IR 05000440/2017008

NRC Design Bases Assurance Inspection (Teams) Inspections Report 05000440/2017008 (DRS-N.Feliz-Adorno)

ML18004B072
Person / Time
Site:	Perry
Issue date:	01/03/2018
From:	Jeffers M NRC/RGN-III/DRS/EB2
To:	Hamilton D FirstEnergy Nuclear Operating Co
References
IR 2017008
Download: ML18004B072 (37)

Text

UNITED STATES January 3, 2018

SUBJECT:

PERRY NUCLEAR POWER PLANTNRC DESIGN BASES ASSURANCE INSPECTION (TEAMS) INSPECTION REPORT 05000440/2017008

Dear Mr. Hamilton:

On September 14, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed a triennial baseline Design Bases Assurance Inspection (Teams) at your Perry Nuclear Power Plant. The enclosed report documents the results of this inspection, which were discussed on November 22, 2017, with Mr. Conicella, and other members of your staff.

Three NRC-identified findings of very-low safety significance were identified. The findings involved violations of NRC requirements. However, because of their very-low safety significance, and because the issues were entered into your Corrective Action Program, the NRC is treating the issues as Non-Cited Violations in accordance with Section 2.3.2 of the NRC Enforcement Policy.

If you contest the violations or significance of these Non-Cited Violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555 0001; with copies to the Regional Administrator, Region III; the Director, Office of Enforcement; and the NRC resident inspector at the Perry Nuclear Power Plant.

If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region III; and the NRC resident inspector at the Perry Nuclear Power Plant. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Mark T. Jeffers, Chief Engineering Branch 2 Division of Reactor Safety Docket No. 50-440 License No. NPF-58 Enclosure:

IR 05000440/2017008 cc: Distribution via LISTSERV

SUMMARY

Inspection Report 05000440/2017008, 08/14/2017-09/14/2017; Perry Nuclear Power Plant;

Design Bases Assurance Inspection (Teams).

The inspection was a 2-week onsite baseline inspection that focused on the design of components and modifications to mitigating systems. The inspection was conducted by regional engineering inspectors and two consultants. The inspection team identified three findings of very-low safety significance (Green) associated with Non-Cited Violations (NCVs)of U.S. Nuclear Regulatory Commission (NRC) regulations. The significance of inspection findings is indicated by their color (i.e., Green, White, Yellow, and Red) and determined using Inspection Manual Chapter 0609, Significance Determination Process, dated April 29, 2015.

Cross-Cutting aspects are determined using Inspection Manual Chapter 0310, Aspects Within the Cross-Cutting Areas, dated December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated November 1, 2016.

The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 6, dated July 2016.

NRC-Identified

and Self-Revealed Findings

Cornerstone: Mitigating Systems

Green.

The team identified a finding of very-low safety significance (Green) and an associated NCV of Title 10 of the Code of Federal Regulations (CFR), Part 50, Appendix B,

Criterion III, Design Control, and 10 CFR 50.63, Loss of All Alternating Current Power, for the licensees failure to evaluate the capability to transfer the high pressure core spray (HPCS) and the reactor core isolation cooling (RCIC) pumps suction source from the condensate storage tank (CST) to the suppression pool during cold weather conditions.

Specifically, (1) monitoring of the CST level instrument lines heat tracing was inadequate to detect a credible common mode failure before the instrument lines would freeze and be rendered inoperable during normal operation, (2) the licensee did not address the condensate (CST) level instrument lines susceptibility to freeze during a cold weather loss of off-site power (LOOP) event with or without a design basis transient or accident, and (3) the licensee incorrectly evaluated the capability to transfer the HPCS pump suction source from the CST to the suppression pool during a cold weather station blackout (SBO)event. The licensee captured the issues within their Corrective Action Program (CAP) as Condition Report (CR) CR-2017-08685, CR-2017-08930, and CR-2017-09006. Corrective actions implemented included: increased the CST level instrument line heat tracing circuit monitoring frequency, revised the affected procedures ensured HPCS and RCIC are adequately aligned to the suppression pool during LOOP design basis events, and ensured a timely transfer of the HPCS and RCIC pump suctions to the suppression pool during a SBO.

The performance deficiency was determined to be more-than-minor because it was associated with the Mitigating Systems cornerstone attribute of design control and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure of the HPCS and or RCIC pumps to automatically transfer their suction source from the CST to the suppression pool upon reaching a low CST water level condition could damage the pump(s) thus preventing them to be used to mitigate a transient or accident.

A detailed risk evaluation was performed and determined that the finding was of very-low safety- significance (Green). The team did not identify a cross-cutting aspect associated with this finding because it was not confirmed to reflect current performance due to the age of the performance deficiency. Specifically, the CST instrument lines were designed and the SBO coping strategy during cold weather was established more than 3 years ago.

(Section 1R21.3.b(1))

Green.

The team identified a finding of very-low safety significance (Green) and an associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the failure to consider all stresses resulting from the emergency closed cooling system as built pipe support 1P42-H1080 connection details. Specifically, the evaluation for the pipe support did not address the impact of rigid connections at both ends of the W8 steel post and of the lateral load on W21 auxiliary steel beam. The licensee captured the issues in their CAP as CR-2017-08986 and CR-2017-09043, reasonably determined the support remained operable, and planned to revise the affected structural analyses.

The performance deficiency was determined to be more-than-minor because it was associated with the Mitigating Systems cornerstone attribute of design control and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the failure to analyze actual pipe configuration and to evaluate the W21 beam did not ensure the emergency closed cooling system and its safety-related supported loads would remain available and capable of providing their accident mitigating function. The finding screened as of very-low safety significance (Green)because it did not result in the loss of operability or functionality of mitigating systems.

