion of seven operability review samples, as defined in Inspection Procedure 71111.15.

b. Findings

Introduction.

The inspectors identified a Green, non-cited violation of Technical Specification Limiting Condition for Operation 3.7.2, Condition G, for the failure of plant personnel to follow the actions specified in Technical Specification 3.7.2 for one main steam isolation valve inoperable in Mode 1. Specifically, following the failure of main steam isolation valve (MSIV) 170, Unit 1 operators exceeded the technical specification time requirement to place the Unit in Mode 2 before restoring operability of the equipment.

Description.

The function of the main steam supply system is to deliver steam from the steam generators to the high pressure turbine. Each main steam line has one MSIV.

The MSIVs can close when needed to isolate the steam generators from the main steam system. The MSIV hydraulic actuation system provides the motive force to quickly close each MSIV. For each MSIV, this system includes two accumulators pre-charged with nitrogen, a single hydraulic fluid reservoir, and a single hydraulic pump that takes suction on the hydraulic reservoir and pressurizes both accumulators.

On November 6, 2013, the Unit 1 control room received a low-level alarm associated with the hydraulic fluid reservoir for MSIV 170. The alarm response procedure requires a nitrogen pre-charge check of each accumulator. When the licensee repositioned valves in the hydraulic actuation system to discharge the hydraulic fluid from the A accumulator back to the reservoir, the hydraulic reservoir catastrophically failed. The failure occurred because high pressure nitrogen had leaked by the accumulator piston o-ring seal, had become entrained in the hydraulic fluid, and then had rapidly expanded once it reached the reservoir. As a result, hydraulic fluid was ejected onto the walls, ceiling, and adjacent equipment. Also, the over-pressurization ruptured the hydraulic fluid reservoir, ejected the lid, and damaged a hydraulic line supplying the B accumulator, rendering the MSIV and both of its accumulators inoperable.

Technical Specification 3.7.2, Main Steam Isolation Valves, requires that four MSIVs, and their associated actuator trains, be operable in Mode 1. Following the event, the licensee declared MSIV-170 and its A and B accumulators inoperable, and entered Technical Specifications 3.7.2 Conditions A, D, and F.

Of the required actions, Condition F requires the most immediate response. Condition F requires that the MSIV be restored to operable status within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. If not completed, Condition G must be entered, and the MSIV must be either restored to operable status or the Unit must be placed into Mode 2 within an additional 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Because the licensee was not able to make repairs to the damaged accumulators, Unit 1 operators entered Condition G approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the event. Operators engaged station management, engineering, and regulatory affairs personnel to discuss Technical Specification 3.7.2 and its basis. The licensee concluded that they could declare MSIV 170 operable if operators were able to downpower and then close the valve and deactivate it. Approximately 9.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the event, operators reduced plant power to approximately 60 percent, closed MSIV-170, and exited Limiting Condition for Operation 3.7.2, Conditions A, D, F, and G.

The licensee initiated repairs to the valve and on November 9, 2013, completed the required maintenance and re-opened the MSIV.

The inspectors challenged the licensees decision to exit Technical Specification Limiting Condition for Operation 3.7.2 Condition G. The associated action statements prescribe a specific sequence of actions to take to address an inoperable MSIV. The Technical Specification basis for Action F states, in part:

With one MSIV inoperable in MODE 1, time is allowed to restore the component to operable status.

Similarly, the basis for Condition G states, in part:

If the MSIV cannot be restored to operable within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Condition H would be entered.

These bases do not mention closure of an inoperable MSIV until after Condition H (Mode 2) is entered. However, the Technical Specification basis clearly differentiates between an operable MSIV and a closed MSIV. The basis statement for Condition H states:

Since the MSIVs are required to be operable in Modes 2 and 3, the inoperable MSIVs may either be restored to operable status or closed.

The inspectors noted that if the licensee had entered Mode 2 before closing the MSIV, they would have been in compliance with the actions required by Condition H, but the MSIV would have still remained inoperable, and the Unit would have remained in Limiting Condition for Operation Condition H until the valve could be repaired and restored to operable status. The Technical Specifications do not contain an allowance to operate with a closed MSIV in Mode 1.

The inspectors also noted that the licensees operating procedures do not allow a MSIV to be closed while at power. Operating Procedure 40OP-9SG01, Main Steam, contains instructions for shutting down the main steam system and includes guidance for closure of the MSIVs. However, the prerequisite for performing the shutdown of the main steam system is that the MSIVs are no longer required to be open for reactor coolant system heat removal. On November 6, 2013, licensee personnel performed the MSIV closure without written procedures via skill-of-the-craft.

The inspectors also questioned the licensees basis for operability of the A and B accumulators for MSIV-170. The licensee concluded that although the A and B accumulators had previously been declared inoperable, due to not being able to maintain pressure, those components would not be required for MSIV operability if the MSIV was closed and deactivated. As part of the corrective maintenance following the event, the licensee removed the damaged A accumulator so that they could replace it.

Yet during this time, the licensee considered the accumulator still operable, despite not being physically located within the plant. The inspectors challenged this justification because applicability description associated with Technical Specification Limiting Condition for Operation 3.7.2 contains no provision for the accumulators being required only if needed to support MSIV operation. The inspectors noted that the technical specification basis specifically states that the conditions and required Actions for Technical Specification 3.7.2 separately address inoperability of the MSIV actuator trains and inoperability of the valves themselves. Thus, the actuator trains are not defined as supporting components. In Limiting Condition for Operation 3.7.2, Conditions A, B, and C specifically require the licensee to restore an inoperable actuator train to operable status. None of these action statements depends on the position of the MSIV.

