IR 05000250/2017007

NRC Design Bases Assurance Inspection (Team) Report No. 05000250/2017007 and 05000251/2017007

ML17277A837
Person / Time
Site:	Turkey Point
Issue date:	10/02/2017
From:	Bartley J NRC/RGN-II/DRS/EB1
To:	Nazar M Florida Power & Light Co
References
IR 2017007
Download: ML17277A837 (39)

Text

October 2, 2017

SUBJECT:

TURKEY POINT NUCLEAR GENERATING STATION - NRC DESIGN BASES ASSURANCE INSPECTION (TEAM) REPORT NUMBER 05000250/2017007 AND 05000251/2017007

Dear Mr. Nazar

On August 18, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Turkey Point Nuclear Generating Station Units 3 and 4. On August 18, 2017, the NRC inspectors discussed the results of this inspection with Mr. Brian Stamp, Plant General Manager, and other members of your staff. The results of this inspection are documented in the enclosed report.

NRC inspectors documented nine findings of very low safety significance (Green) in this report. Nine of these findings involved violations of NRC requirements; one of these violations was determined to be Severity Level IV under the traditional enforcement process. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the

Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region II; the Director, Office of Enforcement; and the NRC resident inspector at the Turkey Point Nuclear Plant..

If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement] in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region II; and the NRC resident inspector at the Turkey Point Nuclear Plant.

M. Nazar 2 This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, "Public Inspections, Exemptions, Requests for Withholding.

"

Sincerely,

/RA/

Jonathan H. Bartley, Chief Engineering Branch 1

Division of Reactor Safety

Docket Nos. 50-250, 50-251 License Nos. DPR-31 and DPR-41

Enclosure:

Inspection Report 05000250/2017007 and 05000251/2017007, w/Attachment:

Supplemental Information

REGION II==

Docket Nos.: 050000250, 05000251

License Nos.: DPR-31 and DPR-41

Report Nos.: 05000250/2017007, 05000251/2017007

Licensee: Florida Power and Light

Facility: Turkey Point Nuclear Generating Station, Units 3 and 4

Location: Homestead, FL

Dates: July 31, 2017 - August 18, 2017

Inspectors: T. Fanelli, Senior Reactor Inspector (Lead) S. Bussey, Senior Reactor Technology Instructor M. Riley, Reactor Inspector N. Morgan, Reactor Inspector M. Jones, Reactor Inspector (RIII)

H. Leake, Contractor

R. Waters, Contractor

Approved by: Jonathan H. Bartley, Chief Engineering Branch 1 Division of Reactor Safety

SUMMARY

IR 05000250/2017-007, 05000251/2017-007; 7/31/2017 - 8/18/2017; Turkey Point Nuclear Generating Station Units 3 and 4; Design Bases Assurance Inspection (Team).

The inspection activities described in this report were performed between July 31, 2017 and August 18, 2017, by five Nuclear Regulatory Commission (NRC) inspectors and one trainee from Region II and one inspector from Region III. The significance of inspection findings are indicated by their color (i.e., greater than Green, or Green, White, Yellow, or Red) and determined using Inspection Manual Chapter (IMC) 0609, "Significance Determination Process," (SDP) dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310, "Aspects Within the Cross-Cutting Areas," dated December 4, 2014. All violations of NRC requirements were dispositioned in accordance with the NRC'

s Enforcement Policy dated November 1, 2016. The NRC's program for overseeing the safe operati on of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 6.

Cornerstone: Initiating Events

• Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, "Design Control," for failure to verify or check the adequacy of design of the under frequency trip feature of the main generator circuit breakers with regard to the effect of its operation on plant stability and the maintenance of critical safety functions. The licensee entered this issue into their corrective action program as AR 2220874 and AR 2224998. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Initiating Events Cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions. Specifically, opening of the main generator breakers due to an under frequency condition on the offsite power system would cause the generator load to suddenly drop from full power to the level of the plant loads, and there was no verification that plant stability and critical safety functions would be maintained. The team evaluated the finding with Inspection Manual Chapter 0609,

Appendix A, and determined the finding met the Support System Initiators screening criteria for requiring a detailed risk evaluation. The team determined that this issue increased the likelihood of the support system initiator "loss of offsite power (LOOP)."

The regional senior risk analyst conducted a detailed risk evaluation with a one year exposure and determined the change in core damage frequency was less than 1E-6, which was of very low safety significanc e (Green). The team did not assign a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.2)

• Green: The NRC identified a Green non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the adequacy of design for the non-safety related component protective covers attached to safety related equipment. For immediate corrective actions, the licensee entered this into their corrective action program as AR 02220993 and removed visibly degraded protective covers.

3 The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute and of the Initiating Events Cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the failure to ensure the quality and qualification of commercial components and assemblies to maintain adequate mounting to Class 1E equipment increased the likelihood of inadvertent component failures, and thus increased the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. The team determined the finding to be of very low safety significance because the finding did not cause a reactor trip and the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition (e.g. loss of condenser, loss of feedwater). This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.

(Section 1R21.2.b.4)

Cornerstone: Mitigating Systems

• Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, "Design Control," for failure to verify that coordination exists between the protective devices on safety related switchgear in order to minimize the probability of losing a safety related power bus. For immediate corrective actions, the licensee entered this issue into their corrective action program as Action Request (AR) 2220956 and performed an operability determination, which determined the system was operable, and was performing a reevaluation of the calculation to determine adequate coordination. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, failing to verify short circuits in non-safety related SSCs downstream of the safety related switchgear would not cause a lockout of the safety-related bus affected its availability and reliability. The team determined the finding to be of very low safety significance because the finding was a deficiency affecting the design of a mitigating structure, system, or component (SSC), and the SSC maintained their operability or functionality. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.1)

• Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the adequacy of design of temperature set points used for isolation of the Component

Cooling Water (CCW) from the CCW supplemental cooling system (SCS) during an accident. For immediate corrective actions, the licensee entered this into their corrective action program as AR 2218834, performed an operability determination, which determined the system is operable but non-conforming, and issued engineering change (EC) 289598 to account for uncertainties in the CCW SCS temperature isolation setpoint. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, by not ensuring prompt isolation or adjusting the isolation setpoint to account for instrument uncertainties and temperature lag, the licensee failed to ensure that the SCS loop would be isolated at onset of an accident, which affected the reliability and capability of the CCW system when called upon. The determined the finding to be of very low safety significance because the findings were a deficiency affecting the design of a mitigating structure, system, or component (SSC), and the SSC maintained their operability or functionality. The finding had a cross-cutting aspect in the area of Human Performance because the licensee failed to ensure knowledge transfer to maintain a knowledgeable, technically competent workforce and instill nuclear safety values [H.9]. (Section 1R21.2.b.3)

• Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion XI, "Test Control," for the licensee's failure to perform surveillance testing on station battery 3B in accordance with the requirements of Institute of Electrical and Electronic Engineers (IEEE) 450-1987. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2219948 and performed an extent of condition review, which determined that none of the station batteries were currently in a degraded condition, and placed surveillance procedure 0-SME-003.15 on administrative hold until the corrective actions are completed. The performance deficiency was determined to be more than minor because if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern. Specifically, the performance deficiency could result in masking degradation of the battery on future performance discharge tests and adversely affect the ability to trend when the testing periodicity should be increased to once a year as required by Technical Specifications (TS). The team determined the finding to be of very low safety significance because the finding did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety-significant in accordance with the licensee's maintenance rule program for greater than 24 hrs. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.5)

• Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the Emergency Containment Cooler (ECC) unit 4A auto start circuitry would not result in exceeding the thermal limits of the CCW system during a design basis accident. Specifically, the licensee failed to verify that a single active failure of the motor starter auxiliary contacts would not result in exceeding the design basis limits for CCW as described in updated final safety analysis report (UFSAR) Section 9.3. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2219505, performed a prompt determination of operability, and determined that the CCW system remained operable. The performance deficiency was determined to be more than minor because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, three ECC fans running during a during a design basis accident would result in exceeding the design basis temperature of 158.6 °F for the 5 CCW supply and a significant reduction in margin for the SI pump lube oil cooler. The team determined the finding to be of very low safety significance because the finding was a deficiency affecting the design of a mitigating structure, system, or component (SSC) and the SSC maintained its operability. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance. (Section 1R21.2.b.6)

Green.