The team determined that this finding had a cross-cutting aspect in the area of human performance because the licensee did not recognize and plan for the possibility of mistakes, latent issues, and inherent risk, even while expecting successful outcomes.

Specifically, the licensee did not recognize this latent issue when revising the structural evaluation in 2015. (Section 1R21.4.b(1)) [H.12]

Green.

The team identified a finding of very-low safety significance (Green) and an associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the failure to verify the capability to manually backwash the emergency service water (ESW)strainer during a LOOP. Specifically, the licensee credited the capability to manually backwash the ESW strainers during a LOOP. However, the associated differential pressure alarm setpoint did not ensure sufficient time to complete this activity because the alarms were set at the same value as the design differential pressure value assumed by the hydraulic calculations. The licensee captured the issue in their CAP as CR-2017-09033, reasonably determined ESW remained operable, and planned to revise the associated calculation and the alarm setpoint to ensure sufficient time to perform the required manual actions during a LOOP.

The performance deficiency was determined to be more-than-minor because it was associated with the Mitigating Systems cornerstone attribute of protection against external factors and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the performance deficiency did not assure the ESW capability to supply the required minimum flow to its supported components.

The finding screened as of very-low safety significance (Green) because it did not result in the loss of operability or functionality of mitigating systems. The team did not identify a cross-cutting aspect associated with this finding because it was not confirmed to reflect current performance due to the age of the performance deficiency. Specifically, the alarm setpoint was established more than 3 years ago. (Section 1R21.6.b(2))

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R21 Design Bases Assurance Inspection (Teams)

.1 Introduction

The objective of the design bases assurance inspection is to verify that design bases have been correctly implemented for the selected risk-significant components and modifications, and that operating procedures and operator actions are consistent with design and licensing bases. As plants age, their design bases may be difficult to determine and an important design feature may be altered or disabled during a modification. The inspection also monitors the implementation of modifications to structures, systems, and components as modifications to one system may also affect the design bases and functioning of interfacing systems as well as introduce the potential for common cause failures. The Probabilistic Risk Assessment model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems, and Barrier Integrity cornerstones for which there are no indicators to measure performance.

Specific documents reviewed during the inspection are listed in the Attachment to the report.

.2 Inspection Sample Selection Process

The team used information contained in the licensees Probabilistic Risk Assessment and the Perry Nuclear Power Plant Standardized Plant Analysis Risk (SPAR) Model to identify one scenario to use as the basis for component selection. The scenario selected was a loss of offsite power (LOOP) event. Based on this scenario, a number of risk-significant components, including those with Large Early Release Frequency (LERF)implications, were selected for the inspection.

The team also used additional component information such as a margin assessment in the selection process. This design margin assessment considered original design reductions caused by design modifications, power uprates, or reductions due to degraded material condition. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as performance test results, significant corrective actions, repeated maintenance activities, Maintenance Rule (a)(1) status, components requiring an operability evaluation, system health reports, and U.S. Nuclear Regulatory Commission (NRC) resident inspector input of problem areas/equipment. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in depth margins. A summary of the reviews performed and the specific inspection findings identified are included in the following sections of the report.

The team also identified modifications for review. In addition, the inspectors selected procedures and operating experience issues associated with the selected components.

This inspection constituted 13 samples (6 components with 1 component associated with LERF implications, 4 modifications, and 3 operating experience) as defined in Inspection Procedure 71111.21M-02.01.

.3 Component Design

a. Inspection Scope

The team reviewed the Updated Final Safety Analysis Report (UFSAR), Technical Specifications, design basis documents, drawings, calculations and other available design basis information, to determine the performance requirements of the selected components. The team used applicable industry standards, such as the American Society of Mechanical Engineers Code, Institute of Electrical and Electronics Engineers Standards, and the National Electric Code, to evaluate acceptability of the systems design. The NRC also evaluated licensee actions, if any, taken in response to NRC issued operating experience, such as Bulletins, Generic Letters, Regulatory Issue Summaries, and Information Notices (INs). The review was to verify that the selected components would function as designed when required and support proper operation of the associated systems. The attributes that were needed for a component to perform its required function included process medium, energy sources, control systems, operator actions, and heat removal. The attributes to verify that the component condition and tested capability was consistent with the design bases and was appropriate may have included installed configuration, system operation, detailed design, system testing, equipment and environmental qualification, equipment protection, component inputs and outputs, operating experience, and component degradation.

For each of the components selected, the inspectors reviewed the maintenance history, preventive maintenance activities, system health reports, operating experience-related information, vendor manuals, electrical and mechanical drawings, operating procedures, and licensees Corrective Action Program (CAP) documents. Field walkdowns were conducted for all accessible components selected to assess material condition, including age-related degradation, configuration, potential vulnerability to hazards, and consistency between the as-built condition and the design. In addition, the team interviewed licensee personnel from multiple disciplines such as operations, engineering, and maintenance. Other attributes reviewed are included as part of the scope for each individual component.

The following six components (samples), including a component with LERF implications, were reviewed:

• Division 3 Emergency Diesel Generator (EDG) (1E22C0001): The team reviewed the mechanical aspects of the EDG design, including the air starting system, the fuel oil storage and transfer system, and the jacket water cooling system to assess the capability of the EDG to perform its design function under accident and transient conditions. The team reviewed the protection of the EDG and associated equipment from external events, including flooding. The team reviewed the availability of jacket water cooling under LOOP and station blackout (SBO) conditions. The team reviewed the generator circuit diagrams, field winding circuit, grounding scheme, fuel oil transfer pump circuitry, and control logic. The team reviewed the short circuit current calculation data and results, and the coordination calculation to assess the short circuit duty and the coordination between the generator and the motor and transformer loads including ratings and branch circuit cabling. The team also reviewed voltage drop, loading sequence, minimum and maximum voltage profiles, and the impact of the changes in voltage and frequency. The calculation review verified methodology, design inputs, assumptions, and results. The team also reviewed jacket water cooling and air start system test procedures and recent test results.

