IR 05000250/2017008

NRC Reactive Inspection Report 05000250/2017008 and 05000251/2017008

ML17132A258
Person / Time
Site:	Turkey Point
Issue date:	05/12/2017
From:	Joel Munday Division Reactor Projects II
To:	Nazar M Florida Power & Light Co
References
IR 2017008
Download: ML17132A258 (33)

Text

UNITED STATES May 12, 2017

SUBJECT:

TURKEY POINT NUCLEAR GENERATING STATION - NRC REACTIVE INSPECTION REPORT 05000250/2017008 AND 05000251/2017008

Dear Mr. Nazar:

On March 21, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed its initial assessment of a high energy arc flash inside the reactor coil cabinet of the Unit 3 3A 4 kilovolt (kV) switchgear, which occurred on March 18, 2017, at Turkey Point Units 3 and 4. Based on this initial assessment, the NRC sent an inspection team to your site on March 22, 2017.

On March 29, 2017, the NRC completed its special inspection and the NRC inspection team discussed the results of this inspection with Mr. Tom Summers, Regional Vice President, and other members of your staff. The results of this inspection are documented in the enclosed report.

The NRC inspectors did not identify any finding or violation of more than minor significance. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Joel T. Munday, Director Division of Reactor Projects Docket Nos.: 05000250, 05000251 License Nos.: DPR-31, DPR-41

Enclosure:

IR 05000250/2017008 and 05000251/2017008 w/Attachment:

Supplemental Information

REGION II==

Dockets: 50-250, 50-251 Licenses: DPR-31, DPR-41 Report Nos.: 05000250/2017008, 05000251/2017008 Licensee: Florida Power & Light Company Facility: Turkey Point Nuclear Generating Station, Units 3 & 4 Location: 9760 SW 344th Street Homestead, FL 33035 Dates: March 22, 2017 - March 29, 2017 Team Leader: E. Stamm, Senior Reactor Inspector, Engineering Branch 1, Division of Reactor Safety, Region II Inspectors: G. Crespo, Senior Construction Inspector, Inspection Branch 4, Division of Construction Oversight, Region II N. Melly, Fire Protection Engineer, Fire & External Hazards Analysis Branch, Division of Risk Assessment, Office of Research J. Reyes, Resident Inspector, Reactor Projects Branch 3, Turkey Point Nuclear Generating Station J. Patel, Senior Reactor Inspector, Engineering Branch 2, Division of Reactor Safety, Region II Approved By: LaDonna B. Suggs, Chief Reactor Projects Branch 3 Division of Reactor Projects, Region II Enclosure

SUMMARY

IR 05000250/2017008, 05000251/2017008; 03/22/2017 - 03/29/2017; Turkey Point Nuclear

Generating Station, Units 3 and 4; Special Inspection Report.

The inspection activities described in this report were performed between March 22, 2017, and March 29, 2017, by three Nuclear Regulatory Commission (NRC) specialist inspectors and one resident inspector from Region II, and one fire protection engineer from the NRCs Office of Research. The significance of inspection findings are indicated by their color (i.e., greater than Green, or Green, White, Yellow, or Red) and determined using Inspection Manual Chapter (IMC) 0609, Significance Determination Process, (SDP) dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310, Aspects Within the Cross-Cutting Areas, dated December 4, 2014. All violations of NRC requirements were dispositioned in accordance with the NRCs Enforcement Policy dated November 1, 2016. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 6.

REPORT DETAILS

Event Description At 11:19 a.m. Eastern Daylight Time (EDT) on March 18, 2017, control room operators at Turkey Point declared an Alert based on Emergency Action Level (EAL) H.A.2 - Fire or Explosion affecting plant safety systems. The 3A 4 kilovolt (kV) switchgear bus experienced a high energy arc flash on its reactor coil (inductor type protection device). All three reactor coolant pumps tripped and a subsequent automatic reactor trip occurred. Control room operators stabilized Unit 3 in Mode 3. No flames were observed by the initial responders to the switchgear room. The 3B reactor coolant pump was restarted for forced circulation. All safety systems functioned as required. Decay heat was removed with steam generator atmospheric steam dumps and steam generator levels maintained with the feed and condensate system.

The loss of the 3A 4kV switchgear bus affected the availability of safety-related systems and notably the 3A high head safety injection (HHSI) pump which was also being credited at the time of the reactor trip for Unit 4 HHSI. The Unit 4 HHSI pumps were out of service for an emergent 3/4-inch diameter pipe repair common to both of the Unit 4 HHSI minimum flow recirculation lines. Both Unit 3 and Unit 4 were in a 72-hour Technical Specifications (TS)limiting condition for operation (LCO) with the 3A and 3B HHSI pumps normally aligned through the common header. The emergent repair had not progressed to pipe disassembly and the licensee restored the Unit 4 HHSI pumps to an operable condition at 1:36 p.m. EDT on March 18, 2017.

It was noted that a fire door that is part of a credited fire barrier to the adjoining 3B 4kV switchgear room was significantly damaged by the pressure wave from the arc flash; the pressure wave bent and deformed the door latch mechanism, thus allowing the normally closed fire door to swing open into the adjacent 3B 4kV switchgear room.

Special Inspection Team Charter Based on the criteria specified in Management Directive (MD) 8.3, NRC Incident Investigation Program, a Special Inspection was initiated in accordance with Inspection Procedure 93812, Special Inspection. The objectives of the inspection, described in the charter, are listed below and are addressed in the identified sections:

(1) Notify regional management within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of arriving onsite to make recommendations related to changes in inspection scope, or escalation to augmented inspection, as warranted, or if information indicates that the assumptions used in the MD 8.3 risk analysis were not accurate. (Section 4OA5.1)

(2) Develop a detailed sequence of events from the time the Unit 4 HHSI pumps were declared inoperable for the emergent pipe repair, through the loss of the 3A vital bus affecting the loss of the 3A HHSI pump, restoration of the Unit 4 HHSI system to an operable condition, until the plants reached a stable condition. (Section 4OA5.2)

(3) Review the plant response and operator actions following the loss of the 3A 4kV switchgear bus. Specifically, determine whether equipment responded as designed, including the loss of reactor coolant pumps and operation on natural circulation. Review the licensees method for removing decay heat through steam generator atmospheric dump valves to determine whether operator actions were in accordance with established procedures.

(Section 4OA5.3)

(4) Review and evaluate the operation of fire protection features associated with the vital switchgear rooms. Specifically, for Fire Door D070-3, which was damaged during the event due to a pressure wave generated from the high energy electrical release, review the fire door requirements in design basis documents and determine if the door was in compliance with the Fire Protection Program. Review the National Fire Protection Association (NFPA)805 analysis and determine if all the hazards for the door were adequately evaluated.

(Section 4OA5.4)

(5) Review and assess the adequacy of the fire brigade response, communications, and establishment of a fire watch in the 4kV switchgear rooms. (Section 4OA5.5)

(6) Review and evaluate the licensees emergency preparedness response. Specifically, determine whether reportability notifications were made accurately, reported to the correct stakeholders, and accomplished in the appropriate timeframes. Determine whether emergency action levels were accurately declared. (Section 4OA5.6)

(7) Review and assess the licensees Risk Management Program actions. Specifically, review maintenance rule 10 CFR 50.65(a)(4) actions associated with the emergent issue for the Unit 4 HHSI system, including the evaluation of risk configuration and allowance of work in 3A or 3B switchgear rooms. Review the licensees procedures and practices for accounting for risk on the opposite unit when equipment is removed from service. Gather information on the licensees knowledge and understanding of Unit 4 on-line risk following the loss of the 3A 4kV switchgear bus. (Section 4OA5.7)

(8) Obtain information and assess the licensees evaluation of potential causes for the failure of the reactor coil that led to the loss of the 3A 4kV switchgear bus. (Section 4OA5.8)

(9) Review preventive maintenance tasks and associated post-maintenance test records associated with the 3A vital bus to determine if maintenance and testing was being performed in accordance with site procedures and equipment vendor recommendations.