The inspectors determined that the most significant contributor to this issue was the lack of a consistent, systematic approach to make decisions regarding the operability of MSIV-170. The licensee has entered this issue into their corrective action program as Action Request 4521714, and initiated action to provide additional training to plant personnel.

Analysis.

The inspectors determined that the failure of plant personnel to perform the actions specified in Technical Specification 3.7.2, Condition G, was a performance deficiency. The inspectors concluded the performance deficiency is more than minor, and therefore is a finding, because it affected the human performance attribute of the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors performed the initial significance determination for the failed MSIV-170. For this evaluation, the valve was failed in the open position. The inspectors used the NRC Inspection Manual Chapter 0609, Attachment 0609.04, Initial Characterization of Findings. The inspectors used the NRC Inspection Manual Chapter 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions. The finding screened to a detailed risk evaluation because it involved a potential loss of one train of safety related equipment for longer than the technical specification allowed outage time.

A Region IV senior reactor analyst performed the detailed risk evaluation. The analyst used the Standardized Plant Analysis Risk model, Revision 8.20, with a truncation limit of E-11 to evaluate this performance deficiency. The exposure period was 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />.

The analyst set the basic even associated with main steam isolation valve 170 failure to close to a probability of failure of 1.0. The change to the core damage frequency for the exposure period was 1.5E-8/year. Since the change to the core damage frequency was less than 1E-7, the analyst was not required to consider external events or the large early release frequency. The dominant core damage sequences included a steam generator tube rupture event in steam generator 1, the failure to isolate the steam generator (the main steam isolation valve failed open), and the failure to refill the refueling water storage tank. The second most common event included losses of offsite power, but the gas turbine generators, the diesel generators and the auxiliary feedwater system helped to limit the risk.

The inspectors also considered the period while the valve was failed in the closed position. A Region IV senior reactor analyst performed the detailed risk evaluation. The exposure period was 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This failure mode coincides with the valves safety position (closed). The failure mode was not included in the Standardized Plant Analysis Risk model and there were no clear core damage sequences associated with this particular failure. The bounding change to the core damage frequency was less than E-7/year. The finding was not significant to the large early release frequency.

Since the calculated change to the core damage frequency was less than 1E-6, and the large early release frequency was not a significant contributor, the finding was of very low safety significance.

The inspectors determined this finding had a cross-cutting aspect in the area of human performance associated with the component of consistent process because the licensee failed to use a consistent, systematic approach to make decisions regarding the operability of MSIV-170 [H.13].

Enforcement.

Technical Specification 3.7.2, Condition F, requires that with one main steam isolation valve inoperable in Mode 1, actions must be taken to restore the inoperable main steam isolation valve to operable status within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. If these actions are not completed, Technical Specification 3.7.2, Condition G, requires that the Unit be placed in Mode 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Contrary to the above, on November 7, 2013, operations personnel failed to place Unit 1 in Mode 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, as required by Technical Specification 3.7.2, Condition G, for an inoperable main steam isolation valve that had not been restored to operable within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> as required by Technical Specification 3.7.2, Condition F. This resulted in MSIV-170 exceeding the Technical Specification 3.7.2 allowed outage time. Because this finding is of very low safety significance and has been entered into the licensees corrective action program as Action Request 4521714, this violation is being treated as a non-cited violation in accordance with Section 2.3.2.a of the Enforcement Policy:

NCV 05000528/2014002-02, Failure to Comply with Technical Specification 3.7.2.

1R18 Plant Modifications

a. Inspection Scope

On January 6, 2014, the inspectors reviewed a temporary modification to isolate one failed lube oil heater for emergency diesel generator A in Unit 2.

The inspectors verified that the licensee had installed this temporary modification in accordance with technically adequate design documents. The inspectors verified that this modification did not adversely impact the operability or availability of affected SSCs.

The inspectors reviewed design documentation and plant procedures affected by the modification to verify the licensee maintained configuration control.

These activities constitute completion of one sample of temporary modifications, as defined in Inspection Procedure 71111.18.

b. Findings

No findings were identified.

1R19 Post-Maintenance Testing

a. Inspection Scope

The inspectors reviewed five post-maintenance testing activities that affected risk-significant SSCs:

• January 30, 2014, Startup transformer NANX01 after planned maintenance

• February 1, 2014, Train A atmospheric dump valves after replacement of thermal relief valves for planned maintenance

• February 19, 2014, Diesel fuel oil piping Train B after corrective maintenance due to through-wall damage to pipe

• February 19, 2014, Unit 2, Re-term of emergency diesel generator B fuel oil transfer pump wiring and conduit

• March 4, 2014, Unit 1, MSIV 170 post maintenance testing The inspectors reviewed licensing- and design-basis documents for the SSCs and the maintenance and post-maintenance test procedures. The inspectors observed the performance of the post-maintenance tests to verify that the licensee performed the tests in accordance with approved procedures, satisfied the established acceptance criteria, and restored the operability of the affected SSCs.

These activities constitute completion of five post-maintenance testing inspection samples, as defined in Inspection Procedure 71111.19.

b. Findings

No findings were identified.

1R22 Surveillance Testing

a. Inspection Scope

The inspectors observed five risk-significant surveillance tests and reviewed test results to verify that these tests adequately demonstrated that the SSCs were capable of performing their safety functions:

In-service tests:

• January 30, 2014, Unit 3, Containment spray Train A in-service test

• March 5, 2014, Unit 2, Containment spray Train A in-service test Other surveillance tests:

• January 23, 2014, Unit 3, Low pressure safety injection and containment spray piping Train A alignment verification

• January 30, 2014, Unit 1, Essential cooling water Train B pump test

• March 5, 2014, Unit 3, Emergency diesel generator Train A fuel oil transfer pump test The inspectors verified that these tests met technical specification requirements, that the licensee performed the tests in accordance with their procedures, and that the results of the test satisfied appropriate acceptance criteria. The inspectors verified that the licensee restored the operability of the affected SSCs following testing.