• High-Pressure Core Spray (HPCS) Pump (1E22C0001): The team reviewed the following HPCS hydraulic calculations to assess the pump capability to perform its required mitigating functions: pump minimum required flow, runout flow, flow capacity, and minimum required net positive suction head. In addition, the team reviewed the suction sources of the pump and the instrumentation associated with the automatic transfer of the sources. The team reviewed the operation of the HPCS pump under accident, transient, SBO, and external event conditions to assess its capability to perform its licensing basis functions. The team reviewed the room cooling associated with the pump to assess the pumps operating environment. The team reviewed electrical calculations, drawings and equipment modifications to assess the availability of the voltage and current at the pump motor terminals for starting and running under worst case design basis loading, operation on emergency power, and grid voltage conditions. In addition, the team reviewed the control logic, protective relay settings, and cable short circuit current to assess the electrical protection coordination and the power supply feeder cables sizing. The team also reviewed surveillance test procedures and recent test results.

• Division 2, Safety-Related Instrument Air Containment Isolation Valve (1P57F0015B): The team reviewed the installed configuration of the valve and adjacent pipe supports to verify conformance with the applicable drawings. In addition, the team reviewed the seismic qualification documentation for the valve to assess its seismic qualification; power and control wiring drawings, and voltage drop calculation to assess the availability of the minimum required voltage to the valve under all postulated conditions; and sizing for the cables and fuses. The team also reviewed the system operating procedures, design modifications, maintenance rule documentation, system health reports, periodic maintenance activities, and operability tests, including in-service testing records.

This review constituted one component sample with LERF implications.

• Safety-Related Instrument Air Storage Tank B (1P57A0003B): The team reviewed calculations related to the storage tank capacity, including the minimum allowable pressure and the allowable leakage limits to assess its capacity under the most limiting conditions. The team reviewed seismic anchorage calculation for the tank and the seismic qualification documentation for the instruments. In addition, the team reviewed the associated instrumentation details and the calibration records of the pressure transmitters. The team also reviewed the system operating instructions and testing records.

• Division 3, 480V Motor Control Centers EF1E-1/2 (1R24S0029/30): The team reviewed the elementary diagram to assess the sizing of control and power fuses and the cables. Also, the voltage drop calculation was reviewed to assess the availability of power and control voltage to the loads and the control components under all postulated conditions. The team also reviewed the design of the associated power supply fuses and the individual load fuses to assess their coordination.

• HPCS Battery and Charger (1E22S0006 and EFD-1C): The team reviewed calculations and analyses related to battery loads, battery and charger sizing and capacity, hydrogen generation, and battery room temperature. The review was performed to assess the battery and charger capability to support the design basis required voltage requirements of the 125 Vdc Division 3 safety-related loads under both normal and design basis accident conditions. The team also reviewed a sample of completed surveillance tests, service duty discharge tests, and modified performance tests.

b. Findings

(1) Failure to Address the Susceptibility of the Condensate Storage Tank Low Level Instrument Lines to Freeze

Introduction:

The team identified a finding of very-low safety significance (Green)and an associated Non-Cited Violation (NCV) of Title 10 of the Code of Federal Regulations (CFR), Part 50, Appendix B, Criterion III, Design Control, and 10 CFR 50.63, Loss of All Alternating Current Power, for the licensees failure to evaluate the capability to transfer the HPCS and the reactor core isolation cooling (RCIC) pumps suction source from the condensate storage tank (CST) to the suppression pool during cold weather conditions. Specifically,

(1) monitoring of the CST level instrument lines heat tracing was inadequate to detect a credible common mode failure before the instrument lines would freeze and be rendered inoperable during normal operation,

(2) the licensee did not address the condensate (CST) level instrument lines susceptibility to freeze during a cold weather LOOP event with or without a design basis transient or accident, and

(3) the licensee incorrectly evaluated the capability to transfer the HPCS pump suction source from the CST to the suppression pool during a cold weather station blackout (SBO) event.

Description:

The CST low level instruments are relied upon to transfer the suctions of HPCS and RCIC to the suppression pool before CST water level would result in inadequate submergence (i.e., inadequate net positive suction head and/or vortexing).

The CST level instruments are controlled under Technical Specification 3.3.5.1, Emergency Core Cooling Instrumentation, and are credited in the SBO analysis to ensure that an assumed volume of water from the CST is added to the suppression pool to manage suppression pool heat up during the licensed 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> coping period without preferred or emergency power. The instrument lines are exposed to the outside environment and rely on heat tracing and insulation to prevent freezing during cold weather conditions. The heat tracing circuit is not safety-related and not powered by the emergency power sources. The team identified the following three examples were the licensee did not address the susceptibility of the CST low level instrument lines to freeze affecting the capability to transfer HPCS and RCIC pumps suction from the CST to the suppression pool under various cold weather conditions:

• The team identified that the licensee failed to address the susceptibility of the CST low level lines to freeze during normal operating conditions. Specifically, the instrument lines heat tracing circuits were susceptible to common mode failure since the circuits were connected to the same electrical cabinet and the expected time to freeze the instrument lines (e.g., less than 90 minutes in some cases) was significantly shorter than the periodic operator rounds (e.g., every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> in most cases) that include verifying that the heat trace circuit is operating properly. Thus, the monitoring of the heat tracing circuit was, therefore, inadequate to ensure that the HPCS and RCIC pump suctions were capable to transfer from the CST to the suppression pool during cold weather because the monitoring frequency would not result in the timely detection of a heat trace circuit failure before a loss of function could occur.