(Section 4OA5.9)

(10) Review and evaluate information regarding the licensees activities in restoration of the low side of the 3A vital bus. (Section 4OA5.10)

(11) Gather information to support additional reviews on generic implications associated with fire doors in rooms with the potential for high arcing events. Identify any other potential generic safety issues and make recommendations for appropriate follow-up action (e.g.,

Information Notices, Generic Letters, and Bulletins). (Section 4OA5.11)

4OA5 Other Activities - Special Inspection

.1 Notify regional management within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of arriving onsite to make recommendations

related to changes in inspection scope, or escalation to augmented inspection, as warranted or if information indicates that the assumptions used in the MD 8.3 risk analysis were not accurate.

a. Inspection Scope

The team reviewed the assumptions used in the MD 8.3 risk analysis upon arrival at the site. Specifically, the team conducted a walk down of the 3A 4kV switchgear room, reviewed control room logs, reviewed equipment status, and reviewed a timeline of events provided by the licensee, and performed an independent assessment to validate the assumptions used in the MD 8.3 risk analysis and provide a recommendation to NRC regional management.

b. Findings and Observations

The team reviewed assumptions by the senior risk analyst used in the MD 8.3 risk analysis and determined them to be representative of the circumstances. The team reviewed the recovery actions required to restore the Unit 4 HHSI pumps and determined the assumptions were correct. In addition, the team determined that the 3B HHSI pump was immediately available to either unit following an event. The team did not identify any common cause issues or fire propagation issues which would have significantly increased the assumed probability of failure of the 3B 4kV switchgear. The team validated that the Unit 3 reactor coolant pumps (RCP) contained the Flowserve N-Seal package. The team reviewed ongoing work in the switchyard as well as grid status and weather conditions in the area and determined there was no evidence of an increase in likelihood of a loss of offsite power beyond the assumptions of the MD 8.3 analysis. The team reviewed other risk-significant equipment status in the plant prior to and during the event and determined no additional equipment was out of service beyond the assumptions in the MD 8.3 analysis. Based on a review of the information, a recommendation was made to NRC regional management to continue the inspection under the guidance of the original special inspection charter.

.2 Develop a detailed sequence of events from the time the Unit 4 HHSI pumps were

declared inoperable for the emergent pipe repair, through the loss of the 3A vital bus affecting the loss of the 3A HHSI pump, restoration of the Unit 4 HHSI system to an operable condition, until the plants reached a stable condition.

a. Inspection Scope

The team gathered information from the licensee through a review of control room logs, interviews with operators, review of the post-trip report, and other resources to develop the following detailed sequence of events.

b. Findings and Observations

March 18, 2017 (All times EDT)02:08 - Operations guarded the 3A HHSI Pump, 3B HHSI pump, and associated breakers 3AA13 and 3AB12 prior to commencing work on the Unit 4 HHSI pumps.

06:24 - 4A and 4B HHSI pumps placed in Pull-to-lock. Pumps declared INOPERABLE.

Action d, of TS 3.5.2.a, was entered for both Unit 3 and Unit 4, which required restoration of at least one of the inoperable pumps within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

07:36 - Unit 4 HHSI pump common recirculation line was isolated.

11:07:25 - Arc flash in Cubicle 3AA06 on 3A 4kV bus injured a worker inside the room and damaged Fire Door D070-3 separating the 3A and 3B 4kV bus rooms.

11:07:26 - Unit 3 automatic reactor trip due to the 3A RCP trip caused by the 3A 4kV bus under-voltage.

11:07:27 - 3B and 3C RCPs trip due to under-frequency on 3B 4kV bus.

11:07:51 - Operators close main steam isolation valves per Emergency Operating Procedures (EOPs).

11:08:50 - Control Room receives report of fire in 3A 4kV bus room and injured person.

~11:13 - Senior Reactor Operator (SRO) dispatched to determine status of Unit 4 HHSI pump work. Recognition that both Units 3 and 4 are in TS 3.0.3, which requires the units to be in HOT STANDBY within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, HOT SHUTDOWN within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and COLD SHUTDOWN within the subsequent 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, due to loss of 3A HHSI pump in conjunction with 4A and 4B HHSI pumps INOPERABLE.

11:15 - Fire Brigade responds to 3A 4kV bus room. Fire Door D070-3, which separates 3A and 3B 4kV bus rooms, found damaged/not secured.

11:15 - SRO assesses 3B 4kV bus room. Fire Door D070-3 found ajar with latch resting on the door jamb. Dusty/hazy environment noted in the room.

11:19:49 - ALERT Declared (HA2 - Fire or Explosion Affecting the Operability of Plant Systems Required to Establish or Maintain Safe Shutdown).

11:24 - 3A 4kV bus east door opened in preparation for smoke ventilation.

11:30 - Fire Brigade confirms that there is no fire in 3A/3B 4kV bus rooms.

11:30:58 - State and local authorities notified of ALERT declaration.

11:34 - 3B 4kV bus east door opened in preparation for smoke ventilation.

11:35 - Operators secure all auxiliary feed water (AFW) pumps and declare Unit 3 AFW Train 1 and 2 INOPERABLE.

11:36 - Operators verify both standby feed water pumps are OPERABLE.

11:38 - Unit 3 load center east door opened in preparation for smoke ventilation.

11:40 - Unit 3 load center exhaust fan 3V15 started to remove smoke from Unit 3 switchgear rooms.

11:49 - 3B 4kV bus east door closed (haze cleared).

12:04 - Operators start the 3B RCP in accordance with 3-EOP-ES-0.1.

12:09:00 - NRC Operations Center notified of ALERT declaration.

12:18 - Unit 4 HHSI pump work authorized to be released.

12:30 - Control Room notified that the reactor coil of the 3A 4kV bus is damaged and the 3A 4kV bus is INOPERABLE.

12:30 - 3A emergency diesel generator (EDG) declared INOPERABLE due to loss of power to its ventilation fan.

13:27 - Local stop of 3V15 load center exhaust fan. Smoke ventilation complete.

13:32 - Operators emergency stop 3A EDG to avoid auto restart.

13:34 - Unit 3 load center east door closed (haze cleared).

13:36 - 3A 4kV bus east door closed (haze cleared).

13:36 - Unit 4 HHSI recirculation line restored. 4A and 4B HHSI pumps declared OPERABLE. Exited TS 3.0.3 for Unit 3 and Unit 4.

14:10 - Fire impairment form for Fire Door D070-3 signed to establish compensatory measures for the degraded barrier including a fire watch.

14:20 - ALERT exited.

14:34 - State and local authorities notified of event termination.

14:53 - Operations guards 3B 4kV bus, 3B/3D Load Centers, 3B train HVAC, and 3B EDG.

15:07 - 4-hr notification to NRC for Unit 3 reactor protection system actuation.

17:06 - Operations starts 3C charging pump.

17:35 - Both AFW trains declared OPERABLE.

18:54 - 8-hr notification to NRC for AFW and 3A EDG actuation.

21:50 - Unit 3 commenced reactor coolant system (RCS) cooldown per 3-GOP-305.

March 19, 2017 (All times EDT)04:40 - Unit 3 entered Mode 4.

12:50 - Unit 3 entered Mode 5.

.3 Review the plant response and operator actions following the loss of the 3A 4kV

switchgear bus. Specifically, determine whether equipment responded as designed, including the loss of reactor coolant pumps and operation on natural circulation. Review the licensees method for removing decay heat through steam generator atmospheric dump valves to determine whether operator actions were in accordance with established procedures.

a. Inspection Scope

The team conducted interviews, reviewed the post-trip report, alarm response procedures, abnormal and EOPs, and corrective action documents generated as a result of the event in order to determine whether plant equipment and operator actions were appropriate and in accordance with established procedures.

The team reviewed:

• the control room operator actions taken to address the Unit 3 automatic reactor trip that resulted from the failure of the safety-related 3A 4kV switchgear,

• the EOPs used, including any EOPs the licensee transitioned to, and criteria that was used to exit the EOP network after the Unit 3 trip,

• the Unit 3 and Unit 4 control room logs to identify the sequence of events and to verify the licensee had adequately entered the required TS LCOs after the Unit 3 switchgear failed,

• the circumstances that led to the Unit 4 control room tagging out the HHSI pump recirculation lines, specifically the required entry into TS 3.0.3 and other required TS entries after the loss of the 3A HHSI pump, which totaled three of four inoperable HHSI pumps,

• whether actions that were taken to return the Unit 4 HHSI pumps to operable status from the tag out were adequate for control room operators to have declared the pumps operable,

• the licensees post trip review report and interviewed the shift manager and the responsible Unit supervisors that were on shift when Unit 3 tripped to determine if the licensee had addressed any unexpected equipment issues where plant response was not as expected,

• all the corrective action program (CAP) action requests (ARs) that were written as a result of the Unit 3 trip to determine if the licensee was adequately resolving equipment issues identified from the unit trip,

• whether any EDG equipment issues resulted from running the EDG after it was declared out of service,

• the circumstances that caused all three reactor coolant pumps to trip and if that equipment operated according to design requirements,

• the control room operator actions relating to the momentary loss of forced cooling and the operation of natural circulation, and

• the circumstances regarding the loss of condenser heat sink resulting from the reactor trip and the operator actions completed to remove decay heat through the steam generator atmospheric dump valves to determine if the operator actions were in accordance with the EOPs.

b. Findings and Observations

The team found that the 3A EDG had not been shut down for approximately one hour after the EDG had been declared out of service due to an inoperable EDG building ventilation fan. No equipment issues were identified as a result of this delay. During the trip it was identified that all three reactor coolant pumps tripped and forced primary circulation was momentarily lost.