These activities constitute completion of five surveillance testing inspection samples, as defined in Inspection Procedure 71111.22.

b. Findings

No findings were identified.

1EP2 Alert and Notification System Evaluation

a. Inspection Scope

The inspectors verified the adequacy of the licensees methods for testing the primary and backup alert and notification system (ANS). The inspectors also reviewed the licensees program for identifying emergency planning zone locations requiring tone alert radios and for distributing the radios. The inspectors interviewed licensee personnel responsible for the maintenance of the primary and backup ANS and reviewed a sample of corrective action system reports written for ANS problems. The inspectors compared the licensees alert and notification system testing program with criteria in NUREG-0654, Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and Preparedness in Support of Nuclear Power Plants, Revision 1; FEMA Report REP-10, Guide for the Evaluation of Alert and Notification Systems for Nuclear Power Plants, and the licensees current FEMA-approved alert and notification system design report, FEMA 350 - ANS Addendum (No. 2), dated September 23, 2011.

These activities constituted completion of one alert and notification system evaluation sample as defined in Inspection Procedure 71114.02.

b. Findings

No findings were identified.

1EP3 Emergency Response Organization Staffing and Augmentation System

a. Inspection Scope

The inspectors verified the licensees emergency response organization on-shift and augmentation staffing levels were in accordance with the licensees emergency plan commitments. The inspectors reviewed documentation and discussed with licensee staff the operability of primary and backup systems for augmenting the on-shift emergency response staff to verify the adequacy of the licensees methods for staffing emergency response facilities, including the licensees ability to staff pre-planned alternate facilities.

The inspectors also reviewed records of emergency response organization augmentation tests and events to determine whether the licensee had maintained a capability to staff emergency response facilities within emergency plan timeliness commitments.

These activities constitute completion of one emergency response organization staffing and augmentation testing sample as defined in Inspection Procedure 71114.03.

b. Findings

No findings were identified.

1EP5 Maintenance of Emergency Preparedness

a. Inspection Scope

The inspectors reviewed the following for the period January 2012 to February 2014;

• After-Action reports for emergency classifications and events;

• After-Action evaluation reports for licensee drills and exercises;

• Independent audits and surveillances of the licensees emergency preparedness program;

• Self-Assessments of the emergency preparedness program conducted by the licensee;

• Drill and Exercise performance issues entered into the licensees Corrective Action Program;

• Emergency preparedness program issues entered into the licensees Corrective Action Program; and,

• Emergency response organization training records.

The inspectors reviewed summaries of 906 corrective action program reports associated with emergency preparedness and selected 45 to review against program requirements, to determine the licensees ability to identify, evaluate, and correct problems in accordance with planning standard 10 CFR 50.47(b)(14) and 10 CFR Part 50, Appendix E, IV.F. The inspectors verified that the licensee accurately and appropriately identified and corrected emergency preparedness weaknesses during critiques and assessments.

The inspectors reviewed records pertaining to the maintenance of equipment and facilities used to implement the emergency plan to determine the licensees ability to maintain equipment in accordance with the requirements of 10 CFR 50.47(b)(8)and 10 CFR Part 50, Appendix E, IV.E. The inspectors verified that equipment and facilities were maintained in accordance with the commitments of the licensees emergency plan.

These activities constitute completion of one sample of the maintenance of the licensees emergency preparedness program as defined in Inspection Procedure 71114.05.

b. Findings

No findings were identified.

1EP6 Drill Evaluation

Emergency Preparedness Drill Observation

a. Inspection Scope

The inspectors observed two emergency preparedness drills on January 14, 2014, and on March 5, 2014, to verify the adequacy and capability of the licensees assessment of drill performance. The inspectors reviewed the drill scenarios, observed the drills from the Technical Support Center and Emergency Operations Facility, and attended the post-drill critiques. The inspectors verified that the licensees emergency classifications, off-site notifications, and protective action recommendations were appropriate and timely.

The inspectors verified that any emergency preparedness weaknesses were appropriately identified by the licensee in the post-drill critiques and entered into the corrective action program for resolution.

These activities constitute completion of two emergency preparedness drill observation samples, as defined in Inspection Procedure 71114.06.

b. Findings

No findings were identified.

RADIATION SAFETY

Cornerstones: Public Radiation Safety and Occupational Radiation Safety

2RS2 Occupational ALARA Planning and Controls

a. Inspection Scope

The inspectors assessed licensee performance with respect to maintaining occupational individual and collective radiation exposures as low as is reasonably achievable (ALARA). During the inspection, the inspectors interviewed licensee personnel and reviewed licensee performance in the following areas:

• Site-specific ALARA procedures and collective exposure history, including the current 3-year rolling average, site-specific trends in collective exposures, and source-term measurements

• ALARA work activity evaluations/post job reviews, exposure estimates, and exposure mitigation requirements

• The methodology for estimating work activity exposures, the intended dose outcome, the accuracy of dose rate and man-hour estimates, and intended versus actual work activity doses and the reasons for any inconsistencies

• Records detailing the historical trends and current status of tracked plant source terms and contingency plans for expected changes in the source term due to changes in plant fuel performance issues or changes in plant primary chemistry

• Radiation worker and radiation protection technician performance during work activities in radiation areas, airborne radioactivity areas, or high radiation areas Audits, self-assessments, and corrective action documents related to ALARA planning and controls since the last inspection These activities constitute completion of one sample of occupational ALARA planning and controls as defined in Inspection Procedure 71124.02.

b. Findings

No findings were identified.