• The team identified that the licensee failed to address the susceptibility of the CST low level instrument lines to freeze during design basis LOOP conditions.

Specifically, the design did not recognize that the CST level instrument lines would not support HPCS and RCIC suction transfer during a LOOP with cold weather because the heat tracing were not powered by the EDGs.

• The team identified that the evaluation of the SBO coping strategy was not technically correct because it non-conservatively estimated the times to freeze the CST low level instrument lines and transfer the HPCS suction. In this case, the licensee had previously recognized that the design of the CST low level instrument lines would not prevent freezing during an SBO with cold weather because the insulated lines were exposed to the outside environment and their heat trace circuit would not be powered during an SBO. As a result, the licensee developed an SBO coping strategy intended to protect the HPCS and RCIC pumps from inadequate submergence by transferring the entire CST usable volume to the suppression pool before the CST level instrument lines would freeze. This transfer included both the normal transfer through the vessel during normal post reactor trip operations to maintain reactor vessel water level as well as an expedited operation to transfer the CST directly to the suppression pool when reactor vessel makeup was not necessary. This transfer would result in an automatic HPCS and RCIC pump suction swap from the CST to the suppression pool upon reaching a low CST water level. While the SBO coping analysis only credited HPCS, the plants procedures treated the RCIC system as the preferred system. However, the team identified that:

The time allotted for pump suction transfer from the CST to the suppression pool was based on a calculation that assumed the instruments remained functional with a small active water volume that was judged by the team to be inadequate. Specifically, the calculation determined the time to freeze the 3/8 inch outside diameter instrument line such that the unfrozen diameter is 1/16 inch (i.e., the unfrozen 1/16 inch core was credited to sense CST level). The 1/16 inch unfrozen diameter was judged by the team to be inadequate because the mathematical model was based on ideal and uniform assumptions that were not applicable to the actual field configuration exposed to non-controlled environmental conditions. In addition, the existence of a relatively small dimension deviation from the assumed dimension value (e.g., an elbow, valve internals, kink on the line, slight deformation due to handling) could exist leading to a freeze seal prior to the estimated freezing time. This non-conservatism was further exacerbated by significant calculational errors. Specifically, the calculation assumed the instrument lines were perfectly insulated. However, the team identified during a field walk down that the actual insulation was crushed adversely affecting the calculation assumptions regarding insulation thickness and thermal conductivity values. In addition, the calculation did not consider uninsulated valves and angle iron supports extending out of the insulation acting as heat transfer fins which would bypass the insulation.

The evaluation of this strategy underestimated the time to transfer the entire CST usable volume and the pumps suctions to the suppression pool. Specifically, the licensee estimated that this transfer would occur around 30-40 minutes after the SBO initiation. The licensee considered this timeframe acceptable because they estimated (non-conservatively as previously discussed) about 83 and 106 minutes to freeze the instrument line assuming ambient temperatures of -10 degrees Fahrenheit and 0 degrees Fahrenheit, respectively. However, the team noted the transfer time was estimated using less than the usable CST volume instead of the entire CST usable volume as directed by plant procedures. The team estimated that the transfer of the entire CST usable volume would take approximately 93 minutes based on a reasonable extrapolation of a scenario the team observed at the control room simulator.

The licensee captured the issues within their CAP as Condition Report (CR)

CR-2017-08685, CR-2017-08930, and CR-2017-09006. Planned corrective actions to be implemented during the next cold weather condition included: an action to increase the CST level instrument line heat tracing circuit monitoring frequency, revise the affected procedures to ensure HPCS and RCIC are adequately aligned to the suppression pool during LOOP design basis events, and to ensure a timely transfer of the HPCS and RCIC pump suctions to the suppression pool during a SBO.

Analysis:

The team determined that the failure to evaluate the capability to transfer HPCS and RCIC pumps suctions from the CST to the suppression pool under cold weather conditions was contrary to 10 CFR Part 50, Appendix B, Criterion III, Design Control, and 10 CFR 50.63, Loss of All Alternating Current Power, and was a performance deficiency. The performance deficiency was determined to be more-than-minor because it was associated with the Mitigating Systems cornerstone attribute of design control and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure of the HPCS and or RCIC pumps to automatically transfer their suction source from the CST to the suppression pool upon reaching a low CST water level condition could damage the pump(s) thus preventing them to be used to mitigate a transient or accident.

The team determined the finding could be evaluated using the Significance Determination Process (SDP) in accordance with Inspection Manual Chapter (IMC) 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, issued on October 7, 2016. Because the finding impacted the Mitigating Systems cornerstone, the inspectors screened the finding through IMC 0609 Appendix A, The Significance Determination Process for Findings At-Power, issued on June 19, 2012, using Exhibit 2, Mitigating Systems Screening Questions.

The team determined the finding required a detailed risk evaluation because the available information provided by the licensee as of September 15, 2017, did not demonstrate reasonable assurance that the HPCS and RCIC pumps would have remained functional with cold weather. Specifically, the team determined that the expected time to freeze the instrument lines was less than the time to reach the CST low level setpoint associated with the pumps suction transfer. .

The Senior Reactor Analyst (SRA) performed a detailed risk evaluation using a version of the Perry SPAR Model, Revision 8.19, which had recently been modified with some additional plant specific features that are documented in Inspection Report 05000440/

2017009. The SRA requested that Idaho National Laboratory slightly modify this revision of the SPAR model to include a basic event modeling the potential for operator action to perform the suction transfer of the HPCS and RCIC systems from the CST to suppression pool if it failed to occur. In the base model, the newly added operator action failure probability was set to 2E-2. This human error probability was estimated using the SPAR Human Reliability Analysis Method for the baseline risk by assuming that the operator failure would be dominated by diagnosis errors and that the only performance driver was a performance shaping factor of High Stress. For this human error probability evaluation, all alarms, instruments, etc. are assumed to function normally and are not affected by the freezing condition. For the degraded condition, the instrument freezing may both prevent the automatic transfer and hinder operator diagnosis of the condition by indicating a false high level in the CST when level is actually decreasing.