Overall, the teams review of the plant response and operator actions following the event concluded that equipment responded as designed, including the loss of reactor coolant pumps. The team also concluded control room operator actions were in accordance with EOPs and actions to restore equipment were appropriate. The teams review of the licensees method for removing decay heat through steam generator atmospheric dump valves concluded that operator actions were in accordance with established procedures.

.4 Review and evaluate the operation of fire protection features associated with the vital

switchgear rooms. Specifically, for Fire Door D070-3, which was damaged during the event due to a pressure wave generated from the high energy electrical release, review the fire door requirements in design basis documents and determine if the door was in compliance with the Fire Protection Program. Review the NFPA 805 analysis and determine if all the hazards for the door were adequately evaluated.

a. Inspection Scope

The inspectors reviewed plant procedures, NFPA 805 analysis, other licensee documents, and interviewed personnel to assess the operation of fire protection features including Fire Door D070-3 for the vital switchgear rooms.

b. Findings and Observations

On March 18, 2017, at approximately 11:07 a.m. EDT, as a result of the pressure wave from the arc flash in switchgear room 3A, fire door D070-3 was damaged and opened into switchgear room 3B. The lock and strike were both broken and the door suffered a minor z-bend and became bowed at the lock set area. The damaged fire door created the potential for a multi-compartment fire between switchgear room 3A and switchgear room 3B. The team confirmed that Fire Door D070-3 meets the requirements of Fire Protection System NFPA 805 Design Basis Document (DBD), 5610-016-DB-001, yet suffered damage, particularly to the strike and latching mechanism.

NPFA 805, Section 3.11.3 requires penetrations in fire barriers are consistent with the designated fire resistance rating of the barrier as determined by performance requirements. Fire Barrier 070-N is part of a three hour rated fire barrier system between switchgear rooms 3A and 3B that consists of reinforced concrete, concrete block barrier and Fire Door D070-3, which is a 3-hour fire-resistance rated door. The team confirmed the nameplate on the damaged fire door matched the rating in Drawing 5610-A-61, Sh. 1.

Appendix G of the licensees Fire Protection DBD, 5610-016-DB-001, indicates that passive fire protection devices such as doors shall conform to 1983 Edition of NFPA 80, Standard for Fire Doors and Windows. The team concluded calculation PTN-FPER-07-080 for Fire Door D070-3s design and installation was in compliance with the requirements of NFPA 80. The licensee also reviewed the current standard, 2016 Edition of NFPA 80, and found the Fire Door D070-3 to successfully meet all acceptance criteria.

The current design bases do not require the licensee to have blast resistant fire doors despite the possibility of an arc flash occurring in the area. The licensee developed AR 02192303 to explore industry standards, operating experience, and evaluations to determine the necessity of blast resistant doors.

The team reviewed the past three annual functional door tests that were undertaken per 0-SMM-016.6, Fire Door Inspection, and found Fire Door D070-3 successfully passed the internal inspections. The team interviewed the individual that performed the last daily fire door surveillance before the incident. As part of the surveillance, the individual latched all doors closed and pushed the fire doors into the frame to ascertain if the door was closed. The individual confirmed that they inspected Fire Door D070-3 as part of the daily fire door surveillance procedure, 0-SFP-016.4, and found no issues.

The team investigated NFPA monitoring thresholds associated with both specific fire doors and cumulative fire doors. Prior to the incident, the performance monitoring group for fire doors accumulated 534.28 hours3.240741e-4 days <br />0.00778 hours <br />4.62963e-5 weeks <br />1.0654e-5 months <br />. Approximately one week after the incident, the total unavailability was 700 hours0.0081 days <br />0.194 hours <br />0.00116 weeks <br />2.6635e-4 months <br /> while the performance criterion threshold is 1426 hours0.0165 days <br />0.396 hours <br />0.00236 weeks <br />5.42593e-4 months <br /> per twelve months. The replacement of Fire Door DO70-3 was not expected to exceed the performance criterion for unavailability; therefore, no action plan was developed for that monitoring criterion. The team also found no previous corrective actions associated with Fire Door D070-3.

The team reviewed the current NFPA 805 requirements with respect to impact to Fire Door D070-3 as part of the high energy arc flash analyses. The requirements are contained in NUREG/CR-6850, Volume 2, Electric Power Research Institute (EPRI)/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volume 2:

Detailed Methodology, Appendix M, Appendix for Chapter 11, High Energy Arcing Faults. The NUREG requires the licensee to assume that any vulnerable component or movable/operable structural element located within 3 feet horizontally of either the front or rear panel/doors, and at or below the top of the faulting cabinet section, will suffer physical damage and functional failure. This will include mobile/operable structural elements like dampers and fire doors. The actual distance from the reactor coil cabinet to Fire Door D070-3 is 14.5 feet and therefore is outside the impact assessment area for high energy arc flash for the affected cabinet.

The team also reviewed transient combustibles permits associated with the work that was on-going during the incident in switchgear room 3A and found that the permits included equipment and materials typically found with Thermo-Lag installation. The team also confirmed there were no fire recovery actions credited in switchgear room 3A, 3B, and 480V Center for a fire in switchgear room 3A.

Overall, the team concluded that fire protection features associated with the vital switchgear rooms operated as designed. Specifically, Fire Door D070-3, which was damaged during the event, was in compliance with the Fire Protection Program and design documents. Additionally, the hazards for the door were adequately evaluated in the licensees NFPA 805 analysis. See Section 4OA5.11 for additional discussion regarding the requirements and assumptions used for impact assessment for high energy arc flash.

.5 Review and assess the adequacy of the fire brigade response, communications, and

establishment of a fire watch in the 4kV switchgear rooms.

a. Inspection Scope

The team reviewed the fire brigade response after an explosion and smoke was reported coming from the Unit 3 safety-related 3A 4kV switchgear to determine and assess whether:

(1) the brigade response was adequately staffed;

(2) there was timely arrival of the required amount of dressed-out fire brigade members;

(3) the required firefighting equipment and communication equipment and procedures were taken to and or available at the scene to adequately plan and execute a fire fighting strategy; and

(4) that the brigades fire-fighting actions and communications were appropriate in accordance with the established procedures and the licensees fire brigade program requirements.

The team also reviewed whether the licensees fire brigade had requested assistance from the Miami-Dade Fire and Rescue Department, the basis for assistance and if Miami-Dade Fire and Rescue provided any firefighting assistance. The team interviewed the responsible fire brigade team leader and the SRO that responded to the switchgear room to obtain the details regarding the as found conditions and actions taken by the brigade to address the smoke and potential fire in the switchgear room.

The team reviewed the licensees fire pre-plan to assess whether the licensee adequately ventilated the smoke from the Unit 3A switchgear given the circumstances.

Specifically, the Unit 3 EDG had automatically started and was blowing high velocity air from the radiator exhaust into the direction of the 3A and 3B switchgear room door entrances. The team walked down the Unit 3 4kV switchgear rooms with the responsible SRO that had assisted in decision making to direct smoke ventilation during the incident, to understand the circumstances regarding the strategy used for ventilation.

The team reviewed the licensees fire risk management actions implemented after the licensee identified the fire door had been damaged, including the establishment of a fire watch in the 3A 4kV switchgear room. The team reviewed the licensees fire brigade response report and CAP database to determine if the licensee was adequately addressing any unresolved issues identified during the fire brigade response.

b. Findings and Observations

On March 18, 2017, at approximately 11:07 a.m. EDT, as a result of an arc flash in switchgear room 3A, eleven out of eleven spot detectors and two out of two very early warning detectors activated in switchgear room 3B. The spot detectors activated spatially from the first detector closest to Fire Door D070-3, which separates switchgear Room 3A and 3B, to the last spot detector activating closest to the exit door on the east side of the room. The licensee acknowledged the alarms at Fire Alarm Control Panel 3C286 after the incident; however, the licensee did not reactivate the smoke detectors until sixty two hours later on March 21, 2017, at 12:51 a.m. EDT. The team confirmed with the licensee that the detectors would not have activated between the times they were acknowledged and reactivated.