2RS4 Occupational Dose Assessment

a. Inspection Scope

The inspectors evaluated the accuracy and operability of the licensees personnel monitoring equipment, verified the accuracy and effectiveness of the licensees methods for determining total effective dose equivalent, and verified that the licensee was appropriately monitoring occupational dose. The inspectors interviewed licensee personnel, walked down various portions of the plant, and reviewed licensee performance in the following areas:

• External dosimetry accreditation, storage, issue, use, and processing of active and passive dosimeters

• The technical competency and adequacy of the licensees internal dosimetry program

• Adequacy of the dosimetry program for special dosimetry situations such as declared pregnant workers, multiple dosimetry placement, and neutron dose assessment

• Audits, self-assessments, and corrective action documents related to dose assessment since the last inspection These activities constitute completion of one sample of occupational dose assessment as defined in Inspection Procedure 71124.04.

b. Findings

No findings were identified.

OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Security

4OA1 Performance Indicator Verification

.1 Drill/Exercise Performance (EP01)

a. Inspection Scope

The inspectors reviewed the licensees evaluated exercises and selected drill and training evolutions that occurred between January 2013 and December 2013 to verify the accuracy of the licensees data for classification, notification, and protective action recommendation (PAR) opportunities. The inspectors reviewed a sample of the licensees completed classifications, notifications, and protective action recommendations to verify their timeliness and accuracy. The inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, to determine the accuracy of the data reported. The specific documents reviewed are described in the attachment to this report.

These activities constituted verification of the drill/exercise performance indicator as defined in Inspection Procedure 71151.

b. Findings

No findings were identified.

.2 Emergency Response Organization Drill Participation (EP02)

a. Inspection Scope

The inspectors reviewed the licensees records for participation in drill and training evolutions between January 2013 and December 2013 to verify the accuracy of the licensees data for drill participation opportunities. The inspectors verified that all members of the licensees emergency response organization (ERO) in the identified key positions had been counted in the reported performance indicator data. The inspectors reviewed the licensees basis for reporting the percentage of emergency response organization members who participated in a drill. The inspectors reviewed drill attendance records and verified a sample of those reported as participating. The inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, to determine the accuracy of the data reported. The specific documents reviewed are described in the attachment to this report.

These activities constituted verification of the emergency response organization drill participation performance indicator as defined in Inspection Procedure 71151.

b. Findings

No findings were identified.

.3 Alert and Notification System Reliability (EP03)

a. Inspection Scope

The inspectors reviewed the licensees records of Alert and Notification System tests conducted between January 2013 and December 2013 to verify the accuracy of the licensees data for siren system testing opportunities. The inspectors reviewed procedural guidance on assessing Alert and Notification System opportunities and the results of periodic alert and notification system operability tests. The inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, to determine the accuracy of the data reported. The specific documents reviewed are described in the attachment to this report.

These activities constituted verification of the alert and notification system reliability performance indicator as defined in Inspection Procedure 71151.

b. Findings

No findings were identified.

.4 Unplanned Scrams per 7000 Critical Hours (IE01)

a. Inspection Scope

The inspectors reviewed licensee event reports (LERs) for the period of January 1, 2013 through December 31, 2013, to determine the number of scrams that occurred. The inspectors compared the number of scrams reported in these licensee event reports to the number reported for the performance indicator. Additionally, the inspectors sampled monthly operating logs to verify the number of critical hours during the period. The inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, to determine the accuracy of the data reported.

These activities constituted verification of the Unplanned Scrams per 7000 Critical Hours performance indicator for Units 1, 2 and 3, as defined in Inspection Procedure 71151.

b. Findings

No findings were identified.

.5 Unplanned Power Changes per 7000 Critical Hours (IE03)

a. Inspection Scope

The inspectors reviewed operating logs, corrective action program records, and monthly operating reports for the period of January 1, 2013 through December 31, 2013, to determine the number of unplanned power changes that occurred. The inspectors compared the number of unplanned power changes documented to the number reported for the performance indicator. Additionally, the inspectors sampled monthly operating logs to verify the number of critical hours during the period. The inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, to determine the accuracy of the data reported.

These activities constituted verification of the Unplanned Power Outages per 7000 Critical Hours performance indicator for Units 1, 2 and 3, as defined in Inspection Procedure 71151.

b. Findings

No findings were identified.

.6 Unplanned Scrams with Complications (IE04)

a. Inspection Scope

The inspectors reviewed the licensees basis for including or excluding in this performance indicator each scram that occurred between January 1, 2013 and December 31, 2013. The inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, to determine the accuracy of the data reported.

These activities constituted verification of the unplanned scrams with complications performance indicator for Units 1, 2 and 3, as defined in Inspection Procedure 71151.

b. Findings

No findings were identified.

4OA2 Problem Identification and Resolution

.1 Routine Review

a. Inspection Scope

Throughout the inspection period, the inspectors performed daily reviews of items entered into the licensees corrective action program and periodically attended the licensees condition report screening meetings. The inspectors verified that licensee personnel were identifying problems at an appropriate threshold and entering these problems into the corrective action program for resolution. The inspectors verified that the licensee developed and implemented corrective actions commensurate with the significance of the problems identified. The inspectors also reviewed the licensees problem identification and resolution activities during the performance of the other inspection activities documented in this report.

b. Findings

No findings were identified.

.2 Annual Follow-up of Selected Issues

a. Inspection Scope

The inspectors selected one issue for an in-depth follow-up:

• On January 13, 2014, the inspectors selected introduction of foreign material into Unit 3 steam generator number 1 on October 9, 2013, as documented in Condition Report Disposition Request 4466275.

The inspectors assessed the licensees problem identification threshold, cause analyses, extent of condition reviews, and compensatory actions. The inspectors verified that the licensee appropriately prioritized the corrective actions and that these actions were adequate to correct the condition.