The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," for the licensee's failure to inspect Intake Cooling Water (ICW) piping in accordance with license renewal commitments. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 02218430 and AR 02218437, planned to perform localized corrosion wall thickness measurements to ensure the ICW system remained operable. The performance deficiency was determined to be more-than-minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the reliability of systems that respond to initiating events to prevent undesirable consequences. Specifically, unmonitored corrosion affects the reliability of the ICW systems. The team determined the finding to be of very low safety significance because it did not represent an actual loss of function of one or more non-Tech Spec trains of equipment designated as high safety-significant in accordance with the licensee's maintenance rule program for >24 hrs. The finding had a cross-cutting aspect in the area of Problem Identification and Resolution, Identification, because the licensee failed to implement a corrective action program with a low enough threshold for identifying issues [P.1]. Specifically, individuals routinely failed to identify corrosion issues on CCW system area walk downs that exceeded proceduralized acceptance criteria of "light surface rust" specified in 0-ADM-564, during the July 5, 2017, August 11, 2016, and April 11, 2016 CCW area walk downs. (Section 1R21.2.b.7)

Cornerstone: Barrier Integrity

• Green: The NRC identified a non-cited violation of Title 10 Code of Federal Regulations Part 50, Appendix B, Criterion XVI, "Corrective Action," for the licensee's failure to take timely corrective action to maintain the unit 3 and 4 containment cathodic protection systems. These systems have been non-functional on both units since 2009. The cathodic protection system's purpose is to protect the containment's interconnected liner, reinforcing bars, and tendon trumplates. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2216534 and performed a prompt operability determination. The licensee concluded that the containment structure was operable but non-conforming and established plans to monitor the potentially impacted inaccessible areas through continued performance of the American Society of Mechanical Engineers (ASME) IWL and IWE programs until actions are taken to restore the Cathodic Protection System.

The performance deficiency was determined to be more than minor, because it is associated with the Design Control attribute of the Barrier Integrity cornerstone and affected the cornerstone objective of maintaining the containment structural integrity and operational capability to provide reasonable assurance that the containment protects the public from radionuclide releases caused by accident or events. Specifically, the failure to implement timely corrective actions to maintain the protection of the containment's interconnected liner, reinforcing bars, and tendon trumplates affected the structural integrity and operational capability of the containment structure. The team determined the finding to be of very low safety significance because the finding was not a pressurized thermal shock issue, did not represent an actual open pathway in the physical integrity of the reactor containment, and did not involve an actual reduction in function of hydrogen igniters in the reactor containment. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.

(Section 1R21.2.b.8)

Traditional Enforcement

• SLIV: The NRC identified a Severity Level-IV non-cited violation of Title 10 Code of Federal Regulations 71(e), "Maintenance of Records, Making of Reports," for the failure to assure that the Updated Final Safety Analysis Report (UFSAR) contained the latest information developed, including all changes made in the facility or procedures as described in the UFSAR. The team determined that the licensee failed to update the UFSAR to include the latest information regarding several design features associated with turbine runback. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2218695 to update the UFSAR. The NRC determined this violation was associated with a minor performance deficiency in accordance with the screening criteria in IMC 0612, Appendix E. Because the failure to update the UFSAR impacted the NRC's ability to perform its regulatory process, the team evaluated the violation using the traditional enforcement process. The team determined that this met the criteria for a SLIV violation because not accurately describing turbine runback design features in the UFSAR could have a material impact on licensed activities, and met the SLIV violation criteria in 6.1.d.3 of the NRC Enforcement Policy. The violation represented a failure to update the UFSAR as required by Title 10 Code of Federal Regulations Part 50.71(e), but the lack of up-to-date information has not resulted in any unacceptable change to the facility or procedures. Cross-cutting aspects are not assigned to traditional enforcement violations. (Section 1R21.2.b.9)

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

1R21 Design Bases Assurance Inspection (Team)

.1 Inspection Sample Selection Process

The team selected risk-significant samples and related operator actions for review using information contained in the licensee's probabilistic risk assessment. In general, this included risk significant structures, syst ems, and components (SSCs) that had a risk achievement worth factor greater than 1.3 or Birnbaum value greater than 1E-6. The sample included seven components selected based on risk significance, one component associated with containment large early release frequency (LERF), four modifications to mitigation SSCs, and two operating experience (OE) items.

The team performed a margin assessment and a detailed review of the selected risk-significant components and associated operator actions to verify that the design bases had been correctly implemented and maintained. Where possible, this margin was determined by the review of the design basis and Updated Final Safety Analysis Report (UFSAR). This margin assessment also considered original design issues, margin reductions due to modifications, or margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for a detailed review. These reliability issues included items related to failed performance test results, significant corrective action, repeated maintenance, maintenance rule status, Inspection Manual Chapter 0326 conditions, NRC Resident Inspector input regarding problem equipment, system health reports, industry OE, and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, OE, and the available defense-in-depth margins. An overall summary of the reviews performed and the specific inspection findings identified is included in the following sections of the report.

.2 Component Reviews

a. Inspection Scope

Components Selected Based on Risk Significance

• Unit 3 CCW Heat Exchangers

• TPCW isolation valve for CCW POV-4882, POV-4883

• MOV-3-1417

• Unit 3/4 HHSI System, Pumps

• 3A 4160V Switchgear

• 3B DC Bus Components with LERF Implications

• Containment Cathodic Protection System Modifications to Mitigation SSCs

• CCW Supplemental Cool EC283225

• Enable Auto start of 3B Emergency Containment Cooling (EC) EC273226

• EHC and Turbine Controls digital upgrade Various ECs 246849 and 246896

• Pressurizer set point change EC246924 For the seven components listed above, the team reviewed the plant technical specifications (TS), UFSAR, design bases documents, and drawings to establish an overall understanding of the design bases of the components. Design calculations and procedures were reviewed to verify that the design and licensing bases had been appropriately translated into these documents and that the most limiting parameters and equipment line-ups were used. Logic and wiring diagrams were also reviewed to verify that operation of electrical components conformed to design requirements. Test procedures and recent test results were reviewed against design bases documents to verify the adequacy of test methods and that acceptance criteria for tested parameters were supported by calculations or other engineering documents, and that individual tests and analyses served to validate component operation under accident conditions.

Maintenance procedures were reviewed to ensure components were appropriately included in the licensee's preventive maintenance program, that components or sub-components were being replaced before the end of their intended service life, and that the licensee has appropriate controls in place for components that are beyond vendor recommended life. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action program documents were reviewed (as applicable) in order to verify that the performance capability of the component was not negatively impacted, and that potential degradation was monitored or prevented. Maintenance Rule information was reviewed to verify that the component was properly scoped, and that appropriate preventive maintenance was being performed to justify current Maintenance Rule status. Component walk downs and interviews were conducted to verify that the installed configurations would support their design and licensing bases functions under accident conditions, and had been maintained to be consistent with design assumptions.

For the four modifications listed above, the team reviewed design bases, licensing bases, and performance capability of components to ensure they have not been degraded through modifications. In addition, post-modification testing was reviewed to ensure operability was established by verifying unintended system interactions will not occur, SSC performance characteristic continue to meet the design bases, modification design assumptions are appropriate, and modification test acceptance criteria have been met. The team also verified design basis documentation was updated consistent with

the design change, verified other design basis features were not adversely impacted, verified procedures and training plans affected by the modification were updated, and verified that affected test documentation was updated or initiated as required by applicable test programs. Walk downs and interviews were conducted as necessary to verify that the modifications were adequat ely implemented. Documents reviewed are listed in the Attachment.