The 3B 4kV switchgear was the protected train after the arc flash in the 3A 4kV switchgear. Procedure 0-ADM-016, Fire Protection Program, Rev. 19, Table 5.6.3-1, denotes Fire Zone 70 (3B 4kV switchgear) to include fire detection instruments in the maintenance rule (a)(4) monitored fire zone and specified required risk-informed interim compensatory actions for degraded equipment. Section 5.6.3.3.d outlined these compensatory actions as the following: all detection instruments must be in service when required to be functional. If any single detector instrument is declared out of service, within one hour, a continuous fire watch shall be established and maintained until the detection instrument is returned to service Smoke removal activities immediately after the incident credits personnel in the switchgear room 3B for nearly four hours. Thereafter, based on the security access logs, at 2:43 p.m. EDT, two maintenance personnel were placed on fire watch duty until 5:22 p.m. EDT. However, these individuals monitored switchgear room 3A and were not placed inside the room with the credited train, 3B. The following fire watch shift arrived at approximately 6:00 p.m. EDT and maintained presence outside of both switchgear rooms 3A and 3B with the entry doors closed. The licensee informed the team that the crew was fearful of the persistent odor that was emanating after the incident in switchgear 3A. Since this crew did not maintain logs nor access the doors, the licensee confirmed to the team they were present outside. AR 2194579 was generated to document fire watches located outside the room do not meet the intent of 0-ADM-016.4, Fire Watch Program. The first documented log of a continuous fire watch occurred at 1:15 p.m. EDT on March 19, 2017. This log continues until the smoke detectors were reactivated at 12:51 a.m. EDT on March 21, 2017; however these individuals were located in switchgear room 3A.

The team interviewed fire watch personnel and determined that the individuals, which did not maintain fire watch logs and stationed themselves outside the switchgear rooms, were Florida Power and Light (FP&L) employees who recently started fire watch activities; whereas, the individuals that maintained logs and placed themselves inside switchgear room 3A were experienced contractors. The team did not have an opportunity to interview FP&L fire watch employees; the contractors that were interviewed were trained and experienced to sufficiently perform the duties.

In addition, the single smoke detector in the 480V Load Center 3A, 3B room (Fire Zone 95) located directly above the switchgear rooms did activate during the incident and was not reactivated until 12:51 a.m. EDT on March 21, 2017. The detector is assumed to have activated by smoke travelling from switchgear room 3A to switchgear room 3B to the fire door located on the second level of switchgear room 3B. According to 0-ADM-016.4, Fire Watch Program, for a deactivated detector in the 480V Load Center 3A, 3B room, the following requirement applies: ...restore the non-functional instruments to functional status within 14 days or within the next 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> establish a fire watch patrol to inspect the zones with the non-functional instruments at least once per hour. The licensee maintained an hourly roving fire watch in switchgear rooms 3A, 3B and 3 A/B/C/D 480V Load Centers rooms before the incident that was temporarily suspended for the 11:00 a.m., 12:00 p.m., 1:00 p.m. & 2:00 p.m. hours on March 18, 2017, due to scene safety and subsequent investigation. The hourly rove was reinstated in switchgear rooms 3A, 3B and 3 A/B/C/D 480V Load Center rooms for the 3:00 p.m.

hour.

The team interviewed licensee fire managers regarding the fire response activities after the incident. The managers were cognizant of the issues and attributed them partly to the false fire alarms in other areas of the plant that occurred shortly after the event.

AR 2194706 was generated to enhance fire procedures that would address functionality of suppression, detection and barriers; and consideration of compensatory measures post incident.

Overall, the team concluded that the licensees fire brigade response and communications were adequate following the event. However, the team identified issues with regards to the establishment of a fire watch for the 4kV switchgear rooms following the event and therefore opened an Unresolved Item (URI) as documented below.

URI 05000250, 251/2017008-01, Potential Failure of Fire Detection Capability on Credited Train of Equipment Following High Energy Arc Flash Event

Introduction:

The team identified an URI associated with the licensees actions to implement fire watches following the 3A 4kV switchgear high energy arc flash. These actions potentially resulted in inadequate fire detection capability in the 3B 4kV switchgear room for a period of up to 58 hours6.712963e-4 days <br />0.0161 hours <br />9.589947e-5 weeks <br />2.2069e-5 months <br /> following the event on March 18, 2017.

Description:

The arc flash in the 3A 4kV switchgear room activated all spot type and early warning smoke detectors in the 3A 4kV switchgear, 3B 4kV switchgear and 3/A/B 480V Load Center rooms. These detectors were not reactivated until 62 hours7.175926e-4 days <br />0.0172 hours <br />1.025132e-4 weeks <br />2.3591e-5 months <br /> later on March 21, 2017, (58 hours6.712963e-4 days <br />0.0161 hours <br />9.589947e-5 weeks <br />2.2069e-5 months <br /> following completion of smoke removal activities). After the event, the 3B 4kV switchgear was the protected train of equipment. Due to the risk significance of switchgear room 3B, Procedure 0-ADM-016.4, Fire Watch Program, required a continuous fire watch with one smoke detector out of service. For the 3/A/B 480V Load Center, Procedure 0-ADM-016.4 required an hourly fire rove for detectors out of service. The licensee had established an hourly fire rove before the incident for all the affected rooms that was temporarily suspended for scene safety and subsequent investigation. The licensee was unable to document a continuous fire watch for 58 hours6.712963e-4 days <br />0.0161 hours <br />9.589947e-5 weeks <br />2.2069e-5 months <br /> following the smoke removal activities in switchgear room 3B until the detectors were reactivated.

Fire watches were posted after the incident to cover switchgear room 3A, which was the non-credited train of equipment. In addition, for approximately 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> following smoke removal activities, the individuals covering switchgear room 3A did not keep fire watch logs and for a period of time the individuals stayed outside the room with the entry door closed. The team noted the cause of this deficiency was primarily due to lack of training and guidance for individuals performing the fire watches.

As a result of inactive smoke detectors and no fire watches in switchgear room 3B, the credited train was without smoke detection for approximately 58 hours6.712963e-4 days <br />0.0161 hours <br />9.589947e-5 weeks <br />2.2069e-5 months <br /> following smoke removal activities. Due to the risk significance of the room, licensee procedures required a continuous fire watch with one detector out of service. An URI has been opened for additional review to identify whether a performance deficiency existed related to the licensees fire watch actions following the arc flash event on March 18. (URI 05000250, 251/2017008-01, Potential Failure of Fire Detection Capability on Credited Train of Equipment Following High Energy Arc Flash Event)

.6 Review and evaluate the licensees emergency preparedness response. Specifically,

determine whether reportability notifications were made accurately, reported to the correct stakeholders, and accomplished in the appropriate timeframes. Determine whether emergency action levels were accurately declared.

a. Inspection Scope

The team reviewed the licensees Alert declaration event report, conducted interviews with operators and emergency preparedness personnel, reviewed control room logs, and reviewed the licensees Emergency Action Level (EAL) procedures to determine whether EALs were accurately declared and whether notifications were accurate and timely.

b. Findings and Observations

The team determined that the licensee accurately classified the event as an Alert under the category HA2, Fire or Explosion Affecting the Operability of Plant Systems Required to Establish or Maintain Safe Shutdown, and declared the Alert at 11:19 a.m. EDT, on March 18, 2017, within the 15 minute time requirement. The licensee also notified the NRC at 12:09 p.m. EDT, within the 60 minute time requirement. The Technical Support Center, Operations Support Center, and Emergency Operations Facility were activated and fully staffed. The team identified one issue related to the failure to establish the Emergency Response Data System (ERDS) due to an equipment malfunction, however voice link was established through the Emergency Notification System Bridge. The team determined the Alert was appropriately terminated at 2:20 p.m. EDT on March 18, 2017, following restoration of the Unit 4 HHSI pumps, evaluation of the damaged fire door, and inspection of the 3B 4kV switchgear.

.7 Review and assess the licensees Risk Management Program actions. Specifically,

review maintenance rule 10 CFR 50.65(a)(4) actions associated with the emergent issue for the Unit 4 HHSI system, including the evaluation of risk configuration and allowance of work in 3A or 3B switchgear rooms. Review the licensees procedures and practices for accounting for risk on the opposite unit when equipment is removed from service.

Gather information on the licensees knowledge and understanding of Unit 4 on-line risk following the loss of the 3A 4kV switchgear bus.

a. Inspection Scope

The team reviewed the licensees Maintenance Rule 10 CFR 50.65 (a)(4) risk management program actions associated with the emergent issue on the Unit 4 leak on the recirculation line of the high head safety injection (HHSI) pumps. The team reviewed the Unit 3 and Unit 4 risk management actions following the failure of the Unit 3 3A 4kV switchgear bus. The team also interviewed the control room shift manager, and the Unit 3 and Unit 4 control room unit supervisors that had the shift responsibilities the day of the Unit 3 4kV switchgear failure to assess their understanding of the risk management actions associated with declaring the 4A and 4B HHSI pumps available to perform their safety function. The team reviewed the software program used by the licensee to assess on-line risk and used the program to run several independent specific scenarios to obtain the core damage frequency (CDF) on-line risk for those scenarios. The team reviewed the clearance tag out that was used to place the 4A and 4B HHSI pumps out of service for making the repairs to the pump recirculation line. The team reviewed the emergency operating procedures for the operator actions the licensee credited for starting the HHSI pumps, versus an automatic start, and assessed whether the actions were adequate to maintain the HHSI pumps available in the on-line risk monitor (OLRM).