These activities constitute completion of one annual follow-up sample as defined in Inspection Procedure 71152.

b. Findings

No findings were identified.

4OA3 Follow-up of Events and Notices of Enforcement Discretion

.1 (Closed) Licensee Event Report 05000530/2013-002-00, Condition Prohibited by

Technical Specifications During Dropped Control Element Assembly Recovery On December 3, 2013, while recovering from a dropped control element assembly, Unit 3 operators inappropriately exited Technical Specifications Limiting Condition for Operation 3.2.1 and 3.2.4. The licensee issued the licensee event report to report a condition prohibited by Technical Specifications.

The licensee concluded the root cause of this event was that the operating crew inappropriately exited Limiting Condition for Operation 3.2.1 and Limiting Condition for Operation 3.2.4 prior to fully understanding and reconciling instrument and alarm discrepancies. The licensee has conducted training on this event during the licensed operator continuing training process and has planned corrective actions to revise the Conduct of Shift Operations and CEA Malfunctions procedures to include lessons learned from this event. The inspectors dispositioned this issue as a licensee-identified violation in Section 4OA7 of this inspection report. This licensee event report is closed.

.2 Unit 1 Main Steam Isolation Valve Failure

a. Inspection Scope

The inspectors reviewed the licensees response to a catastrophic failure of a main steam isolation valve in Unit 1 on November 6, 2013.

.1 Failure to Establish Adequate Procedures for Performing Nitrogen Pre-Charge Checks

Introduction.

The inspectors reviewed a self-revealing, Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the licensees failure to prescribe activities affecting quality by documented procedures of a type appropriate to the circumstances. Specifically, the licensee failed to establish appropriate procedures for performing nitrogen pre-charge checks of the MSIV accumulators. As a result of the licensees failure to establish appropriate procedures, the Unit 1 MSIV-170 hydraulic oil reservoir catastrophically failed on November 6, 2013, rendering the main steam isolation valve and both of its accumulators inoperable.

Description.

The function of the main steam supply system is to deliver steam from the steam generators to the high pressure turbine. Each main steam line has one MSIV.

The MSIVs can close when needed to isolate the steam generators from the main steam system. The MSIV hydraulic actuation system provides the motive force to quickly close the MSIV. The system includes two accumulators pre-charged with nitrogen, a single hydraulic fluid reservoir, and a single hydraulic pump that takes suction on the hydraulic reservoir and pressurizes both accumulators.

Operation of this system requires periodic accumulator pressure adjustments due to thermal cycles such as daytime heating, as well as nitrogen pre-charge checks to confirm that the static nitrogen pressure is adequate to rapidly close the MSIV within the allowed time. Procedure 40OP-9SG01, Main Steam, describes the actions to perform both pressure reductions of the MSIV accumulators and nitrogen pre-charge checks.

Since 2010, periodic pressure reductions due to ambient temperature variations from daytime to night are accomplished using needle valves that are part of a thermal relief valve manifold assembly. In contrast, to perform the pre-charge check, the accumulators hydraulic fluid is rapidly discharged to the hydraulic fluid reservoir by actuating a four-way valve.

On November 6, 2013, the Unit 1 control room received a low-level alarm associated with the hydraulic fluid reservoir for MSIV-170. The alarm response procedure requires a pre-charge check of each accumulator. When the licensee re-positioned valves in the manifold to discharge the hydraulic fluid from the A accumulator back to the reservoir, the hydraulic reservoir catastrophically failed. The failure occurred because high-pressure nitrogen had leaked by the accumulator piston o-ring seal, had become entrained in the hydraulic fluid, and had then rapidly expanded once it reached the reservoir. As a result, hydraulic fluid was ejected onto the walls, ceiling, and adjacent equipment. Also, the over-pressurization ruptured the hydraulic fluid reservoir, ejected the lid, and damaged a hydraulic line supplying the B accumulator, rendering the MSIV and both of its accumulators inoperable.

The licensee declared the MSIV and both the A and B accumulators inoperable and entered Technical Specifications 3.7.2, Main Steam Isolation Valves. The licensee replaced the ruptured hydraulic reservoir and damaged piping and restored the valve to operable status on November 9, 2013. The licensee subsequently modified their operating procedures to use only the installed thermal relief bypass valves to depressurize the accumulators in a slower, more controlled manner when performing nitrogen pre-charge checks. The licensee has entered this issue into their corrective action program as Condition Report Disposition Request 4474316.

The licensees corrective action program documented many instances in which these operations caused significant pressure transients within the MSIV hydraulic actuation system. Questions regarding the adequacy of the venting of the MSIV hydraulic system arose as early as 1996. Condition Report Disposition Request 9-6-0512 identified that during testing, the lack of venting capacity causes the hydraulic reservoirs to bulge due to the fast pressurization for which they were not designed. The evaluation documented that many of MSIV hydraulic fluid reservoirs showed signs of bulging, but concluded that the pressure transients only occurred during testing, and therefore, recommended that no changes be made to the system or operating procedures.

Many other corrective action documents have described events during maintenance or testing evolutions, in which the hydraulic fluid dipstick caps were ejected from the reservoirs and hydraulic fluid sprayed across the main steam support structure room.

The documents include Review Condition Report Disposition Request 3-7-018, Adverse Condition Reports Disposition Requests 1-7-0276, 1-7-0297, 2-8-0268, 2358770, and Action Requests 3131201, 4130649, and 4336251, which describe other events that occurred between 1997 and January 2013. None of the previous evaluations recognized the pressure transients as a potential negative impact to the operability of the MSIV.