Additionally, the team performed the following specific reviews:

• For the selected operator actions, the inspectors performed a margin assessment and detailed review of the operator actions listed below. Where possible, margins were determined by the review of the assumed design basis and UFSAR response times and performance times. The team observed time critical operator actions performed during simulator evaluated scenarios in accordance with the station annunciator response procedures, emergency operating procedures, and the off normal operating procedures for the following conditions:

1) During the onset of a main steam line break (MSLB) inside containment, stop AFW flow to the faulted steam generator to limit mass and energy releases into containment. 2) During the onset of a main steam line break (MSLB) inside containment, limit high head safety injection (HHSI) pump operating time at shutoff head on minimum recirculation flow to prevent pump overheating. 3) During a residual heat removal (RHR) pump start with operation at shutoff head, secure RHR pump to prevent pump overheating. 4) During a component cooling water (CCW) 50 gpm out-leakage, initiate makeup to prevent emptying the CCW surge tank.

• The team observed a field simulated performance of restoring intake cooling water (ICW) flow at least the minimum allowable value during a basket strainer backwash evolution.

b. Findings

===.1 Inadequate Verification of Electrical Protective Device Selective Coordination

Introduction:

The NRC identified a Green non-cited violation (NCV) of Title 10 Code of Federal Regulations Part 50 (10 CFR 50), Appendix B, Criterion III, "Design Control," for failure to correctly verify that coordination exists between the protective devices on safety related switchgear in order to minimize the probability of losing a safety related===

power bus.

Description:

The team reviewed Calculation PTN-BFJE-91-019, "AC Emergency Power System Coordination," revision 11, to determine if the licensee had established adequate breaker coordination to minimize the probability of losing electric power to safety related 4160 volt-alternating-current (Vac) switchgear. The team noted that the two trains of safety related switchgear supplied both non-safety and safety-related components. The UFSAR Section 7.2 stated, that the reactor protection system was designed in accordance with Institute of Electrical and Electronic Engineers (IEEE) 279-1968, "IEEE Standard Criteria for Protection Systems for Nuclear Power Generating Stations." The criteria in Section 4.7 "Control and Protection System Interaction," specified, in part, that where a plant condition that requires protective action can be brought on by a failure or malfunction of the control system, and the same failure or malfunction prevents proper action of a protection system channel or channels designed to protect against the resultant unsafe condition, the remaining portion of the protection system shall independently meet the "General Functional Requirement" for precision and reliability (Section 4.1), and the "Single Failure Criterion" (Section 4.2).

The calculation, PTN-BFJE-91-019, concluded that coordination existed between all the electrical protective devices. The team determined that this conclusion was not supported because the calculation did not consider:

(1) uncertainties for the response protective device as an assembly including current transformers and other components in the loop etc., including the tolerances allowed in calibration procedures: (2)asymmetrical short circuit currents that would occur at the inception of a fault; and (3)the responses of overcurrent relays in the range of 100 to 115% of their amp setting.

The team determined that if a downstream fault was postulated on the non-safety related control system components, the lack of coordination could cause the safety related switchgear's protection devices (lockout relays) to lockout the entire safety related switchgear. This would disable one of the two trains of the protection system components, trip the reactor coolant pumps perturbing the system flows, and trip the reactor. The team determined the remaining portion of the protection system could not meet Section 4.1 and 4.2 of IEEE 279-1968. A single failure in the remaining protection train could prevent it from performing its safety function.

Analysis:

The team determined the failure to verify that the design of control and protection system interactions were in accordance with the specifications of with IEEE 279-1968 Section 4.7, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, failing to verify that faults on control system SSCs (e.g. reactor coolant pumps) downstream of the safety related switchgear would not cause a lockout of the safety-related bus affected its availability and reliability. The team evaluated the finding with Inspection Manual Chapter (IMC) 0609, Att. 4, "Initial Characterization of Findings," issued October 7, 2016, for Initiating Events, and IMC 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the findings were a deficiency affecting the design of a mitigating structure, system, or component (SSC), and the SSC maintained their operability or functionality. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, "Design Control," required, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, since March 4, 2004, the licensee failed to provide design control measures for verifying or checking the adequacy of design. Specifically, calculation PTN-BFJE-91-019, "AC Emergency Power System Coordination," did not correctly verify that control and protection system interactions would not create the possibility of losing both trains of engineered safety features required to mitigate design basis accidents. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2220956 and performed an operability determination, which determined the system was operable, and was performing a reevaluation of the calculation to determine adequate coordination. This violation is identified as NCV 05000250/2017007-01 and 05000251/2017007-01, "Inadequate Verification of Electrical Protective Device Selective Coordination."

.2 Failure to Perform Design Verification for Under Frequency Trip of the Main Generator

Breakers

Introduction:

The NRC identified a Green NCV of 10 CFR 50, Appendix B, Criterion III, "Design Control," for failure to verify or check the adequacy of design of the under frequency trip feature of the main generator circuit breakers with regard to the effect of its operation on plant stability and the maintenance of critical safety functions.

Description:

UFSAR Section 1.1.4, "Regulatory Guide Application," identified that the licensee was committed to Regulatory Guide 1.28, "Quality Assurance Program Requirements (Design and Construction)," June 1972, and thus to ANSI N45.2-1971, "Quality Assurance Program Requirements for Nuclear Power Plants." The standard ANSI N45.2-1971 required that "Design control measures shall be applied to verify or check the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program." Prior to receiving the operating license for Unit 3 in July 1972, the licensee installed a new design feature without submitting the design as part of the original FSAR for licensing review nor later in 1982, as part their evaluation of the site electrical system design for their licensing submittal for General Design Criteria (GDC) 17 (Reference: FPL letter L-82-509, November 16, 1982). The UFSAR section 8.1.1 "Principal Design Criteria" for "Electrical Systems," stated, in part, that Turkey Point complied with the requirements of GDC 17. The team determined that the licensee neither verified and validated the as installed design nor evaluated this design feature as part of the safety analysis. The design opened the main generator circuit breakers feeding power to the switchyard in the event of a transmission grid under frequency of 57 Hertz or less. The specification for the design placed the unit in an islanding mode where the main generator provided power to the plant instead of the grid or emergency diesel generators.

The under frequency design was specified on Logic diagrams 5610-T-L1, Sheet 4B, "Generator Trip Logic," Revision 8, and 5613-T-L1, Sheet 4A, "Generator Trip Logic,"

Revision 3, which showed under frequency relays UF1, UF2, UF3, and UF4 that trip the main generator output circuit breakers in the event of a frequency less than 57 Hz. Logic diagram 5610-T-L1, Sheet 4C, "Generator Trip Logic," Revision 7, stated, regarding these relays, "Operation at other than synchronous speed, at load, results in excessive turbine blade stress. Only a limited total lifetime operation is allowed- at approximately 57 Hz. The switchyard bkr's [circuit breakers] are opened after 12 seconds but not the field breaker and the unit acts as a house generator." Opening of the main generator circuit breakers would cause the generator load to suddenly drop from full power to the level of the plant loads, approximately 5%, resulting in a 95%

system runback. This would result in the main generator powering plant house loads including the reactor coolant pumps, steam generator feed pumps, and the Class 1E AC loads. The team determined that the UFSAR Section 7.3, "Regulating System," specified that the reactor could automatically reduce to approximately 15% power without tripping the turbine and reactor making this unanalyzed under frequency design possible. However, the plant's licensing basis only allows a 50% runback, which does not require the reactor to reduce power to 15%.