The team reviewed the training provided to licensed operators with respect to crediting operator actions to maintain safety systems as available in the OLRM. The team reviewed the licensees procedures that described guarding and protection of safety-related equipment during periods when other systems were undergoing maintenance or being tested.

b. Findings and Observations

Overall, the team identified several weaknesses with the licensees Risk Management Program actions, both prior to, and after the event. Specifically, 10 CFR 50.65(a)(4)actions associated with the emergent issue for the Unit 4 HHSI system were based on the incorrect assumption that the 4A and 4B HHSI pumps were available. This led to risk management actions that did not include the protection of the 3A and 3B 4kV switchgear which allowed work in the 3A switchgear room to proceed.

The teams review of the licensees procedures and practices for accounting for risk on the opposite unit with equipment removed from service identified issues for further follow-up by the regional senior risk analyst and, therefore, an URI was opened, as documented below.

URI 05000250, 251/2017008-02, Potential Failure to Complete an Adequate Risk Assessment

Introduction:

The team identified an URI associated with the licensees assessment and management of risk under 10 CFR 50.65(a)(4) prior to and following the event, including their conclusions regarding availability of the Unit 4 HHSI pumps.

Description:

On Friday March 17, 2017, Unit 3 was operating at 100 percent rated thermal power (RTP) and the operational core damage frequency (CDF) of the OLRM was in the low end of the Green band, indicating power operations in the low risk band.

Unit 4 was operating at 100 percent RTP and the CDF was also Green in the OLRM. A down-power on Unit 3 was planned to start the next day in preparation for entering a refueling outage. A work crew was inside the 3A 4kV safety-related switchgear room installing Thermo-Lag insulation on cable trays. The licensee needed to complete this insulation work by the end of the Unit 3 outage in order to meet NFPA 805 commitments.

The Thermo-Lag work had been ongoing for several months. In the afternoon of March 17, 2017, Engineering identified a leak on a 3/4-inch diameter test line pipe down-stream of the common line that joins the 4A and 4B HHSI pump recirculation lines.

Based on the identified leakage and engineering inspection, the licensees immediate operability assessment concluded that Unit 4 HHSI system was operable and Operations requested a two-day prompt operability determination. The tag-out clearance to repair the test line required isolating the pump recirculation line to complete a welding code repair, resulting in the Unit 4 HHSI pumps becoming TS Inoperable and also unavailable to perform their safety function. It was estimated the work would take approximately 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />.

On Saturday, March 18, 2017, the licensee took the 4A and 4B pumps out of service to start the repair. At 6:24 a.m. EDT, both Units entered TS 3.5.2.a Action d, and started a 72-hour LCO for two of the four HHSI pumps TS Inoperable. During the day-shift turnover, the shift manager, both unit control room supervisors, and the reactor board operators were updated and informed of the plan to repair the HHSI test line. The crews reviewed the Unit 4 HHSI pumps status of pull-to-lock and the risk assessment that was completed which required operator actions to maintain the HHSI pumps available. None of the SROs challenged the licensees decision to use the EOP network to credit operator action or timeliness to start the pumps to declare the pumps available on the OLRM. The 4A and 4B HHSI return line was isolated at approximately 7:36 a.m. EDT, which prevented HHSI pump recirculation flow. The 4A and 4B HHSI pump breakers remained available and were not tagged out, and both pump control switches had been placed in pull-to-lock which prevented the pumps from automatically starting on either a Unit 3 or a Unit 4 safety injection (SI) actuation signal. The licensee did not enter the 4A and 4B HHSI pumps into the OLRM as unavailable, instead the pumps were declared available to perform their safety function based on crediting operator action to start the pumps. The licensee protected the 3A and 3B pump rooms, as well as the 3A and 3B pump supply breaker cubicles on their associated 4kV switchgear; however, with the 4A and 4B pumps considered available, the licensee did not protect the 3A and 3B 4kV switchgear, and the Thermo-Lag work continued in the 3A 4kV switchgear. Both units OLRM remained in the Green band, based, in part, on having four available HHSI pumps as determined by the licensees risk assessment actions and OLRM results.

The Turkey Point Unit 3 and Unit 4 HHSI systems are shared systems. Although each unit has two HHSI pumps, the OLRM credits four available HHSI pumps for Unit 3 and Unit 4. If either unit receives an SI actuation signal, all four pumps receive a start signal and inject into a common HHSI header. The Unit 3 and Unit 4 control rooms are co-located in one large room. There are four HHSI pump control switches in each control room, (i.e., each control room has switches for the 3A, 3B, 4A and 4B pumps). Each control room has the capability to start or stop any pump. However, if any pump switch is in the pull-to-lock position in either control room, then that pump will not automatically start, nor will it have manual start capability. The licensees risk assessment, credited control room operator action to start the 4A and 4B HHSI pumps, in place of an automatic start on a SI actuation, and did not enter the pumps as unavailable into the OLRM. Specifically, operator action was credited by the control room operator taking steps to manually start the HHSI pumps when entering the EOP network during a SI actuation. After entering EOP-E-0, Reactor Trip OR Safety Injection, step 4 had the operator check if SI was actuated, SI Annunciators - ANY ON, OR, Safeguards equipment - AUTO STARTED. In the response not obtained column of the EOP, if SI was required, the procedure had operators manually actuate SI and proceed to step 5.

That step required operators to complete Attachment 3 of EOP-E-0, Prompt Action Verifications, which required verification of pump operation of At least two High-Head SI pumps RUNNING. The response not obtained column requested the operator to manually start High-Head Pump(s). It was determined that it would take approximately 8.5 minutes to advance to that point in EOPs for the control room operator to manually start the tagged out Unit 4 HHSI pumps, in place of the immediate automatic pump start on an SI actuation. Additionally, the team found that on the Unit 3 control room switches, the 4A and 4B HHSI pumps had also been tagged and placed in pull-to-lock.

Additional time and coordination would have been needed between the two unit control room supervisors to take the 4A and 4B HHSI pumps out of pull to lock on the Unit 3 side, and this was not addressed in the EOP. During the interviews of the control room supervisors, they did not recall if this sequence of removing the pull-to-lock on both unit control rooms switches had been discussed and the licensee had not provided any written instructions or procedures to the board operators to address this portion of the switch sequencing for taking credit for operator action to start the 4A and 4B HHSI pumps.

The team found the licensee did not have a validated timeline to show that all operator action steps would be completed to make the HHSI pumps available prior to the time the HHSI pump safety functions were required. Specifically, the licensee had not validated that any accident scenario required a HHSI pump to start in less than 8.5 minutes.

Additionally, it was identified during the inspection that during a specific type of small break LOCA, the HHSI pumps could be started and left dead headed for more than 3 minutes. In this scenario, because the HHSI pump recirculation lines were tagged out, the pumps would have overheated and been damaged, causing the control room operators to have to address additional issues during accident mitigation, (i.e., loss of refueling water storage tank inventory due to potential leakage from pumps). In determining the risk assessment of the HHSI pump for availability, the licensee had not addressed this issue and no procedures were provided to control room operators to prevent running the pumps dead headed for longer than 3 minutes.

At 11:07 a.m. EDT, the Unit 3, 3A 4kV switchgear failed and the unit automatically tripped. The licensee determined the 3A HHSI pump was inoperable and at 11:13 a.m.

EDT both units entered T.S. 3.0.3 due to having three of four HHSI pumps inoperable on two units. The repair work on the Unit 4 HHSI test line had not progressed to the point of cutting the pipe and the licensee took actions to restore the 4A and 4B HHSI pumps.

At 1:36 p.m. EDT, the Unit 4 recirculation return line was restored and the HHSI pumps were returned to available and operable status. The team found that the licensee had not assessed the OLRM after the failure of the 3A 4kV switchgear and Unit 4 remained in Mode 1 at 100 percent RTP without an updated risk assessment. During the inspection, the team obtained Unit 3 and Unit 4 OLRM print outs for the equipment that was unavailable prior to, and after, the Unit 3 4kV switchgear failure. The results showed that with two HHSI pumps unavailable, (4A and 4B), Units 3 and 4 remained in the Green risk band. After the Unit 3A 4kV switchgear failure, with three HHSI pumps unavailable, Unit 3 increased to the Red band and Unit 4 risk increased to the upper limit of the Green band.