The inspectors concluded the most significant contributor to this issue was an ineffective use of station operating experience. In 2010, the licensee added thermal relief valves that were intended to provide a secondary means of ensuring accumulator pressure remained within the limits of the nitrogen accumulators. Prior to this modification, periodic pressure reductions could only be accomplished by use of a four-way valve that often resulted in pressure being reduced below the lower operability limit. When they installed the relief valves, the licensee changed the pressure reduction instructions in Procedure 40OP-9SG01, Main Steam, to use the newly installed valves for reducing pressure. A licensee procedure reviewer, who was aware of the potential for hydraulic fluid to eject from the reservoir, determined that this new method would not cause the hydraulic fluid ejections that had occurred previously. However, the licensee changed only the pressure-reduction section of the procedure. Notably, the licensee did not change the pre-charge check instructions to also use the thermal relief valves. From May 2010 to November 2013, Procedure 40OP-9SG01, Main Steam, underwent eight revisions, but none identified that the thermal relief valves could be used to address the stations history of hydraulic oil ejections during testing.

Analysis.

The inspectors determined the licensees failure to prescribe nitrogen precharge checks by documented procedures of a type appropriate to the circumstances was a performance deficiency. The inspectors determined that the performance deficiency is more than minor, and therefore is a finding, because it affected the procedure quality attribute of the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors performed the initial significance determination of this finding based on the failed MSIV-170. For this evaluation, the valve was failed in the open position. The inspectors used the NRC Inspection Manual Chapter 0609, Attachment 0609.04, Initial Characterization of Findings. The inspectors used the NRC Inspection Manual Chapter 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions. The finding screened to a detailed risk evaluation because it involved a potential loss of one train of safety related equipment for longer than the technical specification allowed outage time.

A Region IV senior reactor analyst performed the detailed risk evaluation. The analyst used the Standardize Plant Analysis Risk model, Revision 8.20, with a truncation limit of E-11 to evaluate this performance deficiency. The exposure period was 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />. The analyst set the basic even associated with MSIV-170 failure to close to a probability of failure of 1.0. The change to the core damage frequency for the exposure period was 1.5E-8/year. Since the change to the core damage frequency was less than 1E-7, the analyst was not required to consider external events or the large early release frequency. The dominant core damage sequences included a steam generator tube rupture event in steam generator 1, the failure to isolate the steam generator (the MSIV failed open), and the failure to refill the refueling water storage tank. The second most common event included losses of offsite power, but the gas turbine generators, the diesel generators, and the auxiliary feedwater system helped to limit the risk.

The inspectors determined this finding has a cross-cutting aspect in the area of problem identification and resolution, associated with the operating experience aspect, because the licensee did not effectively evaluate internal operating experience when establishing procedures for the main steam system [P.5].

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, states, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Contrary to the above, the licensee failed to prescribe activities affecting quality by documented procedures of a type appropriate to the circumstances. Specifically, prior to November 6, 2013, Procedure 40OP-9SG01, did not incorporate the use of thermal relief valves into the pre-charge check instructions to reduce pressure in the nitrogren accumulators. As a result, the main steam isolation valve hydraulic reservoirs became overpressurized when the licensee performed nitrogen pre-charge checks. In response to this finding, the licensee implemented a temporary procedure change directing the use to the thermal relief bypass valves for a controlled depressurization of the main steam isolation valve accumulators during pre-charge checks. Because this finding is of very low safety significance (Green) and was entered into the corrective action program as Condition Report Disposition Request 4474316, this violation is being treated as a non-cited violation in accordance with Section 2.3.2.a of the Enforcement Policy: NCV 05000528/2014002-03, Failure to Establish Adequate Procedures for Performing Nitrogen Pre-Charge Checks.

.2 Failure to Declare an Unusual Event

Introduction.

The inspectors identified a Green, non-cited violation of 10 CFR 50.54(q)for the failure of operations personnel to implement the emergency plan in response to a certain event. Specifically, on November 6, 2013, after the hydraulic reservoir for MSIV-170 exploded during a nitrogen pre-charge pressure check, plant operators did not declare an Unusual Event as required by the emergency plan. The licensee entered the issue into the corrective action program as Action Request 4522120 and initiated an apparent-cause evaluation to identify the cause and corrective actions.

Description.

On November 6, 2013, Unit 1 control room operators received an MSIV 170 hydraulic reservoir low level alarm. Alarm response Procedure 40AL-9RK6A, Panel B06A Alarm Responses, requires a MSIV accumulator nitrogen pre-charge pressure check. To perform this check, the licensee discharges all hydraulic fluid from each of the MSIVs two accumulators in order to measure the nitrogen pressure remaining. While performing the MSIV-170, Train A, accumulator pre-charge check, at 1:07 p.m., the Unit 1 control room received a simultaneous MSIV trouble alarm, hydraulic accumulator A pressure low alarm, and a hydraulic accumulator B pressure low alarm. At that same instant, an auxiliary operator standing by in the adjacent main steam support structure room heard a loud noise and looked out of the door to investigate. The auxiliary operator radioed to the control room staff that the hydraulic reservoir for MSIV-170 had catastrophically failed and hydraulic fluid had sprayed all over the room.

The licensees initial assessment identified that when the hydraulic system valves were re-positioned to discharge the hydraulic fluid from the accumulator back to the reservoir, the hydraulic reservoir catastrophically failed because high pressure nitrogen had leaked by the o-ring seal in the accumulator piston and rapidly expanded when it reached the hydraulic reservoir. Hydraulic fluid was ejected onto the walls, ceiling, and adjacent equipment. The over-pressurization ruptured the reservoir, ejected the reservoir lid, and damaged hydraulic fluid supply lines. Several hours later, the licensee realized that the event had also damaged a fitting between the B accumulator supply line and the reservoir, and that the B accumulator could not maintain pressure. The licensee entered Limiting Condition for Operation 3.7.2, Main Steam Isolation Valves, Conditions A, D, and F. The event rendered the MSIV and both of its actuator trains inoperable.