UFSAR Section 14.1.10, "Loss of External Electrical Load," discusses the analysis for a complete loss of load but assumes a turbine and reactor trip at the start of the event. There is no discussion whether the analysis described in 14.1.10 bounds the generator breaker under frequency trip event, which does not involve a trip. The team determined that the licensee did not perform analysis or testing of this design feature to determine its impact on the plants electrical systems and the design requirements of GDC 17. The GDC specified the design to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies. The team reached their conclusion for the following reasons:

• AC system degradation would be certain because the under frequency event would be electrically unstable and unpredictable,

• the buses connected to the auxiliary transformer prevents their subsequent fast transfer to the startup transformer when the instability occurs,

• the large non- Class 1E loads would continue to operate connected to the safety bus,

• Class 1E and non- Class 1E loads share a common bus, and

• the design has never been tested or analyzed

Analysis:

The team determined the failure to perform design verification for the main generator breaker under frequency trip feature, as required by ANSI N45.2, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Initiating Events

Cornerstone and adversely affected the cornerstone objective of limiting the likelihood of events that upset plant stability and challenge critical safety functions. Specifically, opening of the main generator breakers due to an under frequency condition on the offsite power system would cause the generator load to suddenly drop from full power to the level of the plant loads, and there was no verification that plant stability and critical safety functions would be maintained and would cause a loss of offsite power. The team evaluated the finding with Inspection Manual Chapter (IMC) 0609, Att. 4, "Initial Characterization of Findings," issued October 7, 2016, for Initiating Events, and IMC 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," issued June 19, 2012, and determined the finding met the Support System Initiators screening criteria for requiring a detailed risk evaluation. The team determined that this issue increased the likelihood of the support system initiator "loss of offsite power (LOOP)." A regional senior risk analyst (SRA) conducted a detailed risk evaluation with a one year exposure and determined the change in core damage frequency was less than 1E-6, which was of very low safety significance (Green). The SRA modelled the effect of the performance deficiency as a potential loss of offsite power without the ability to recover the offsite power. This was based on the assumptions that, given a grid under frequency condition as described by the performance deficiency, all switchyard breakers would trip and lockout, except those feeding the unit auxiliary transformers and would not be recoverable in a timely manner because of the effort needed to reset the lockouts. The dominating sequence, (95% of the change) was an under frequency grid condition combined with failure of all emergency diesel generators (EDGs) leading to a station blackout. If one EDG were not

recovered, core damage would result. The team did not assign a cross-cutting aspect because the issue did not reflect current licensee performance.

Enforcement:

10 CFR 50, Appendix B, Criterion III, "Design Control," required, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, since July 1972, the licensee failed to provide design control measures for verifying or checking the adequacy of design of the main generator breaker under frequency trip feature. Specifically, the licensee failed to verify or check the adequacy of the design to assure that an under frequency trip of the main generator breakers would not cause an unplanned series of events and conditions leading up to a reactor trip, loss of offsite power, or damage to Class 1E equipment due to frequency transients. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2220874. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-02 and 05000251/2017007-02, "Failure to Perform Design Verification for Under Frequency Trip of the Main Generator Breakers."

.3 Failure to Verify the Adequacy of CCW isolation from Supplemental Cooling System (SCS)

Introduction:

The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the adequacy of design of temperature set points used for isolation of the CCW from the non-safety related SCS during an accident.

Description:

On September 14, 2015, the site completed modification EC 283225 that integrated the newly installed SCS to the CCW system. The SCS must be isolated during an accident to ensure adequate CCW flow to CCW components performing an accident function and to ensure the integrity of the CCW system on potential failure of non-safety related portions of the SCS. The UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968. The criteria specified in Section 4.1 "General Functional Requirement," required that the protection system shall, with precision and reliability, automatically initiate appropriate protective action whenever a plant condition monitored by the system reaches a preset level.

The isolation signal used a temperature threshold at SCS discharge of 104 o F. The licensee assumed that this temperature would be indication of an accident in progress.

Safety related trip circuitry including cables and temperature switches (TS-254 and TS-2216) facilitated isolation. The team noted that the 104 oF setpoint did not ensure that the SCS would be isolated at the beginning of an accident because of the delay for any temperature increase to reach the SCS discharge. In addition, the installation did not account for instrument and loop uncertainty. Given a three year calibration frequency established by the licensee, the instrument uncertainty alone could account for approximately 14 oF of uncertainty before isolation would occur. The team determined that interaction between non-safety related and safety related SCS components did not ensure isolation of the CCW system at the onset of applicable accident sequences. When not isolated, the most limiting failure modes of the SCS chillers could affect the operation of the CCW (i.e. adverse thermal hydraulic conditions or shock). The team noted that accounting for instrument uncertainty was required by NextEra Standard IC-3.17, "Instrument Setpoint Methodology for Nuclear Power Plants," and Institute of Electrical and Electronic Engineers (IEEE) 279 Section 4.1.

Analysis:

The failure to verify the SCS would isolate from the CCW at the onset of an accident was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, by not ensuring prompt isolation or adjusting the isolation setpoint to account for instrument uncertainties and temperature lag, the licensee failed to ensure that the SCS loop would be isolated at onset of an accident, which affected the reliability and capability of the CCW system when called upon. The team used IMC 0609 Attachment 4, "Initial Characterization of Findings," issued October 7, 2016, for Mitigating Systems, and IMC 0609 Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the findings were a deficiency affecting the design of a mitigating structure, system, or component (SSC), and the SSC maintained their operability or functionality. The finding had a cross-cutting aspect in the area of Human Performance because the licensee failed to ensure knowledge transfer to maintain a knowledgeable, technically competent workforce and instill nuclear safety values [H.9].

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, "Design Control," stated, in part, that "design control measures shall provide for verifying or checking the adequacy of design." Contrary to the above, since September 14, 2015, the licensee's design control

measures failed to provide for verifying or checking the adequacy of the SCS design to ensure it isolated from CCW at the onset of an accident. Specifically, failing to verify that the CCW was isolated from the SCS at the onset of an accident created the possibility that the CCW would not be able to meet the accident analysis. For immediate corrective actions, the licensee entered this into their corrective action program as AR 02218834, performed an operability determination, which determined the system is operable but non-conforming, and issued EC 289598 to account for uncertainties in the CCW temperature switch setpoint adjustment. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-03 and 05000251/2017007-03, "Failure to Verify the Adequacy of CCW isolation from Supplemental Cooling System (SCS)."

===.4 Failure to Verify the Adequacy of Design for Component Protective Covers

=

The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the adequacy of design for the non-safety related component protective covers onto safety related equipment.

Description:

On May 7, 1993, the licensee issued specification SPEC-C-013 "Installation Guidelines for Miscellaneous Non-System Related Items on Existing Structures". The specification was non-safety related and applied to non-safety related SSCs. On May 16, 1994, engineering evaluation JPN-PTN-SECS-94-018, Revision 2 "Engineering Evaluation of Bump Covers for the Reactor Trip Breakers in the Unit 3 & Unit 4 Reactor Control Rod Equipment Room" was issued. The engineering evaluation justified the use of the SPEC-C-013 to install the protective covers on Class 1E SSCs. The UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968. The criteria specified in Section 4.3 "Quality of Components and Modules," required that components and modules shall be of a quality that is consistent with minimum maintenance requirements and low failure rates, and this quality shall be achieved through the specification of requirements known to promote high quality, such as requirements for design, for manufacturing, and quality control. The criteria specified in Section 4.4 "Equipment Qualification," required that type test data or reasonable engineering extrapolation based on test data shall be available to verify that equipment that must operate to provide protection system action will meet, on a continuing basis, the performance requirements determined to be necessary for achieving the system requirements. The plant used two designs for their protective covers (bump covers) both used non-safety related commercial components. The first design consisted of two pieces of fire treated two by four wood, one on each side of the mechanism to be protected, with a piece of Plexiglas attached to the wood with screws. Velcro attached the wood to the SSC cabinet face. The second design utilized molded Plexiglas with neodymium magnets as the mounting mechanism.