The team questioned the adequacy of the licensees decision to credit operator actions to maintain the Unit 4 HHSI pumps available while:

(1) performing the code repair on the Unit 4 common HHSI pump test line,

(2) potential existed for the HHSI pumps being operated without a recirculation flow line, and

(3) the adequacy of instructions or procedures to control room operators when starting the HHSI pumps in certain accident scenarios which would cause pumps to run dead headed. Additionally, the team questioned the licensees risk management decisions which included allowing work to continue in the 3A 4kV switchgear room, and, after the failed Unit 3A 4kV switchgear and Unit 3 reactor trip, failure to complete a risk assessment to account for additional unavailable safety-related equipment. The NRC required additional inspection to determine whether a performance deficiency exist. Specifically, further review is needed to:

(1) determine the adequacy of risk management actions taken to protect Unit 3 equipment while the 4A and 4B HHSI pumps were removed from service,

(2) review the OLRM tool to determine whether the CDF results are consistent with the unavailability of the HHSI pumps and the 3A 4kV switchgear, and

(3) review the licensees procedures to determine why instructions were provided to start the HHSI pumps while the recirculation lines were tagged out, without evaluating the potential consequences for damaging the pumps during a small break LOCA. (URI 05000250, 251/2017008-02, Potential Failure to Complete an Adequate Risk Assessment)

.8 Obtain information and assess the licensees evaluation of potential causes for the

failure of the reactor coil that led to the loss of the 3A 4kV switchgear bus.

a. Inspection Scope

The team reviewed licensee documents, performed walk downs associated with the safety-related 3A 4kV switchgear located inside room 071, and interviewed licensee personnel to determine the conditions leading up to the internal bus fault event on the morning of March 18, 2017. The documents reviewed included procedures, work orders, drawings of floor plans, one line diagrams, specifications, correspondence, photographs, licensees NRC Inspection Team Briefing document, and Root Cause Charter description AR 02192198.

b. Findings and Observations

The team initiated the review by performing a walk down of the 3A 4kV switchgear room to establish an understanding of the conditions inside the room that may have affected the 3A 4kV switchgear. The room, which was significantly smaller than the 3B 4kV switchgear room, provided minimally adequate access around the equipment, such as the switchgear, motor control centers (MCCs), a sequencer panel, a sump pump, and floor mounted air handling units. The current limiting reactor (CLR), or reactor coil, associated with the event was located in section 3AA06 of the 3A 4kV switchgear. The front of this section is across from a room air handler unit, which directs its air towards the ventilation louvers in the CLR section.

The team interviewed members of the licensees failure investigation process team and determined their evaluation of the potential causes for the failure of the reactor coil included:

• Bus fault in reactor coil cubicle 3AA06

• Failed insulator in cubicle 3AA06

• Fault in reactor coil

• Bus fault external to the 3AA06 cubicle

• Load fault with failure to isolate

• Magnetic properties of the reactor coil interacting with erected scaffold.

• 3AA06 side panels pushed in from outside reducing air gap

• Foreign material from internal and/or external sources

• Bolts installed with nuts facing towards grounded surfaces.

• Large quantities of conductive dust suspended in air from sweeping prior to fault Each of the potential causes were dismissed for lack of any evidence with the exception of those issues that would have contributed to a reduction in the air gap between uninsulated busses and ground surfaces.

The installation of the Thermo-Lag was in progress just prior to the bus fault and according to statements from the installing contractor personnel, they had just exited the room to prepare to go to lunch and had been cleaning up the space before leaving. One of the workers had gone back into the room to check on one last item when the bus fault occurred and suffered injuries as a result of the explosion.

Based on interviews and photographs provided, it was determined that the mesh, used to make up the joining pieces of insulation, was conductive. That mesh material was also light weight and made out of carbon fiber.

The protective relays operated as expected for almost all components, including the 174/TDO relay in the trip circuit that operated the lockout relay, which in turn opened all the breakers in the 3A 4kV switchgear bus. The lockout relay operation prevented the 3A EDG from closing in on the 3A 4kV switchgear bus. The loss of the bus initiated a loss of steam flow on the turbine. The Unit 3 turbine and generator were motoring for approximately 30 seconds with the transmission system experiencing power swings associated with the loss of the main generator. After 30 seconds, the Unit 3 generator 286/G3 lockout tripped followed by the switchyard breakers opening and isolating the generator in 1.8 cycles. The reactor coil separates the high and low sides of the 3A 4kV switchgear bus. The high side, which was upstream of the reactor coil, had a higher withstand capability for short circuits that the low side of the switchgear bus.

There is a slight difference between the overcurrent relays for phases A and B compared to phase C. Tracings provided with the details of current and voltage conditions prior to, during, and after the bus fault reveal an increase in the fault current of phase C preceding the increase in phase A. Photographs of the effects of the bus fault indicated an initial arc located next to what appeared to be phase C bus.

However, the target flags in the overcurrent relays failed to indicate a phase C trip.

The entire overcurrent protection system worked as expected except for the delay on the phase C components.

The team reviewed procedures and methods prescribed by the licensee to control foreign material contamination. A number of the methods indicated included cutting the Thermo-Lag material outside the switchgear room approximately 15 ft from the east door to the room. Some of the final cutting and trimming of the carbon fiber mesh was done inside the switchgear room on top of the scaffolding, which had been fitted with Grifflon net to protect from foreign material particles. In addition, a Pearl Weave material was used to protect against falling objects to the space below. The team was able to confirm a number of these methods used by the conditions of the space during the walk down of the room and the interview transcripts provided by the licensee of the Thermo-Lag installation personnel. However, these methods appear to cover larger pieces of material that would be appropriately captured by the Pearl Weave or the Grifflon but not the smaller pieces of carbon fiber mesh that could become airborne and migrate around the room. The only apparent control provided for airborne particulate would be the air filter in the air handling unit. This would require the material to be at an elevation low enough to get sucked in by the air return at the bottom of the air handler. Any material suspended in air would be blown out from the air handler and potentially be blown through the louvers in the reactor coil cabinet.

Overall, the team concluded that the licensee was taking appropriate actions to evaluate the potential causes for the failure of the 3A 4kV bus. The most likely potential causes of the event involve the introduction of foreign material into the switchgear as well as the configuration and design of the switchgear. Additional review of information related to these potential causes will be required following the conclusion of the licensees root cause evaluation, which had not yet been completed at the time of the inspection.

Therefore the team opened two URIs as documented below.

i. URI 05000250, 251/2017008-03, Potential Failure to Implement Adequate Foreign Material Exclusion Controls

Introduction:

The team identified an URI associated with the licensees potential failure to properly control the spread of airborne particulates generated from the installation of the Thermo-Lag insulation material on cable trays and conduits inside the 3A switchgear room.

Description:

The documentation provided to install the Thermo-Lag insulation was prescribed in work order 40464284-03, EC 283459 Install T-Lag of MCC-3B Power Cables in 3A SWGR, dated the 10th of March 2017. This work order referred to procedure MA-AA-101-1000, Foreign Material Exclusion Procedure, for job supervisor to review and approve the foreign material exclusion (FME) controls under item 2.3. The supervisor signature was provided on the 17th of October 2016 for this particular task.

However, the signature date was prior to this work order issue date. Section 4.3 of the FME procedure in paragraph 10 stated that, Special precautions need to be taken when work activities (spray painting, sand blasting, grinding, cutting, welding, insulating, chemical cleaning etc.) may generate airborne dust, debris or chemical fumes that could be introduced into operating plant equipment such as motors, switchgear, control panels and electrical cabinets. In addition, section 4.5.1, Electrical Cabinets, paragraph 1, directed personnel to visually inspect the surrounding area, particularly overhead, for potential sources of foreign material and to note any nearby ventilation system that may introduce foreign material into the cabinet. In paragraph 2, it indicated that, Where practical, covers should be installed on open electrical enclosures, cabinets, and boxes required to be left open by procedure, plant operations, or maintenance. Section 4.5.2, Switchgear, directed the personnel to follow the measures identified above.

In addition, the conductivity of this mesh may have played a significant factor in the resulting bus fault when it migrated into the reactor coil cabinet through the open louvers and formed a low impedance path from the exposed phase C bus to the metal enclosure of the cabinet. Pieces of the black mesh were discovered inside the reactor coil insulated windings, which indicated an absence of screening material or a means to block foreign material migration into the inside of the reactor coil cabinet with its exposed busses.

Procedure 0-GMP-102.21, Installation, Modification and Maintenance of Thermo-Lag Fire Barrier Systems, did not contain an engineering evaluation of the carbon fiber mesh used with the system installed inside the 3A 4kV switchgear room. Material safety data sheet (MSDS-0012821) from Cytec Engineered Materials with product name Thornel Pan Based Standard Modulus Carbon Fiber provided a hazard identification of Electrically Conductive Fibers - Airborne fibers can short circuit electrical equipment.