The licensee consulted the Nuclear Generating Station Emergency Plan, Table 2, Initiating Conditions and EAL Thresholds, and considered the following two emergency action levels:

HA2 (ALERT): FIRE or EXPLOSION affecting the operability of plant safety systems required to establish or maintain safe shutdown.

HU2(UNUSUAL EVENT): FIRE within the PROTECTED AREA or not extinguished within 15 minutes of detection or EXPLOSION within the PROTECTED AREA.

Operators considered the HA2 Alert action level. The licensee determined that the event met the HA2 action level threshold definition of visible damage:

Damage to equipment or structure that is readily observable without measurements, testing, or analysis. Damage is sufficient to cause concern regarding the continued operability or reliability of the affected structure, system, or component. Example damage includes: deformation due to heat or impact, denting, penetration, rupture, cracking, and paint blistering. Surface blemishes (e.g., paint chipping, scratches) should not be included.

However, because the MSIVs are not required for safe shutdown, the licensee concluded that the event did not meet the HA2 ALERT initiating condition.

Operators further considered the HU2 (Unusual Event) action level. Operators did not declare an Unusual Event because they believed that the event did not meet the definition of an explosion. The definition of an explosion is identified in NEI 99-01, Methodology for Development of Emergency Action Levels, Revision 5, and Procedure EP-0901, Classifications, as:

A rapid, violent, unconfined combustion, or catastrophic failure of pressurized/energized equipment that imparts energy of sufficient force to damage permanent structures, systems, or components.

The licensees rationale was that the pre-charge check procedure contains a step for the area operator to unscrew the dipstick cap on top of the hydraulic oil reservoir. Because of this, the shift manager concluded that the oil reservoir was a vented component and therefore, it was not considered a pressurized piece of equipment.

The inspectors challenged this conclusion. Although the hydraulic reservoir was not designed to hold the extreme pressure of the expanding nitrogen gas, the reservoir did become pressurized, and pressurization was the precise mechanism that caused the catastrophic failure. Additionally, pressurization was an expected phenomenon, as evidenced by the procedural step that required loosening the dipstick cap to provide additional venting.

From the considerations described above, the inspectors concluded that the most significant contributor to the performance deficiency was the licensees failure to use a consistent, systematic approach to make decisions. Specifically, the licensee demonstrated a lack of understanding of the emergency classification decision-making process described in Palo Verde Procedure EP-0901, Classifications, for determining if an explosion had occurred in the protected area. The licensee entered this issue into the correction action program as Palo Verde Action Request 4522120.

Analysis.

The failure to implement the emergency plan and declare an Unusual Event when warranted was a performance deficiency. This finding was more than minor and therefore is a finding because not classifying the event potentially put the public at risk and thereby affected the Emergency Preparedness Cornerstone attribute of emergency response organization performance. The inspectors evaluated the finding using Manual Chapter 0609, Appendix B, Emergency Preparedness Significance Determination Process, and determined it to be of very low safety significance (Green) because it was a failure to comply with the NRC requirements and was not a loss of planning standard function. The planning standard function was not lost because the underlying emergency classification and action level scheme basis has not changed. The licensee entered this into their corrective action program as Action Request 4522120. This finding has a cross-cutting aspect in the area of human performance, associated with the consistent process component, because the licensee did not use a consistent, systematic approach to make decisions [H.13].

Enforcement.

Title 10 CFR 50.54(q), Emergency Plans, states, in part, that a licensee shall follow an emergency plan that meets the requirements in Appendix E to this part and the planning standards of § 50.47(b). PVNGS Emergency Plan, Revision 48, states, in part, that an emergency shall be classified and declared if the shift manager finds that a specific emergency action level threshold has been reached. Contrary to the above, the licensee failed to classify and declare an Unusual Event after the specific emergency action level threshold had been reached. Specifically, on November 6, 2013, operations personnel failed to classify an Unusual Event for an explosion within the protected area. Because this finding is of very low safety significance and has been entered into the licensee's corrective action program as Action Requests 4522120, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000528/2014002-04, Failure to Declare an Unusual Event.

4OA5 Other Activities

(Closed) Severity Level IV Notice of Violation 05000528; 529; 530/2013002-04, Failure to Maintain the Updated Final Safety Analysis Report for Radwaste Systems and Processes This Severity Level IV violation, identified during an NRC inspection conducted from January 14 through 18, 2013, stated that contrary to 10 CFR 50.71(e), the licensee did not periodically update the Updated Final Safety Analysis Report (UFSAR), originally submitted as part of the application for the license, to assure that the information included in the report contains the latest information developed. The licensee responded to the Notice of Violation in a letter dated June 13, 2013. To correct this violation, the licensee determined the causes, implemented procedure changes, removed the non-conforming equipment, and submitted licensing document change requests for inclusion in the next Updated Final Safety Analysis Report update. The inspectors reviewed the corrective actions and determined the results of the actions taken are adequate. This violation is closed.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On February 21, 2014, regional inspectors presented the radiation safety inspection results to Mr. R. Bement, Senior Vice President, Nuclear Site Operations, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

On February 28, 2014, regional inspectors presented the results of the onsite inspection of the emergency preparedness program to Mr. R. Bement, Senior Vice President, Nuclear Site Operations, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

On April 4, 2014, the resident inspectors presented the inspection results to Mr. R. Bement, Senior Vice President, Nuclear Site Operations, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

4OA7 Licensee-Identified Violations

The following violations of very low safety significance (Green) were identified by the licensee and are violations of NRC requirements which meet the criteria of the NRC Enforcement Policy for being dispositioned as non-cited violations.