These protective covers were installed on Class 1E components, which are protection syst em components and modules within the scope of IEEE 279-1968.

The team conducted walk downs and observed that the protective covers were installed on trip sensitive Class 1E equipment throughout Units 3 and 4. These included Reactor trip breakers, Class 1E MCCs, Class 1E Load Centers, Fire Panels C286 and C288, Vital Battery Chargers, Vital Inverters, and various other Class 1E 4160Vac switchgear cabinets. On each of three separate walk downs spanning the two weeks spent onsite, the team observed numerous examples where the mounting of the protective covers was degraded. In some cases, the covers were stacked on top of one another and the column of covers was separating from the cabinets. The Velcro and adhesive showed signs of separation (adhesive failure), and the Velcro showed signs of hook and loop connection failure. Falling covers would contact trip sensitive equipment and other degraded covers, which could cause failures of Class 1E components. The team determined that the design and manufacturing processes did not ensure that the commercial components maintained adequate quality nor did the processes ensure that the assembled protective covers would maintain adequate quality on a continuing basis.

The protective covers were not qualified to meet the required performance requirements of maintaining secure mounting on a continuous basis to prevent inadvertent Class 1E component failure. The licensee generated AR 2220750 in their corrective action program to address the potential adverse effect of the degraded protective covers. In addition, the team questioned whether the magnetic field produced by the neodymium magnet covers would interfere with the electrical characteristic of the Class 1E components. Magnetic fields in the presence of large currents could produce physical forces, eddy currents, and inductive heating not evaluated by the licensee. The team determined that these protective covers were not shown to be qualified as required by IEEE 279-1968. The team determined that the design of the protective covers degraded the quality and qualification of the Class 1E components, on which they were mounted. Title 10 CFR 50, Appendix B criterion III "Design Control," required that the design of Class 1E equipment must be verified and checked, and that changes, including field changes, shall be subject to design control measures commensurate with those applied to the original design. The licensee initiated AR 02220993 on August 17, 2017, to address the performance deficiency and removed degraded covers.

Analysis:

The licensee's failure to meet the criteria specified in IEEE 279-1968 to maintain the quality and qualification of Class 1E components was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute and of the Initiating Events Cornerstone objective to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations.

Specifically, the failure to ensure the quality and qualification of commercial components and assemblies to maintain adequate mounting to Class 1E equipment increased the likelihood of inadvertent component failures, and thus increased the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. The team used IMC 0609 Attachment 4, "Initial Characterization of Findings," issued October 7, 2016, for initiating events, and IMC 0609 Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding did not cause a reactor trip and the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition (e.g. loss of condenser, loss of feedwater). Because the design of the protective covers was from 1993, the team determined the finding was not indicative of current licensee

performance

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, "Design Control," required, in part, that design changes, including field changes, shall be subject to design control measures commensurate with those applied to the original design. Contrary to the above, since 1994, the licensee failed to use design control measures commensurate with those applied to the original design for design changes, including field changes.

Specifically, the licensee did not maintain the quality and qualification requirements from IEEE 279-1968 for Class 1E equipment when applying filed changes. Degraded protective covers could fall and trip protection system components challenging the protection system reliability and availability. For immediate corrective actions, the licensee entered this into their corrective action program as AR 2220993 and removed the visibly degraded protective covers. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-04 and 05000251/2017007-04, "Failure to Verify the Adequacy of Design for Component Protective Covers."

.5 Failure to adequately perform discharge testing on 3B Battery

Introduction:

The NRC identified a Green NCV of Title 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," for the licensee's failure to perform surveillance testing on station battery 3B in accordance with the requirements of IEEE 450-1987.

Description:

Surveillance testing requirements for Technical Specification (TS) limiting condition for operation 3.4.8.2, "DC Sources," required the verification that station battery 3B be at least equal to or greater than 80% of the manufacturer's rating when subjected to a performance discharge test every 5 years. The surveillance testing requirements also required that the frequency of this discharge test be increased to once a year if the battery showed signs of degradation or reached 85% of its expected service

life. TS defined the station battery as degraded when the battery capacity drops by more than 10% of rated capacity from its previous average of performance tests or when capacity is below 90% of the manufacturers rating. Surveillance procedure 0-SME-003.15, "Station Battery 60 Month Maintenance," Rev. 2, stated that the battery performance test was performed in accordance with IEEE 450-1987. The team noted that section 6.4 of IEEE 450 stated that the performance test be ended when battery terminal voltage reached 105V. During the review of the previous two performance tests performed for station battery 3B, in 2011 and 2013 respectively, the team identified that both tests were ended based on time and not based on when voltage reached 105Vdc as required by IEEE 450. The team noted that both performance tests were ended at 122 minutes, when voltage was approximately 107V-direct-current (Vdc). The inspectors determined that the failure to end the surveillance test when the station battery terminal voltage reached 105Vdc resulted in an inaccurate battery capacity determination of 101% for station battery 3B. The team also determined that running the test longer until the battery terminal voltage reached 105Vdc would show more capacity for station battery 3B than currently recorded. The team concluded that the failure to perform the surveillance test in accordance with IEEE 450 would create an inaccurate baseline for battery capacity and mask the degradation of the battery on future performance tests that ensure that the battery capacity has not dropped by more than 10% of rated capacity from the average of previous capacity tests. The failure to detect a degraded battery would result in a failure to increase the frequency of performance testing as required by TS 3.4.8.2. The team noted that this deficiency affected the performance tests for all of the licensee's other safety-related station batteries. On August 11, 2017, the licensee entered this issue into their corrective action program as AR 2219948, performed an extent of condition review, and determined that none of the station batteries were currently in a degraded condition. The licensee also placed surveillance procedure 0-SME-003.15 on administrative hold until the corrective actions are completed.

Analysis:

The licensee's failure to perform surveillance testing on station battery 3B in accordance with IEEE 450-1987, as required by Title 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," was a performance deficiency. The performance deficiency was determined to be more than minor because if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern. Specifically, the performance deficiency could result in masking degradation of the battery on future performance discharge tests and adversely affect the ability to trend when the testing periodicity should be increased to once a year as required by TS. The team used Inspection Manual Chapter (IMC) 0609, Att. 4, "Initial Characterization of Findings,"

issued October 7, 2016, for mitigating systems, and IMC 0609 App. A, "The Significance Determination Process (SDP) for Findings At-Power," issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was not a deficiency affecting the design or qualification of a mitigating SSC, did not represent a loss of system and/or function, did not represent an actual loss of function of a single train for greater than its TS allowed outage time or two separate safety systems out-of-service for greater than their TS allowed outage time, and did not represent an actual loss of function of one or more non-TS trains of equipment designated as high safety-significant in accordance with the licensee's maintenance rule program for greater than 24 hrs. Since the last performance test on station battery 3B was performed in 2013, the team determined the finding was not indicative of current licensee

performance.

Enforcement:

Title 10 CFR Part 50, App. B, Criterion XI, "Test Control," required in part, a test program be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Section

6.4 of IEEE 450-1987 required performance discharge testing be terminated when battery terminal voltage reached 105Vdc. Contrary to the above, since at least 2011, the licensee failed to incorporate the requirements and acceptance limits contained in IEEE 450-1987 for battery performance discharge testing. Specifically, Surveillance procedure 0-SME-003.15 did not adequately specify that the battery performance discharge test not be terminated until voltage reached 105Vdc. The failure to perform surveillance testing in accordance with IEEE 450-1987 could result in masking degradation of the battery on future capacity tests and adversely affect the ability to trend when the testing periodicity would be required to be increased to once a year as required by TS 3.4.8.2. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2219948 and performed an extent of condition review, which determined that none of the station batteries were currently in a degraded condition, and placed surveillance procedure 0-SME-003.15 on administrative hold until the corrective actions are completed. This violation is being treated as an NCV consistent with Section 2.3.2.a of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-05 and 05000251/2017007-05, "Failure to Adequately Perform Discharge Testing on Battery 3B"

===.6 Failure to verify the adequacy of design for the Emergency Containment Cooler (ECC) and CCW systems

=

The NRC identified a Green NCV of Title 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the ECC unit 4A auto start circuitry would not result in exceeding the thermal limits of the CCW system during a design basis accident. Specifically, the licensee failed to verify that a single active failure of the motor starter auxiliary contacts would not result in exceeding the design basis limits for CCW as described in UFSAR Section 9.3.