To estimate the change in risk due to the degraded condition, the following assumptions were made:

• The degraded condition was modeled as a recoverable failure of the automatic suction transfer function of the HPCS and RCIC systems.

• Only the loss of offsite power event trees were evaluated. The level indication and automatic suction swap-over of the systems remained available for other initiating events.

• The CST level instruments and level sensors required for successful suction transfer of HPCS and RCIC from the CST to the suppression pool are not modeled in the SPAR model. The SRA used two existing basic events in the SPAR model as surrogates to represent failure of the automatic suction transfer due to freezing. For the HPCS system, the basic event HCS-MOV-FT-SUCTR, HPCS Suction Transfer Fails was set to True or failed. For the RCIC system, the basic event RCI-MOV-OO-F010 was also set to True or failed.

• The basic event for operator action to perform the suction transfer of both systems was evaluated using the SPAR Human Reliability Method. The SRA assumed the performance shaping factor that would be the most significant performance driver in the degraded condition was ergonomics, as the indication of CST level necessary for diagnosis could be misleading. However, the SRA also determined that operators would be monitoring level, and could determine that the low CST level should have been reached and take the necessary manual action. The ergonomics performance shaping factor was rated as poor. All other performance shaping factors were set at the nominal values. The resulting human error probability for the failure to perform the suction transfer was 0.2.

• The exposure period was determined to be 58 days. This was based on the past 3 years of weather data reviewed by the licensee to determine, on average, the number of days that the outside temperature was less than 32 degrees Fahrenheit. This is likely a conservative estimate of the exposure period. The UFSAR Table 2.3-3 showed the mean number of days with a high of 32 degrees Fahrenheit as 36 degrees Fahrenheit. The exposure time was further divided into a period of 13 days, which represents the mean time below 17 degrees Fahrenheit, and 45 days, the mean time with a temperature above 17 degrees Fahrenheit but below 32 degrees Fahrenheit. Below 17 degrees Fahrenheit, plant SBO procedures require using the HPCS system to transfer water from the CST to the suppression pool, which results in a much shorter time to the low CST level and possible pump damage. However, above 17 degrees Fahrenheit, this action is not required, and the time to the low level in the CST would be similar to the LOOP scenarios.

• The CST is normally maintained with approximately 400,000 gallons of water.

The low level CST alarm and automatic suction transfer should normally occur at approximately 98,000 gallons. The RCIC is the preferred system over HPCS for use during LOOP events. Assuming a RCIC flowrate of 700 gpm, many hours of successful operation would occur before any concern with loss of suction and pump trip. This time would allow for the recovery of offsite power and the use of normal inventory control and heat removal systems. To account for the recovery of offsite power and use of normal systems, the SRA multiplied the delta core damage frequency for LOOP scenarios by the appropriate offsite power non-recovery probability at 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. For the portion of the exposure period between 17 degrees Fahrenheit and 32 degrees Fahrenheit (i.e., 45 days), offsite power non-recovery probabilities were also modified for SBO sequences. No additional recovery of offsite power was credited for LOOP or SBO sequences which also involved one or more stuck open relief valves.

The change core damage frequency from the degraded plant condition was estimated as 7E-7/yr. The dominant sequence involved a SBO event, the failure of the operator to perform the suction transfer resulting in RCIC and HPCS failure, and the failure to recover offsite power. External events were evaluated qualitatively using the risk insights from a previous detailed risk evaluation documented in Inspection Report 05000440/2017009. In that evaluation, the external event risk for LOOP related scenarios was less than the internal event risk, primarily because of a lower external event LOOP frequency obtained from the Individual Plant Examination of External Events. The SRA concluded external event risk would not cause the risk of the finding to exceed the 1E-6/yr. threshold for a more significant finding. The SRA evaluated LERF by applying a 0.2 LERF factor specified by IMC 0609 Appendix H, Containment Integrity Significance Determination Process, for plants with a Mark III containment to sequences that represent core damage at high pressure. The delta LERF estimate was determined to be less than 1E-7/yr. Based on the results of the detailed risk evaluation, the finding was determined to be of very-low safety significance (Green).

The team did not identify a cross-cutting aspect associated with this finding because it was not confirmed to reflect current performance due to the age of the performance deficiency. Specifically, the CST instrument lines were designed and the SBO coping strategy during cold weather was established more than 3 years ago.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that measures shall be established for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

As of August 23, 2017, the licensee failed to verify the adequacy of design. Specifically, the licensee did not verify the adequacy of the CST low level instruments lines to detect low water level and cause an automatic HPCS and RCIC suction transfer to the suppression pool when the CST supply becomes exhausted during cold weather conditions. The heat tracing of these lines would not provide freeze protection during a LOOP with cold weather and monitoring of the heat tracing was inadequate to detect a failure before the instrument lines estimated freeze time during normal operations with cold weather.

In addition, 10 CFR 50.63, Loss of All Alternating Current Power, requires, in part, that the licensee determine the capability for coping with an SBO of a specified duration by an appropriate coping analysis. Revision 12 of Section 15H, Station Blackout, of the UFSAR, states The Perry specific SBO assessment which conforms to 10 CFR 50.63 and Regulatory Guide 1.155 follows. Regulatory Guide 1.155, Station Blackout, Section 3.2, Evaluation of Plant-Specific Station Blackout Capability, stated The following considerations should be included when determining the plants capability to cope with a station blackout The design adequacy and capability of equipment needed to cope with a station blackout for the required duration and recovery period should be addressed and evaluated as appropriate for the associated environmental conditions.