This URI was initiated to further review the environment created during the installation of the Thermo-Lag in 3A 4kV switchgear room. This environment may have contributed to a degraded isolation of exposed medium voltage bus bars inside the reactor coil cabinet.

Following the completion of the licensees root cause evaluation, inspectors will determine whether performance deficiencies existed related to the licensees evaluation of the carbon fiber mesh and the foreign material exclusion controls in effect at the time of the event. (URI 05000250, 251/2017008-03, Potential Failure to Implement Adequate Foreign Material Exclusion Controls)ii. URI 05000250, 251/2017008-04, Potential Inadequate Design Control of Current Limiting Reactor

Introduction:

The team identified an URI associated with potential discrepancies between the licensees design documentation and the installed configuration of busses inside the reactor coil cabinet.

Description:

The team reviewed the reactor coil layout drawing, showing the location of the reactor coil and bus configuration within the switchgear cabinet and compared the drawing with the photographs available of conditions inside the cabinet, including phase designation markings provided on the busses, which appeared to indicate a discrepancy between drawings and bus markings. The drawing indicated an incoming bus configuration from front to rear as phase B, phase C, and phase A. However, the photographs indicated markings on the busses themselves as phase A, phase B, and phase C. The trip flags on the overcurrent relays indicate an initial fault starting on phase A. This discrepancy should be reviewed and appropriate corrective actions taken.

The team also evaluated the available fault current on the 3A 4kV switchgear to assess the impact of the current limiting reactor (CLR) on the switchgear and its capacity to withstand short circuit currents imposed on the bus during faults. The vendor indicated that the 3A 4kV switchgear bus high side could withstand 78,000 amperes (A) but the low side could only withstand 60,000 A. The available fault currents in the low side configuration for restoration was determined to be 55,720 A asymmetrical or 35,171 A symmetrical.

The teams review of calculation PTN-3FSE-07-001, Unit 3 - Safety Related AC Electrical Distribution PSB-1, Short Circuit, Voltage Drop and Bus Loading Analysis, indicated an assumed 3A 4kV switchgear bracing for 78,000 A symmetrical to be consistent with a 350 MVA, 4kV breaker. However, other documents indicate a 78,777 A to be an asymmetrical fault current and a 350MVA capability corresponds more closely to 49,000 A symmetrical than the 78,000 A symmetrical. This issue needs further review in order to be fully understood and determine if there are any issues that need to be addressed.

The megger test results provided for the low side of the 3A 4kV switchgear established a 500 megohms (M) resistance measurement between the phase busses as satisfactory.

The inspectors noted that other national standards such as the International Testing Association Inc., Maintenance Testing Specifications, 1997 edition determined that the insulation resistance tests on electrical apparatus and systems recommends a minimum of 1,000 M for an equipment similar to the 3A 4kV switchgear rated for 5,000 V.

Finally, the team identified a potential concern with the design and installation of the CLR unit inside the 3A 4kV switchgear provided with exposed incoming and outgoing 4kV bussing. The 3A 4kV switchgear had thermoplastic insulated bussing throughout the gear except at the CLR coil. There was no industry standard for a required spacing between the bare individual phase busses and grounded surfaces. Information provided indicated a spacing that conformed to accepted industry technical publications.

However, other aspects associated with the cabinet construction and room layout of ventilation equipment in this particular case may have contributed to the bus fault. In particular, the louvers in the front and rear of the cabinet allow unimpeded access to the inside of the cabinet and the exposed energized busses. No guidance was provided to maintain the orientation of the bus connection bolts to provide as wide a gap as possible to grounded surfaces. In the case of the 3A 4kV switchgear, photographs showed evidence that the bolts had been installed backwards for the connection to the C phase bus at the rear bottom of the cabinet. This was the flash-over spot where the bus faulted to the metal cabinet. Specifications and drawings associated with this equipment did not provide any guidance on spacing or insulation to be applied to the busses.

An URI was opened in order to review the design and configuration of the reactor coil located inside the 3A 4kV switchgear following the completion of the licensees root cause evaluation. This review will be accomplished to determine whether any performance deficiencies exist in the area of design control. (URI 05000250, 251/2017008-04, Potential Inadequate Design Control of Current Limiting Reactor)

.9 Review preventive maintenance tasks and associated post-maintenance test records

associated with the 3A vital bus to determine if maintenance and testing was being performed in accordance with site procedures and equipment vendor recommendations.

a. Inspection Scope

The team reviewed licensee bus cleaning procedures, breaker inspection procedures, cubicle inspection and cleaning, work orders associated with relay calibration, work orders for breaker inspections, and discussed schedules for bus cleaning and relay calibration efforts to determine whether adequate maintenance and testing were being performed on the 3A 4kV bus.

b. Observations and Findings

The team reviewed the results of the past two performances of preventive maintenance (PM) procedure 0-PME-005-01, 3A 4.16 kV Bus Clearing Relay Test and Calibration.

Relay 3/3A1 PMs were performed on November 3, 2015, and on October 10, 2010, with satisfactory results. Relay 3/3A2 PMs were performed on February 3, 2017, and on October 10, 2010, with satisfactory results.

The team also reviewed the results of the past two performances of PM procedure 0-PME-005.03, 3A 4.16 kV General Electric breaker inspection and cleaning.

Maintenance for breaker 3AA05 was performed on November 6, 2015, and on January 10, 2012, with satisfactory results.

Additional work order packages which included grounding, inspecting, cleaning and meggering the 3AA06 reactor coil were conducted satisfactorily and within scheduled intervals. The inspectors also verified this maintenance was satisfactorily conducted on the other three safety-related switchgear reactor coils.

Overall, the team determined that the licensee had conducted adequate maintenance and testing on the 3A 4kV switchgear prior to the event. AR 02194587 was initiated in response to team comments on procedure 0-PME-005.10 - Section 4.21, Reactor Coil Cleaning and Inspection, for failing to address bus connection bolt orientation as this may have been a contributing factor to the bus fault.

.10 Review and evaluate information regarding the licensees activities in restoration of the

low side of the 3A vital bus.

a. Inspection Scope

The team reviewed inspection, cleaning, and testing procedures and issued work orders to determine the adequacy of activities to restore the low side of the 3A 4kV switchgear to service.

b. Findings and Observations

The team reviewed documentation that included a support or refute matrix that addressed potential causes of the bus fault. Based on the initial review of conditions identified with the CLR and the entire 3A 4kV switchgear by the licensee, it was appropriate to separate the 3A 4kV switchgear High side from the Low side by removing the bus on both sides of the CLR performed under Temporary Modification 288658. The high side, which was upstream of the reactor coil, had a higher withstand capability for short circuits that the low side of the switchgear bus. AR 02192198 was issued by Engineering to establish reasonable assurance that the low side of the 3A 4kV switchgear could be fed from 3C switchgear with no unintended consequences. The protection scheme for this restoration configuration, was powered from the 3C transformer through a 4,000 A, 3AC16 breaker that feeds an 800 A tie breaker 3AC13 and ties to breaker 3AA09 on the 3A switchgear. The team reviewed the licensees restoration review, which included a white paper that detailed the C-Bus loading and determined the operational impact addressing the 3A and 3C bus faults with and without feeder breaker actuation from the 3A bus and the 3C bus. The white paper covered the loads connected to 3A & 3C 4kV switchgears with the impact on the loss of each of the branch breakers tripping. Load center 3F, 3G, and 3E were included in the review of branch circuit failures. No significant impact was identified.

The teams review of the bus bars in the switchgear indicated that the bussing running the length of the gear was described as having insulation consisting of extruded thermoplastic sleeve and bus joints insulated with polyvinyl chloride boots. This insulation was verified with photographs provided of previous inspections of the switchgear. The inspection of the back of the cubicles 3AA07, 3AA08, 3AA10, 3AA11, 3AA17, 3AA18, 3AA19, 3AA20, and 3AA21 revealed that thermal-lag fibers were found in cubicles 17 and 21. These fibers had been removed at the time of the inspection.

There was additional cleaning performed in the 3AA06 cubicle bus bars to raise the megger readings on the east side bus of the 3A 4kV switchgear to a level greater than 500 M. However, the basis for this satisfactory resistance number was not made clear.

This question is presented above as part of the URI 05000250, 251/2017008-04.

Overall, the team concluded that the licensees activities to restore the low side of the 3A 4kV bus were adequate.