Description:

UFSAR Section 6.3 stated that the emergency containment cooling system was designed to remove sufficient heat from the reactor containment following a design basis accident to keep the containment pressure from exceeding design pressure. The system consists of three forced-air cooling units that used the CCW as the heat sink.

UFSAR Section 9.3 stated that to restrict CCW system post-accident temperatures to within acceptable limits, a design basis change remains in effect at expended power uprate (EPU) conditions to limit the maximum number of ECCs automatically starting to no more than two, assuming when only two CCW heat exchangers are in operation. As a result of the Unit 4 EPU, the licensee performed EC 273226 to ensure that only two ECC units were operable within 60 seconds of a safety injection signal and to ensure that the swing ECC 4A started automatically within one minute of an SI signal given a failure of one of the other two ECC units. The licensee stated in EC 273226 that only two of the containment cooling system's ECCs could operate simultaneously and that the operation of three ECCs was not acceptable because it would result in the transfer of too much heat load to the CCW system, exceeding the CCW design. During the review of the control logic for swing ECC 4A, the team identified the modification introduced the potential for a single failure of an auxiliary motor starter contact to cause the simultaneous operation of all three ECCs units, placing the plant in an unanalyzed condition at the time of identification. The team noted that this condition was also applicable to Unit 3. The licensee performed a prompt operability determination and determined that three ECC fans running would result in a CCW supply temperature of approximately 164

ºF, exceeding the design basis temperature of 158.6

ºF for the CCW supply as described in UFSAR Section 9.3.2 and UFSAR Table 9.3.1. The team also noted that this left approximately 1

ºF of margin for the safety injection pump lube oil cooler, which reduced the available margin by ~80%. UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968, "IEEE Standard Criteria for Protection Systems for Nuclear Power Generating Stations."

Criterion 4.5 "Channel Integrity," of IEEE 279 required, that all protection system channels shall be designed to maintain necessary functional capability under extremes of conditions, as applicable, relating to environment, energy supply, malfunctions, and accidents.

Analysis:

The failure to ensure the channel integrity of the ECCs and CCW in accordance with IEEE 279, as required by 10 CFR Part 50, Appendix B, Criterion III, "Design Control," was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, three ECC fans running during a during a design basis accident would result in exceeding the design basis temperature of 158.6 degrees F for the CCW supply and a significant reduction in margin for the SI pump lube oil cooler. The team used Inspection Manual Chapter (IMC) 0609, Att. 4, "Initial Characterization of Findings," issued October 7, 2016, for mitigating systems, and IMC 0609 App. A, "The Significance Determination Process (SDP) for Findings At-Power," issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was a deficiency affecting the design of a mitigating structure, system, or component (SSC) and the SSC maintained its operability. Since EC 273226 was completed in 2012, the team determined the finding was not indicative of current licensee performance.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, "Design Control," required in part, that the design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews. Contrary to the above, since 2012, the licensee failed to verify and check the adequacy of the design of the ECC motor starter logic circuitry. Specifically, the failure of an auxiliary contact would result in automatically starting three ECC fans, thus exceeding the design bases temperature limits of the CCW supply system. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2219505, performed a prompt determination of operability, and determined that the CCW system remained operable. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-06 and 05000251/2017007-06, "Failure to Verify the Adequacy of Design for the ECC

and CCW Systems"

===.7 Failure to Identify ICW Pipe Corrosion

Introduction:

The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," for the licensee's failure to inspect ICW piping in accordance with license renewal commitments.===

Description:

On August 2, 2017, during CCW system walk-downs, the team identified multiple instances of notable corrosion, including approximately 0.25" thick metallic flakes, on unit 4 ICW riser piping to the CCW heat exchanger. The team determined that this corrosion met the deficiency criteria established in licensee procedure 0-ADM-

564, 'Systems/Programs Monitoring." The team reviewed License Renewal (LR) Basis Document, PTN-ENG-LRAM-00-0042, Systems and Structures Monitoring Program - License Renewal Basis Document, and determined per attachment 11.1, "Systems/Component Groups Requiring inspection for License Renewal," outdoor ICW piping susceptible to loss of material due to general corrosion and pitting (external), required visual inspection. Section 5 of the LR Bases stated, in part, that 0-ADM-561, 'Structures Monitoring Program' and 0-ADM-564, 'Systems/Programs Monitoring' have been generated to include those inspections and related attributes required to manage the aging effects identified in the License Renewal Aging Management Reviews and listed in Attachments 11.1 and 11.2. Inspection requirements were translated into Final Safety Analysis Report section 16.2.15, Existing Programs - Systems and Structures Monitoring, by stating "The Systems and Structures Monitoring Program (SSMP) has been enhanced via issuance of procedures 0-ADM-561, "Systems and Structures Monitoring Program", and 0-ADM-564, "Systems/Programs Monitoring." These procedures address inspection requirements to manage certain aging effects in accordance with 10 CFR 54, modifying the scope of specific inspections, and improving documentation requirements." Procedure 0-ADM-564, section 4.3.7 stated, "The following is a list of items [that] shall be used for performing walk-downs for License Renewal scope listed on Attachment 2, System/Component Groups Requiring Inspection for License Renewal." Attachment 2 directly referenced Section 11.1 from the LR Bases document, to identify LR scope.

Section 4.3.7.A stated, "For system commodities and components, the parameters monitored include corrosion, flaking, pitting, gouges, cracking, fouling, loss of material, loss of seal, change in material properties by visual inspection of external surfaces for leakage and defects, other surface irregularities, protective coating degradation on select stainless steel pipe welds, leakage at limited locations, and missing parts (LR commitment)." Section 4.3.7.G stated "Deficiency Criteria: Piping: Any corrosion greater than uniform light surface corrosion (LR commitment)."

The team reviewed inspection records for three inspections dated, April 9, 2016; August 8, 2016; and July 5, 2017. The inspectors determined that the license failed to identify any corrosion in excess of the deficiency criteria documented in Procedure 0-ADM-564. The team determined that this oversight was a failure to meet the requirements to inspect the ICW piping in accordance with license renewal commitment.

Analysis:

The team determined that the failure to meet the requirements to inspect the piping in accordance with license renewal commitments as required by 0-ADM-564, as set forth in FSAR section 16.2.15, and was a performance deficiency. The performance deficiency was determined to be more-than-minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the reliability of systems that respond to initiating events to prevent undesirable consequences. Specifically, unmonitored corrosion affects the reliability of the ICW systems. The team used Inspection Manual Chapter (IMC) 0609, Att. 4, "Initial Characterization of Findings," issued October 7, 2016, for mitigating systems, and IMC 0609 App. A, "The Significance Determination Process (SDP) for Findings At-Power," issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because it did not represent an actual loss of function of one or more non-Tech Spec Trains of equipment designated as high safety-significant in accordance with the licensee's maintenance rule program for >24 hrs.

Specifically, the licensee performed an evaluation of piping thickness at select location and determined that remaining wall thickness did not challenge minimum wall thickness limits or operability limits. The finding had a cross-cutting aspect in the area of Problem Identification and Resolution, Identification, because the licensee failed to implement a corrective action program with a low enough threshold for identifying issues.