It also stated, This should include consideration as appropriate of the following Potential effects of other hazards, such as weather, on station blackout response equipment As of August 31, 2017, the licensee failed to determine the capability for coping with an SBO by an appropriate coping analysis. Specifically, the coping analysis for an SBO with cold weather incorrectly evaluated the capability to transfer the HPCS suction from the CST to the suppression pool because the licensee underestimated the times to

(1) freeze the CST low level instrument lines and

(2) transfer the entire CST usable volume and the pump suction to the suppression pool.

The licensee has taken corrective actions to address the finding by monitoring the CST level line heat trace circuits more frequently during normal cold weather operating conditions, updating procedures to alert operators that a loss of power to distribution panel F1A04 will result in a loss of CST level line heat tracing, and to ensure that the HPCS and RCIC suction sources are transferred to the suppression pool before the level lines become non-functional during cold weather design basis and SBO conditions.

Because this violation was of very-low safety significance (Green) and was entered into the licensees CAP as CR-2017-08685, CR-2017-08930, and CR-2017-9006 these violations are being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy. (NCV 05000440/2017008-01; Failure to Address the Susceptibility of the Condensate Storage Tank Low Level Instrument Lines to Freeze)

.4 Mitigating System Modifications

a. Inspection Scope

The team reviewed four permanent plant modifications. This review included in-plant walkdowns for accessible portions of the modified structures, systems, and components.

The team reviewed the modifications to verify that the design bases, licensing bases, and performance capability of the components had not been degraded through modifications. The modifications were selected based upon risk significance, safety significance, and complexity. The team reviewed the modifications selected to determine if:

• the supporting design and licensing basis documentation was updated;

• the changes were in accordance with the specified design requirements;

• the procedures and training plans affected by the modification have been adequately updated;

• the test documentation as required by the applicable test programs has been updated; and

• post-modification testing adequately verified system operability and/or functionality.

The team also used applicable industry standards to evaluate acceptability of the modifications. The modifications listed below were reviewed as part of this inspection effort:

• Addenda A-01 and A-02 to Revision 9 of Calculation 0P42-0111, Self-Weight Excitation Review of Hangers for Emergency Closed Cooling System;

• Engineering Change Package (ECP) 14-0228-001, New EDG Fuel Oil Level Instruments;

• ECP 09-0573, Emergency Service Water C Pump Refurbishment; and

• ECP 11-0755, Place Sand Bags in Control Complex at Door IB-103.

b. Findings

(1) Inadequate Evaluation of Emergency Closed Cooling System Pipe Support

Introduction:

The team identified a finding of very-low safety significance (Green) and an associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the failure to consider all stresses resulting from the as built pipe support connection details.

Specifically, the evaluation for pipe support 1P42-H1080 did not address the impact of rigid connections at both ends of the W8 steel post and of the lateral load on W21 auxiliary steel beam.

Description:

In 1985, the licensee evaluated the safety-related emergency closed cooling system pipe support 1P42-H1080 in Calculation 0P42-0111, Revision 9. The calculation was revised through addenda A-01 and A-02, on September 4, 2014, and September 25, 2015, respectively, to evaluate the addition of conduits associated with the spent fuel pool instrumentation modification.

During this inspection, the team noted that the pipe support configuration consisted of a vertical W31 steel post installed at elevation 620 feet in the intermediate building with the top end rigidly attached to the bottom of the floor at the 654 foot elevation. Thus, in case of any differential vertical displacements between the two floors due to change in live loads or under a seismic event, this configuration would result in a significant transfer of the floor loading to the post. However, Calculation 0P42-0111, including its addenda A-01 and A-02, did not address this configuration. Specifically, it failed to account for the additional loads associated with the relative displacements of the floors. The licensee captured this concern in their CAP as CR-2017-08986 on August 30, 2017.

In addition, the team noted that the post was laterally supported at about mid-height through a brace to a W21 beam originally installed as an auxiliary steel member to support cable trays. Calculation 0P42-0111 concluded that the associated stresses in W21 beam would be small and acceptable based on judgment. However, the licensee did not document a basis supporting this judgement and a preliminary review by the team and the licensee during this inspection period determined that the stresses could be significant enough to necessitate more detailed analysis. The licensee captured this concern in their CAP as CR-2017-09043 on August 31, 2017.

The licensees immediate corrective actions included an evaluation that reasonably concluded that after consideration of the relative displacements between the floors and with more refined evaluations, the stresses in the pipe support members and the W21 steel beam will remain within the operability limits. The proposed corrective actions to restore compliance at the time of this inspection was to re-evaluate the structural analyses.

Analysis:

The team determined the failure to consider all stresses resulting from the as built pipe support connection was contrary to 10 CFR Part 50, Appendix B, Criterion III, Design Control, and was a performance deficiency. The performance deficiency was determined to be more-than-minor because it was associated with the Mitigating Systems cornerstone attribute of design control and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to analyze actual pipe configuration and to evaluate the W21 beam did not ensure the emergency closed cooling system and its safety-related supported loads would remain available and capable of providing their accident mitigating function.

The team determined the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, issued on October 7, 2016. Because the finding impacted the Mitigating Systems cornerstone, the inspectors screened the finding through IMC 0609 Appendix A, The Significance Determination Process for Findings At-Power, issued on June 19, 2012, using Exhibit 2, Mitigating Systems Screening Questions.