.11 Gather information to support additional reviews on generic implications associated with

fire doors in rooms with the potential for high arcing events. Identify any other potential generic safety issues and make recommendations for appropriate follow-up action (e.g.,

Information Notices, Generic Letters, and Bulletins).

a. Inspection Scope

The team performed a walk down of the 3A 4kV switchgear room and reviewed applicable plant drawings, room volume calculations, electrical discharge recordings and plant status conditions which led to the event. The team also performed a visual inspection of the damage and deformation of Fire Door D070-3 latching mechanism. In addition, the team reviewed licensee NFPA-805 documentation and supporting analysis for high energy arc fault (HEAF) scenarios and the multi-compartment scenario for the 3A and 3B 4kV switchgear room in the context of the assumptions for door failure. This was done to gather information to support additional reviews and to make recommendations for appropriate follow-up on generic implications associated with this event.

b. Findings and Observations

The team conducted a review of the licensees evaluation of Fire Door D070-3 in the context of potential damage following a HEAF event. The licensee followed requirements that are contained in NUREG/CR-6850, Volume 2, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volume 2: Detailed Methodology, Appendix M, Appendix for Chapter 11, High Energy Arcing Faults, which stated, Any vulnerable component or movable/operable structural element located within 0.9 m (3 ft)horizontally of either the front or rear panels/doors, and at or below the top of the faulting cabinet section, will suffer physical damage and functional failure. This will include mobile/operable structural elements like fire dampers and fire doors.

Fire door D070-3 was outside the 0.9 m (3 ft) recommended damage zone of influence.

The reactor coil cabinet 3AA06 and Fire Door D070-3 were separated by 4.4m (14.5 ft)measured diagonally (i.e. - straight line distance from nearest edge of cabinet 3AA06

[i.e. - southwest corner of cabinet] to the nearest edge of the door). The closest electrical enclosure was 1.8m (5.8 ft) from fire door D070-3.

The guidance provided in Appendix M of NUREG/CR-6850 intended to capture the immediate damage state corresponding to the first phase of a HEAF event and did not take room pressurization into consideration for barrier failure. The first phase was defined as; the short, rapid release of electrical energy followed by ensuing fire(s) that may involve the electrical device itself, as well as any external exposed combustibles, such as overhead exposed cable trays or nearby panels, that may be ignited or damaged during the energetic phase.

The damage and deformation of the latch mechanism of Fire Door D070-3 was caused by the over-pressurization of the room corresponding to the increase in pressure at the onset of the arc event. Fire Door D070-3 was not rated as a pressure boundary and the pressure increase was enough to deform the latch mechanism, enabling the door to swing into the 3B 4kV switchgear room, defeating the 3-hour fire barrier classification.

The team reviewed the licensees HEAF scenario associated with the event and the multi-compartment analysis scenario associated with the 3A and 3B 4kV switchgear rooms identified as scenario 071-MCA-1-PTB. The following was the licensee risk quantification of the event. For the multi-compartment scenario the non-suppression probability values were set to 0.0 because there was no hot gas layer development during the event.

Scenario Zone IGF NSP SF CCDP CDF Actual 071 1.00E+00 1.00E+00 1 9.63E-07 9.63E-07 071-MCA-1-PTB Zone 71 to 70 1.00E+00 0.00E+00 1.00E+00 1.05E-01 0.00E+00 The conditional core damage probability (CCDP) contribution for the multi-compartment scenario highlights the importance of the 3-hour barrier between the switchgear rooms.

From a review of international operating experience documented in the Organisation for Economic Co-operation and Development (OECD) report titled, OECD Fire Project -

Topical Report No. 1. Analysis of High Energy Arcing Fault (HEAF) Fire Events, fire door deformation has been observed following HEAF events in small spaces. The team reviewed volumetric calculations of the 3A 4kV switchgear room which has an estimated free volume of 15,700 cubic ft (minus equipment) per plant drawings 5610-C-114, Sheet 1, Rev. 16, 5610-C-390, Rev. 12, and 5610-E-52, Rev. 5. The phenomena of door failure following a HEAF event in a small space may be an area for future research, guidance changes and, or an NRC Information Notice.

The team also reviewed the ongoing licensee root cause analysis efforts and the postulated failure mechanism identified as FME intrusion of the carbon fiber Thermo-Lag mesh material. As identified above in URI 05000250, 251/2017008-03, the installation and conductivity influence of the Thermo-Lag black carbon fiber mesh materials have been identified as an area for generic communication.

The conductivity of this mesh was a suspected significant factor in the resulting bus fault when it migrated into the reactor coil cabinet through the open louvers and formed a low impedance path from the exposed phase C bus to the metal enclosure of the cabinet.

Pieces of the black mesh were discovered inside the reactor coil insulated windings, which indicated an absence of screening material or a means to block foreign material migration into the inside of the reactor coil cabinet with its exposed busses.

From a review of operating experience, Turkey Point had experienced several other precursor events in the battery charger rooms while in the process of Thermo-Lag installation nearby. On February 8, 2017, the 3B2 vital battery charger input breaker and 480 V supply breaker unexpectedly tripped while in service. At the time of the trip, Projects personnel were in the new electrical equipment room (NEER) installing Thermo-Lag insulation. A loud bang and possible flash were reported to have occurred in the lower level near the 4D MCC. The breaker trips rendered the battery charger incapable of performing its design function. This trip occurred 6 days after similar trips. The 3A2 charger MCC supply breaker and input breaker tripped, followed approximately 4 minutes later by the 051 spare charger input breaker trip. At the time of the trips, Projects personnel were cleaning up following an ongoing effort to remove and replace thermal insulation in the NEER, specifically in the vicinity of the two chargers.

Subsequent investigation identified a notable level of dust in the room and also inside the charger cabinets. Electrical Maintenance determined that dust inside the charger cabinets was conductive. The battery chargers were cleaned by Electrical Maintenance using soft brushes and a vacuum. Both chargers were then successfully returned to service without incident. The licensee identified the battery charger events as a result of external factors including possible conductive dust but failed to identify the potential influence of the carbon fiber mesh conductivity influence from the Thermo-Lag installation. The corrective actions for the event included thorough cleaning of the chargers and subcomponents in the area required for voltage regulation. An URI related to this issue was opened in NRC Inspection Report 05000250/2017001 and 05000251/2017001 (ADAMS Accession #ML17131A318).

After the event on March 18, 2017, and the identification of the carbon fiber mesh as a potential failure mechanism, the licensee halted all Thermo-Lag installation fleet-wide until appropriate FME controls could be implemented to address the conductivity and inductive effects on circuits where it is applied. On April 17, 2017, the licensee revised its work practices for installing Thermo-Lag and instituted controls to perform all cutting and trimming of any insulation materials outside switchgear rooms in a tented area that has high efficiency particulate air (HEPA) filters operating. The electrical buses were being draped with plastic FME material to prevent any insulation materials from entering the cubicles.

Overall, the team gathered information to support additional reviews on generic implications associated with fire doors in rooms with the potential for high arcing events as well as information to support a potential generic communication related to the conductivity of specific Thermo-Lag insulation materials.

4OA6 Meetings, Including Exit

On March 29, 2017, the team presented the inspection results to Mr. Tom Summers, Regional Vice President and other members of the licensees staff. Proprietary information that was reviewed during the inspection was returned to the licensee or destroyed in accordance with prescribed controls.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

C. Bible, Fleet Engineering Director

P. Czaya, Licensing Engineer

M. Downs, Senior Emergency Preparedness Coordinator

U. Farradj, Jensen Hughes

M. George, Fire Protection Coordinator

R. Gil, Fleet Engineering Manager

M. Guth, Licensing Manager

R. Hess, General Operations Training Supervisor

S. Heyworth, Fire Protection Program Engineer

J. Melchior, Fire Protection Analyst

J. Mowbray, Engineering Site Manager - Programs

L. Nicholson, Licensing Director

P. Polfleit, Emergency Preparedness Corporate Functional Area Manager

L. Porro, Programs Engineering Corporate Functional Area Manager

A. Restrepo, Senior Engineer - PRA

C. Sinopoli, Jensen Hughes

J. Speicher, Operations Unit Supervisor

B. Stamp, Plant General Manager

T. Summers, Southern Regional Vice-President

K. Vincent, Senior Engineer - PRA

J. Vives, Electrical Design Engineering Supervisor

NRC personnel

J. Hanna, Senior Risk Analyst, Division of Reactor Projects

D. Orr, Senior Resident Inspector, Turkey Point

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000250, 251/2017008-01 URI Potential Failure of Fire Detection Capability on Credited Train of Equipment Following High Energy Arc Flash Event (Section 4OA5.5.b)

05000250, 251/2017008-02 URI Potential Failure to Complete an Adequate Risk Assessment (Section 4OA5.7.b)

05000250, 251/2017008-03 URI Potential Failure to Implement Adequate Foreign Material Exclusion Controls (Section 4OA5.8.b.i)

05000250, 251/2017008-04 URI Potential Inadequate Design Control of Current Limiting Reactor (Section 4OA5.8.b.ii)