Specifically, individuals routinely failed to identify corrosion issues on CCW system area walk downs that exceeded proceduralized acceptance criteria of "light surface rust" specified in 0-ADM-564, during the July 5, 2017, August 11, 2016, and April 11, 2016 CCW area walk downs.

Enforcement:

Title 10 CFR 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," stated in part that activities affecting quality shall be prescribed by documented instructions and procedures and shall be accomplished in accordance with these instructions and procedures. Final Safety Analysis Report section 16.2.15, Existing Programs - Systems and Structures Monitoring states in part that "procedure 0-ADM-564, "Systems/Programs Monitoring" address inspection requirements to manage certain aging effects in accordance with 10 CFR 54." Procedure 0-ADM-564, section 4.3.7.G established deficiency criteria for piping as "any corrosion greater than light surface corrosion." Contrary to the above, on April 9, 2016, August 11, 2016, and July 5, 2017, the CCW area walk-down inspections Turkey Point failed to accomplish prescribed activities affecting quality in accordance with these instruction and procedures for license renewal scope components. Specifically, On August 2, 2017, the team identified the licensee did not identify corrosion that exceeded the procedures acceptance criteria that was greater than light surface corrosion.

For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 02218430 and AR 02218437, planned to perform localized corrosion wall thickness measurements to ensure the ICW system remained operable. This violation is being treated as an NCV consistent with Section 2.3.2.a of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-07 and 05000251/2017007-07, "Failure to Identify ICW Pipe Corrosion."

===.8 Failure to Correct a Non-Conforming Condition Impacting Containment

Introduction:

The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," for the licensee's failure to take timely corrective action to maintain the Unit 3 and 4 containment cathodic protection systems.===

These systems have been non-functional on both units since 2009. The cathodic protection system purpose is to protect the containment's interconnected liner, reinforcing bars, and tendon trumplates.

Description:

The team noted that the Unit 3 and Unit 4 containments' Cathodic Protection Systems (CPS) were non-functional since approximately 2009. The team reviewed the containments design bases to determine if this affected their long term structural integrity and operational capability. The team determined that the containment design bases described in the UFSAR credited the CPS to protect the containment metallic structures, and that the safety evaluation report, NUREG-1759, dated April 2002, for license renewal required the maintenance of the CPS as a condition of license

renewal. The UFSAR Subsection 5.1.7 "Containment Testing" specified, in part, the cathodic protection system is designed to protect the interconnected liner, reinforcing bars, and tendon trumplates. In addition, Subsection 8.2.2.1.1.2 "Specifics of the Onsite AC Power System" described the electrical design of the cathodic protection system, and specified, in part, the metallic portion of the containment to be protected includes the liner, the reinforcing bars and the tendon assemblies.

The safety evaluation report, NUREG-1759, stated, in part, that the licensee submittals did not credit the CPS for aging management for 10 CFR 50.54 License Renewal.

However, in the staff evaluations for the ASME Section Xl, Subsections IWE and IWL Inservice Inspection Programs, Sections 3.9.1.2 and 3.9.1.4, the staff specified, in part, it is the malfunction of cathodic protection system that could give rise to the degradation of the protected safety-related components. In a discussion on April 11, 2001, the applicant emphasized that the procedures for ensuring the effectiveness of the cathodic protection system were available at the plant site for a staff review. In the aging management review inspection during August 20-September 14, 2001, the inspectors verified that the operation procedures for the CPS were available at the plant site and were adequate. The licensee identified the non-functionality of the CPS, and issued a condition report on the CPS, AR 1920613, in October 2009, as a result of WO 3800925 (Unit 3, 10/2008)and WO 37017321(Unit 4, 02/2009). The AR was closed to the licensee's long term aging management program (LTAM), which is not their corrective action program. The degrading effects on the containment structure were not identified or evaluated. As a result of the inspection sample on July 14, 2017, the licensee issued AR 2216534, dated July 24, 2017 and evaluated the affects on the containment structure operability.

Analysis:

The failure to take timely corrective actions to correct a condition adverse to quality was a failure to meet 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," and was a performance deficiency. The performance deficiency was determined to be more than minor, because it is associated with the Design Control attribute of the Barrier Integrity cornerstone and affected the cornerstone objective of maintaining the containment structural integrity and operational capability to provide reasonable assurance that the containment protects the public from radionuclide releases caused by accident or events. Specifically, the failure to implement timely corrective actions to maintain the protection of the containment's interconnected liner, reinforcing bars, and tendon trumplates affected the structural integrity and operational capability of the containment structure. The team used IMC 0609 Attachment 4, "Initial Characterization of Findings," issued October 7, 2016, for barrier integrity, and IMC 0609 Appendix A, "The Significance Determination Process (SDP) for Findings At-Power,"

issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was not a pressurized thermal shock issue, did not represent an actual open pathway in the physical integrity of the reactor containment, and did not involve an actual reduction in function of hydrogen igniters in the reactor containment. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.

Enforcement:

10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," required, in part, that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and non-conformances are promptly identified and corrected. Contrary to the above, since July 2009, the licensee failed to establish measures to assure that this condition adverse to quality was corrected. Specifically, the licensee failed to implement timely corrective actions to maintain the cathodic protection of the containment's interconnected liner, reinforcing bars, and tendon trumplates. Allowing the cathodic protection system to remain non-functional could give rise to the degradation of the containment structure. For immediate corrective actions, the licensee entered the issue into their corrective action program as AR 2216534 and performed a prompt operability determination. The licensee concluded the containment structure was operable but non-

conforming and established compensatory measures. The licensee is developing corrective actions to resolve the degraded and nonconforming condition. This violation is being treated as an NCV consistent with Section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000250/2017007-08 and 05000251/2017007-08, "Failure to Correct a Non-Conforming Condition Impacting Containment."

.9 Failure to Update the UFSAR with the Latest Information Developed

Introduction:

The NRC identified a SLIV NCV of 10 CFR 71(e), "Maintenance of Records, Making of Reports," for the failure to assure that the UFSAR contains the latest information developed, including all changes made in the facility or procedures as described in the UFSAR.

Description:

Procedure LI-AA-101-1003, "Updated Final Safety Analysis Report (UFSAR) Revision," Revision 5, Section 4.1, required that the UFSAR be updated for changes made in the facility/procedures as described in the UFSAR. The team found several examples of design features described in the UFSAR associated with the turbine runback design features that were not installed or were removed by plant modifications. UFSAR section 14.1.10 states that the "loss of external electrical load may result from an abnormal increase in network frequency," which would cause a "rapid large load reduction by the action of the turbine control." However, there is no design feature that would initiate this sequence of events as a result of a network over frequency condition. This section further states that, following opening of the main breaker from the generator, "offsite power is available for the continued operation of plant components such as the reactor coolant pumps." However, the design is such that opening of the main breaker from the generator results in blocking of automatic transfer of the 4160V buses to offsite power, which would prevent continued operation of plant components from offsite power. Blocking of the automatic transfer is accomplished by time delay relays set for 0.167 seconds, such as the 162/3A2 relay shown on drawing 5613-E-28, Sheet 1A, "Electrical Auxiliaries, Auxiliary Transformer Breaker 3AA02," Revision 7.

On February 3, 1993, the site issued PCM 92-181, Revision 1, which eliminated automatic turbine runback for a dropped rod or reactor axial flux imbalance. However, the licensee failed to update UFSAR Section 1.4.6 to reflect the removal of this feature.

On October 5, 1993, the site issued PCM 93-005, Revision 0, which eliminated automatic turbine runback for reactor overpower and over temperature. However, the licensee failed to update UFSAR Sections 7.2.1 and 7.7 to reflect the removal of this

feature.

On December 23, 2011, the site issued EC-246849, Revision 1, which added an automatic turbine runback feature that responds to various losses of secondary system equipment. However, the licensee failed to update the UFSAR to describe this feature.