The finding screened as of very-low safety significance (Green) because it did not result in the loss of operability or functionality of mitigating systems. Specifically, the licensee performed an operability determination which concluded that the differential movements between the floors would be very small and that the resulting stresses would reasonably be bounded by the applicable stress operability limits. Licensee evaluation also indicated that the W21 beam stresses would meet the applicable operability limits.

The team determined that this finding had a cross-cutting aspect in the area of human performance because the licensee did not recognize and plan for the possibility of mistakes, latent issues, and inherent risk, even while expecting successful outcomes.

Specifically, the licensee did not recognize this latent issue when revising the structural evaluation in 2015. [H.12]

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that measures shall be established for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Contrary to the above, since August 7, 1985, the licensee failed to verify the adequacy of the design. Specifically, the licensee did not verify the design adequacy of support 1P42-H1080 because the associated structural evaluation failed to consider the impact of the rigid end connections of the W8 steel post and also failed to demonstrate acceptability of the W21 beam affected by the pipe support.

The licensee is still evaluating its planned corrective actions. However, the team determined that the continued non-compliance does not present an immediate safety concern because the licensee performed an evaluation that reasonably concluded that the affected structures will remained operable.

Because this violation was of very-low safety significance (Green) and was entered into the licensees CAP as CR-2017-08986 and CR-2017-09043, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy.

(NCV 05000440/2017008-02; Inadequate Evaluation of Emergency Closed Cooling System Pipe Support).

.5 Operating Experience

a. Inspection Scope

The team reviewed three operating experience issues (samples) to ensure that generic concerns had been adequately evaluated and addressed by the licensee. The operating experience issues listed below were reviewed as part of this inspection:

• IN 2007-01, Recent Operating Experience Concerning Hydrostatic Barriers;

• IN 2015-01, Degraded Ability To Mitigate Flooding Events; and

• Part 21 No. 2013-09-00, Wedge Pin Failure of an Anchor/Darling Double-Disc Gate Valve at Browns Ferry Nuclear Plant U1.

b. Findings

No findings were identified.

.6 Operating Procedure Accident Scenarios

a. Inspection Scope

The team performed a detailed reviewed of the procedures listed below. The procedures were compared to UFSAR, design assumptions, and training materials to assess their consistency. The following operating procedures were reviewed in detail:

• Emergency Operating Procedure (EOP)-01A Chart, Level Power Control, Revision H;

• EOP-02 Chart, Primary Containment Control, Revision F;

• EOP-SPI 3.2, Suppression Pool Makeup, Revision 1;

• EOP-SPI 6.4, HPCS Injection, Revision 2;

• EOP-SPI 6.6, RCIC Injection and Pressure Control, Revision 3;

• ONI-R10-1, Loss of AC Power, Revision A;

• ONI-R10-2, Station Blackout, Revision B;

• ONI-SPI C-3, CST Transfer to Suppression Pool, Revision 4;

• ONI-SPI C-7, Division 3 to Division 2 480 Volt Crosstie, Revision 5;

• ONI-SPI D-1, Maintaining System Availability, Revision 5;

• ONI-SPI D-3, Cross Tie Unit Batteries, Revision 5;

• ONI-ZZZ-1, Tornado or High Winds, Revision 28;

• SOI-P45/P49, Emergency Service Water and Screen Wash Systems, Revision 30; and

• SOI-P57, Safety Related Instrument Air System, Revision 17.

For the procedures listed, time dependent operator actions were reviewed for reasonableness. This review included walk downs of in-plant actions with a licensed operator and the observations of licensed operator crews actions during the performance of an SBO scenario in the stations simulator to assess operator knowledge level, adequacy of procedures, and availability of special equipment where required, and capability to perform time dependent operator actions within the required time. In addition, the team evaluated operations interfaces with other departments. The following operator actions were reviewed:

• Emergency Service Water Pump Strainer(s) Manual Backwash during a LOOP;

• Supply Outboard Main Steam Isolation Valve following a Loss of Instrument Air;

• Break Vacuum in the Emergency Service Water System during Internal Flooding;

• Restore Emergency AC Power following SBO recovery;

• Swap CST Suction from the CST to the Suppression Pool during a Tornado Warning;

• Operations of HPCS and RCIC during in EOP-1 during Cold Weather Conditions;

• Transfer CST Water to Suppression Pool Directly during Cold Weather SBO;

• Dump the Upper Containment Pool into the Suppression Pool during an SBO;

• Power Containment Isolation Valves during an SBO;

• Cross-tie Unit Batteries during an SBO;

• Cross-tie Division II to Division III during an SBO; and

• Open Control Room Cabinets during an SBO.

b. Findings

(1) Failure to Verify the Capability to Manually Backwash the Emergency Service Water Strainer during Loss of Offsite Power

Introduction:

The team identified a finding of very-low safety significance (Green) and an associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the failure to verify the capability to manually backwash the Emergency Service Water (ESW) strainer during a LOOP. Specifically, the licensee credited the capability to manually backwash the ESW strainers during a LOOP. However, the associated differential pressure alarm setpoint did not ensure sufficient time to complete this activity because the alarms were set at the same value as the design differential pressure value assumed by the hydraulic calculations.

Description:

The ESW system is equipped with strainers that need to be manually backwashed during a LOOP with high differential pressure. Specifically, Revision 12 of UFSAR Section 9.2.1, Emergency Service Water System, stated, The emergency service water strainers are driven by nonsafety-related motors from nonsafety-related power supplies. In addition, it stated, Manual backwash will, therefore, be required after a LOOP. Plant procedures direct operators to manually backwash the strainers if a high differential pressure alarm is received.