.1 Technical Specification Limiting Condition for Operation (LCO) 3.2.1, Condition A,

requires that if the Core Operating Limit Supervisory System (COLSS) calculated core power exceeds the Core Operating Limit Supervisory System calculated core power operating limit based on linear heat rate (LHR), actions must be taken to restore linear heat rate to within limits, within one hour. Technical Specification Limiting Condition for Operation 3.2.4, Condition A, requires that if Core Operating Limit Supervisory System calculated core power is not within limits, actions must be taken to restore the Departure from Nucleate Boiling Ratio to within limits, within one hour. If these actions are not completed, Technical Specifications Limiting Condition for Operation 3.2.1, Condition C, and Limiting Condition for Operation 3.2.4, Condition C, require that thermal power be reduced to less than 20 percent of rated thermal power within six hours. Contrary to the above, on December 3, 2013, Unit 3 operations personnel failed to reduce rated thermal power in accordance with the actions specified in Technical Specifications Limiting Condition for Operation 3.2.1, Condition C, and Limiting Condition for Operation 3.2.4, Condition C.

Specifically, on December 3, 2013, while recovering from a dropped control element assembly, Unit 3 operators inappropriately exited Limiting Condition for Operation 3.2.1 and Limiting Condition for Operation 3.2.4, resulting in the licensee exceeding the allowed completion time of Condition C by 12 minutes. Licensee engineering personnel identified this condition during a post-event review of plant data on December 15, 2013.

The licensees subsequent cause evaluation determined that the operating crew had inappropriately exited Limiting Condition for Operation 3.2.1 and Limiting Condition for Operation 3.2.4 prior to fully understanding and reconciling instrument and alarm discrepancies. Planned corrective actions will revise Procedure 40DP-9OP02, Conduct of Shift Operations, to add guidance and actions for operators prior to exiting a Limiting Condition for Operation. Procedure 40AO-9ZZ11, CEA Malfunctions, will also be revised to incorporate lessons learned from this event. The inspectors used the NRC Inspection Manual Chapter 0609, Attachment 0609.04, Initial Characterization of Findings, and concluded that the finding is of very low safety-significance (Green)because the finding did not affect a reactor protection system trip signal, did not involve control manipulations that unintentionally added positive reactivity, and did not result in a mismanagement of reactivity by operators. The issue has been entered into the licensees corrective action program as Action Request 4485144.

.2 Title 10 CFR 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that

conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. Contrary to the above, prior to November 15, 2013, the licensee failed to correct a condition adverse to quality.

Specifically, on October 9, 2013, the licensee found foreign material in one of the Unit 3 steam generators. The licensee determined the material to be from an uncaptured Flexitallic gasket in the feedwater system. This material resulted in a wear scar on a steam generator tube, and as a result the affected tube was plugged. On December 12, 2006, the licensee discovered foreign material in a Unit 2 steam generator. That material required plugging of the tube, and was also from Flexitallic gaskets in the feedwater system. The licensees apparent cause evaluation for the 2006 event identified that the use of uncaptured Flexitallic gaskets was the source of the foreign materials. The cause evaluation assigned no corrective action to replace these gaskets with a captured design that minimizes the potential for foreign material generated from the gaskets. The licensee entered the issue into the corrective action program as Condition Report Disposition Request 4466275 and initiated corrective actions to replace the non-captured gaskets with captured caskets. The inspectors used the NRC Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, and concluded that the finding is of very low safety-significance (Green) because the finding did not involve a degraded steam generator tube condition where one tube could not sustain 3 times the differential pressure across a tube during normal full power, steady state operation, and because the steam generators did not violate acciodent leakage performance criterion.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

R. Bement, Senior Vice President, Nuclear Site Operations

P. Connally, Drill Coordinator, Emergency Preparedness

D. Crozier, Senior Coordinator, Emergency Preparedness

R. Davis, Director, Emergency Preparedness

T. Gray, Support Services Superintendent, Radiation Protection

L. Grusecki, Supervisor, Radiation Protection

D. Hautala, Senior Consultant, Regulatory Affairs

D. Heckman, Senior Consultant, Regulatory Affairs

A. Krainik, Manager, Emergency Preparedness

M. Lacal, Vice President, Operations Support

S. Lantz, Section Leader, Radiation Protection Dosimetry

M. McGhee, Department Leader, Nuclear Regulatory Affairs

M. McLaughlin, Director, Technical Support

D. Mims, Senior Vice President, Nuclear Regulatory Affairs

C. Moeller, Manager, Radiation Protection

E. Niemeyer, Lead Investigator, Performance Improvement

F. Oreshack, Consultant, Regulatory Affairs

W. Pierce, Senior Coordinator, Emergency Preparedness

M. Shea, Director, Safety

S. Wagner, Emergency Preparedness Training

R. Witzak, Superintendent, Radiation Protection

D. Wheeler, Director, Performance Improvement

G. White, Supervisor, Radiation Protection

T. Williams, Section Leader, Emergency Preparedness

B. Woodard, Emergency Preparedness Training

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000528/2014002-01 NCV Failure to Follow Protected Equipment Procedure (Section 1R13)

05000528/2014002-02 NCV Failure to Comply with Technical Specification 3.7.2 (Section 1R15)

05000528/2014002-03 NCV Failure to Establish Adequate Procedures for Performing Nitrogen Pre-Charge Checks (Section 4OA3)

05000528/2014002-04 NCV Failure to Declare an Unusual Event (Section 4OA3)

Attachment 1

Closed

05000530/2013-002-00 LER Condition Prohibited by Technical Specifications During Dropped Control Element Assembly Recovery

05000528; 529; NOV Failure to Maintain the Updated Final Safety Analysis Report for 530/2013002-04 Radwaste Systems and Processes (Section 4OA5)