Analysis:

The team determined the failure to update the UFSAR in accordance with procedure LI-AA-101-1003 was a performance deficiency. The NRC determined this violation was associated with a minor performance deficiency in accordance with the screening criteria in IMC 612 Appendix E, "Examples of Minor Issues." Because the failure to update the UFSAR impacted the NRC's ability to perform its regulatory process, the team evaluated the violation using the traditional enforcement process. The team determined that this met the criteria for a SLIV violation because not accurately describing turbine runback design features in the UFSAR could have a material impact on licensed activities, and met the SLIV violation criteria in 6.1.d.3 of the NRC Enforcement Policy. The violation represented a failure to update the UFSAR as required by Title 10 Code of Federal Regulations Part 50.71(e), but the lack of up-to-date information has not resulted in any unacceptable change to the facility or procedures. Cross-cutting aspects are not assigned to traditional enforcement violations.

Enforcement:

10 CFR 50.71(e) stated, in part, that the UFSAR must contain the latest information developed. Contrary to the above, since February 1993, the licensee failed to update the UFSAR with the latest information developed for turbine runback design. Specifically, the UFSAR did not contain the latest information developed regarding turbine runback associated with grid over frequency, reactor axial flux imbalance, reactor unsafe operating conditions, and losses of secondary system equipment. For immediate corrective actions, the licensee entered this issue into their corrective action program as AR 2218695 to update the UFSAR. This violation is SL-IV and is being treated as an

NCV, consistent with Section 2.3.2.(a) of the NRC Enforcement Policy. This violation is identified as NCV 05000250/2017007-09 and 05000251/2017007-09, "Failure to Update the UFSAR with the Latest Information Developed."

.10 Potential failure of 125 Vdc Bus 3B Class 1E components

Introduction:

The team identified an unresolved item pertaining to the verification of the integrity of Class 1E components on DC Bus 3B in accordance with the requirements of IEEE 279-1968.

Description:

UFSAR Section 8.2.2.3.1 stated that the emergency power for vital instrumentation and controls is supplied by a station DC power system which contains five safety related 125Vdc batteries and four DC distribution panels. 125 Vdc distribution panel 3B supplies safety related power to several safety-related equipment including sequencers, reactor trip switchgear, inverter 3Y06, and control power to 480Vac load centers 3B and 3D and 4160 Vac switchgears 3AB01 and 4AB20. UFSAR Section 7.2 stated that the reactor protection system was designed in accordance with IEEE 279-1968. Section 4.5 of IEEE 279-1968, "Channel Integrity," requires all protection system channels be designed to maintain necessary functional capability under extremes of conditions relating to malfunctions. During the review of calculation 5177-265-EG-22, "Circuit Breaker/Fuse Coordination Study," Rev. 8, the team questioned if there were instances where class 1E cables associated with DC Bus 3B (3D23) would not be adequately protected given a short circuit on the load side of the breakers. The failure to ensure the Class 1E protective devices would not allow the maximum available short circuit to permanently damage cabling to safety-related equipment associated with DC Bus 3B could result in additional loss of Class 1E equipment. Unresolved Item (URI)05000250/2017007-01 and 05000251/2017007-01, "Potential failure of 125 Vdc Bus 3B Class 1E components, ") is opened for additional review to determine if the Class 1E cables on DC Bus 3B can withstand the maximum possible short circuit and to determine if a performance deficiency exists.

.3 Operating Experience

a. Inspection Scope

The team reviewed one operating experience issues for applicability at the Turkey Point Nuclear Plant. The team performed an independent review for these issues and, where applicable, assessed the licensee's evaluation and disposition of each item. The issues that received a detailed review by the team included:

• IN2009-11, Configuration Control Errors ML091240039

b. Findings

No findings of significance were identified

4OA5 Other Activities

.1 (Closed) Unresolved Item (URI) URI 05000250, 251/2017008-04, Potential Inadequate Design Control of Current Limiting Reactor.

a. Inspection Scope

The URI was documented on May 12, 2017, in NRC reactive inspection report 05000250/2017008 and 05000251/2017008. The URI was opened in order to review the design and configuration of the reactor coil located inside the 3A 4kV switchgear following the completion of the licensee's root cause evaluation. This was to determine whether any performance deficiencies exist in the area of design control. The potential concern with the design and installation inside the 3A 4kV switchgear was with exposed incoming and outgoing 4kV bussing. The 3A 4kV switchgear had thermoplastic insulated bussing throughout the gear except at the reactor coil.

The team reviewed the design layout drawings, photographs of the interior of switchgear 3A, design specification, and industry quality standards to determine if adequate clearances were used in the design and installation of the reactor coil inside of the switchgear. The team reviewed American National Standard Institute (ANSI) C37.32-2002, "American National Standard for High Voltage Switches, Bus Supports, and Accessories Schedules of Preferred Ratings, Construction Guidelines, and Specifications," which specified clearance requirements for phase to phase and phase to

ground spacing. From the documentation reviewed, the team did not identify any discrepancies between the design of switchgear 3A and the specified clearance requirements, and therefore, no performance deficiency was identified.

b. Findings

No findings of significance were identified; URI 05000250, 251/2017008-04 is closed.

4OA6 Meetings, Including Exit

On August 18, 2017, the team presented the inspection results to Mr. Stamp and other members of the licensee's staff. On September 28, 2017, a re-exit meeting was conducted via teleconference to present the final inspection results to Mr. Summers and other members of the licensee's staff. Proprietary information that was reviewed during the inspection was returned to the licensee or destroyed in accordance with prescribed

controls.

ATTACHMENT:

SUPPLEMENTARY INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

P. Barnes, System Engineering Manager

D. Barrow, Maintenance Director

H. Benitez, Engineering Team Lead

O. Carol, System Engineer

C. Cashwell, Training Manager

P. Czaya, Licensing Engineer

R. De La Torre, Electrical Design Engineer

M. Guth, Licensing Manager

G. Melin, Operations Director

J. Pallin, Engineering Site Director

C. Rossi, Nuclear Assurance Supervisor

B. Stamp, Plant General Manager

R. Tomonto, Design Engineering Manager

J. Vives, Electrical Design Supervisor

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000250, 251/2017007-01 URI Potential failure of 125 Vdc Bus 3B Class 1E

components (Section 1R21.2.b.10)

Closed

05000250, 251/2017008-04 URI Potential

Inadequate Design Control of Current Limiting Reactor (Section 4OA5.1)

Opened &

Closed

05000250, 251/2017008-04 NCV Inadequate Verification of Electrical Protective

Device Selective Coordination (Section

1R21.2.b.1)

05000250, 251/2017007-02 NCV Failure to Perform Design Verification for Under Frequency Trip of the Main Generator Breakers (Section 1R21.2.b.2)

05000250, 251/2017007-03 NCV Failure to Verify the Adequacy of CCW isolation

from Supplemental Cooling System (SCS) (Section 1R21.2.b.3)

05000250, 251/2017007-04 NCV Failure to Verify the Adequacy of Design for Component Protective Covers (Section 1R21.2.b.4)

05000250, 251/2017007-05 NCV Failure to Adequately Perform Discharge Testing on Battery 3B (Section 1R21.2.b.5)

05000250, 251/2017007-06 NCV Failure to Verify the Adequacy of Design for the ECC and CCW Systems (Section 1R21.2.b.6)

05000250, 251/2017007-07 NCV Failure to Identify ICW Pipe Corrosion (Section

1R21.2.b.7)

05000250, 251/2017007-08 NCV Failure to Correct a Non-Conforming Condition

Impacting Containment (Section 1R21.2.b.8)

05000250, 251/2017007-09 SLIV Failure to Update the UFSAR with the Latest

Information Developed (Section 1R21.2.b.9)