However, the team noted that the high differential pressure alarm setpoint value did not provide sufficient time to complete the manual backwash before clogging conditions adversely affect the ESW system flow. Specifically, the licensee estimated that it would take approximately 2 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> to manually backwash the strainers during an in-field walk down of the backwash procedure that the team observed. In contrast, ESW Hydraulic Calculation P45-057, Emergency Service Water System Thermal Hydraulic Model, Revision 3, assumed a strainer differential pressure value that was equal to the alarm setpoint. Thus, the alarm setpoint did include any allowance for additional debris accumulation on the strainer while the manual backwash is completed.

The licensee captured the teams concerns in their CAP as CR-2017-09033 on August 31, 2017. The immediate corrective action was to perform a past and current operability review that reasonably determined the ESW remained operable by crediting unused margin reserved for potential pump degradation. The proposed corrective actions to restore compliance was to revise the associated calculation and the alarm setpoint to ensure sufficient to perform the required manual actions during a LOOP.

Analysis:

The team determined that the failure to verify the capability to manually backwash the ESW strainer during LOOP was contrary to 10 CFR Part 50, Appendix B, Criterion III, Design Control, and was a performance deficiency. The performance deficiency was determined to be more-than-minor because it was associated with the Mitigating Systems cornerstone attribute of protection against external factors and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the performance deficiency did not assure the ESW capability to supply the required minimum flow to its supported components.

The team determined the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, issued on October 7, 2016. Because the finding impacted the Mitigating Systems cornerstone, the team screened the finding through IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power, issued on June 19, 2012, using Exhibit 2, Mitigating Systems Screening Questions. The finding screened as of very-low safety significance (Green) because it did not result in the loss of operability or functionality of mitigating systems. Specifically, the licensee performed a past and current operability review that reasonably determined the ESW remained operable by crediting unused margin reserved for potential pump degradation.

The team did not identify a cross-cutting aspect associated with this finding because it was not confirmed to reflect current performance due to the age of the performance deficiency. Specifically, the alarm setpoint was established more than 3 years ago.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that measures shall be established for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Contrary to the above, as of August 31, 2017, the licensee failed to verify the design adequacy of ESW, a safety-related system. Specifically, the licensing basis credited the capability to manually backwash the ESW strainers during a LOOP. However, the associated differential pressure alarm setpoint did not ensure sufficient time to complete this activity because the alarms were set at the same value as the design differential pressure value assumed by the hydraulic calculations.

The licensee is still evaluating its planned corrective actions. However, this issue does not present an immediate safety concern because the licensee performed a past and current operability review that reasonably determined the ESW had unused margin reserved for pump degradation that could be temporarily used to allow sufficient time to complete a manual backwash during a LOOP.

Because this violation was of very-low safety significance (Green) and was entered into the licensees CAP as CR-2017-09033, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy.

(NCV 05000440/2017008-03, Failure to Verify the Capability to Manually Backwash the Emergency Service Water Strainer during Loss of Offsite Power)

4OA2 Identification and Resolution of Problems

.1 Review of Items Entered Into the Corrective Action Program

a. Inspection Scope

The team reviewed a sample of problems identified by the licensee associated with the selected samples and that were entered into the CAP. The team reviewed these issues to verify an appropriate threshold for identifying issues and to evaluate the effectiveness of corrective actions related to design issues. In addition, corrective action documents written on issues identified during the inspection were reviewed to verify adequate problem identification and incorporation of the problem into the CAP. The specific corrective action documents sampled and reviewed by the team are listed in the attachment to this report.

The team also selected four issues identified during previous component design basis inspections to verify that the concerns were adequately evaluated and corrective actions were identified and implemented to resolve the concern, as necessary. The following issues were reviewed:

• NCV 05000440/2006009-04, Inadequate Procedures for Controlling Flow into Reactor Vessel;

• NCV 05000440/2011008-01, Failure to Adequately Protect Safety-Related Equipment from Internal Flooding;

• NCV 05000440/2011008-02, Inadequate Control Circuit Voltage Calculation for Safety-Related Contactors; and

• NCV 05000440/2016007-02, Use of Unapproved Standard for Site Flooding Modification and Associated

b. Findings

No findings were identified.

4OA6 Management Meetings

.1 Interim Meeting Summary

On September 14, 2017, the team presented the preliminary inspection results to Mr. D. Hamilton and other members of the licensee staff. The licensee acknowledged the issues presented. The team confirmed that several documents reviewed were considered proprietary and were handled in accordance with the NRC policy related to proprietary information. The team had outstanding questions that required additional review and a follow-up exit meeting.

.2 Exit Meeting Summary

On November 22, 2017, the team presented the inspection results to Mr. N. Conicella and other members of the licensee staff. The licensee acknowledged the issues presented. The team asked the licensee whether any materials examined during the inspection should be considered proprietary. Several documents reviewed by the team were considered proprietary information and were either returned to the licensee or handled in accordance with NRC policy on proprietary information.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

D. Hamilton, Vice President

F. Payne, Plant General Manager

N. Conicella, Regulatory Compliance Manager

D. Reeves, Site Engineering Director

L. Zerr, Regulatory Compliance Supervisor

T. Kledzik, Regulatory Compliance Engineer

U.S. Nuclear Regulatory Commission

M. Jeffers, Branch Chief

N. Féliz Adorno, Senior Reactor Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000440/2017008-01 NCV Failure to Address the Susceptibility of the Condensate

Storage Tank Low Level Instrument Lines to Freeze

(Section 1R21.3.b(1))

05000440/2017008-02 NCV Inadequate Evaluation of Emergency Closed Cooling

System Pipe Support (Section1R21.4.b(1))

05000440/2017008-03 NCV Failure to Verify the Capability to Manually Backwash

the Emergency Service Water Strainer during Loss of

Offsite Power (Section 1R21.6.b(2))

Discussed

None