IR 05000281/2020090

NRC Inspection Report 05000281/2020090 and Preliminary White Finding and Apparent Violation

ML20181A438
Person / Time
Site:	Surry
Issue date:	06/26/2020
From:	Mark Miller Division Reactor Projects II
To:	Stoddard D Virginia Electric & Power Co (VEPCO)
References
EA-20-057 IR 2020090
Download: ML20181A438 (16)

Text

June 26, 2020

SUBJECT:

SURRY POWER STATION - NRC INSPECTION REPORT 05000281/2020090 AND PRELIMINARY WHITE FINDING AND APPARENT VIOLATION

Dear Mr. Stoddard:

On May 13, 2020, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Surry Power Station. The purpose of the inspection was to review the turbine-drive auxiliary feedwater system discharge check valve failure that occurred on November 20, 2019.

On May 13, 2020, the NRC inspectors discussed the results of this inspection with Mr. Fred Mladen and other members of your staff. Inspectors documented the results of the inspection in the enclosed report.

Section 71152 of the enclosed report documents a finding with an associated apparent violation that the NRC has preliminarily determined to be White with low-to-moderate safety significance.

Inspectors found that Dominion Energy did not analyze common failure or maintenance patterns to determine their significance and to identify potential failure mechanisms of the Unit 2 turbine driven auxiliary feedwater pump discharge check valve, 2-FW-142, when establishing its check valve condition monitoring program in accordance with the 2004 ASME Code for Operation and Maintenance of Nuclear Power Plants, Mandatory Appendix II. The inspectors determined that this was a performance deficiency reasonably within Dominion Energys ability to foresee and prevent since program establishment in 2005 and identification of valve failure during testing on November 20, 2019. We assessed the significance of the finding using the significance determination process (SDP) and readily available information. We are considering escalated enforcement for the apparent violation consistent with our Enforcement Policy, which can be found at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. Because we have not made a final determination, no notice of violation is being issued at this time. Please be aware that further NRC review may prompt us to modify the number and characterization of any apparent violations.

We intend to issue our final significance determination and enforcement decision, in writing, within 90 days from the date of this letter. The NRCs significance determination process (SDP) is designed to encourage an open dialogue between your staff and the NRC; however, neither the dialogue nor the written information you provide should affect the timeliness of our final determination.

Before we make a final decision, you may choose to communicate your position on the facts and assumptions used to arrive at the finding and assess its significance by either (1) attending and presenting at a regulatory conference or (2) submitting your position in writing. The focus of a regulatory conference is to discuss the significance of the finding. Written responses should reference the inspection report number and enforcement action number associated with this letter in the subject line.

If you request a regulatory conference, it should be held within 40 days of your receipt of this letter. Please provide information you would like us to consider or discuss with you at least 10 days prior to any scheduled conference. If you choose to attend a regulatory conference, it will be open for public observation. If you decide to submit only a written response, it should be sent to the NRC within 40 days of your receipt of this letter. If you choose not to request a regulatory conference or to submit a written response, you will not be allowed to appeal the NRCs final significance determination.

Please contact Stewart N. Bailey at 404-997-4545, and in writing, within seven days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within seven days, we will continue with our significance determination and enforcement decision.

This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Mark S. Miller, Director Division of Reactor Projects Docket No. 05000281 License No. DPR-37

Enclosure:

IR 05000281/2020090 w/Attachments: Supplemental Information TDAFW Self Recovery Term White Paper

Inspection Report

Docket Number: 05000281 License Number: DPR-37 Report Number: 05000281/2020090 Enterprise Identifier: I-2020-090-0004 Licensee: Virginia Electric and Power Company Facility: Surry Power Station Location: Surry, Virginia Inspection Dates: November 20, 2019 to May 13, 2020 Inspectors: L. McKown, Senior Resident Inspector C. Read, Resident Inspector A. Rosebrook, Senior Reactor Analyst Approved By: Stewart N. Bailey, Chief Reactor Projects Branch 4 Division of Reactor Projects Enclosure

SUMMARY

The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees performance by conducting an NRC inspection at Surry Power Station, in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors. Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information.

List of Findings and Violations

Failure to implement the ASME Operation and Maintenance Code (OM) Inservice Testing Program for Pumps and Valves (IST) leads to a failure of the turbine driven auxiliary feedwater pump during testing.

Cornerstone Significance Cross-Cutting Report Aspect Section Mitigating Preliminary White None (NPP) 71152 Systems AV 05000281/2020090-01 Open EA-20-057 A self-revealing apparent violation of 10 CFR 50.55a(f)(4) was discovered associated with the licensees inability to implement the ASME Operation and Maintenance Code (OM)

Inservice Testing Program for Pumps and Valves (IST). Specifically, the established check valve condition monitoring program could not detect degradation of the Unit 2 turbine driven auxiliary feedwater (TDAFW) pump discharge check valve which led to failure of the valve and caused the pump to rotate in the reverse direction. This resulted in unrecoverable damage to the pump and turbine bearings requiring invasive maintenance to restore during surveillance testing on November 20, 2019. The condition also rendered the motor-driven auxiliary feedwater (MDAFW) pumps unable to provide FSAR minimum required flow to the steam generators due to flow being bypassed via the TDAFW line. As a result, all three Unit 2 auxiliary feedwater pumps were declared inoperable on November 20, 2019, and the safety function was considered lost until the TDAFW line was isolated.

Additional Tracking Items

Type Issue Number Title Report Section Status LER 05000281/2019-002-00 Surry, Unit 2, Auxiliary 71153 Closed Feedwater System Loss of Safety Function due to Check Valve Failure to Close

INSPECTION SCOPES

Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with their attached revision histories are located on the public website at http://www.nrc.gov/reading-rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared complete when the IP requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter (IMC) 2515, Light-Water Reactor Inspection Program - Operations Phase. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.

71152 - Problem Identification and Resolution

Annual Follow-up of Selected Issues (IP Section 02.03) (1 Sample)

The inspectors reviewed the licensees implementation of its corrective action program related to the following issues:

(1) CR1136400, Unit 2 auxiliary feedwater declared inoperable due to the failure of the turbine driven auxiliary feedwater pump discharge check valve, on February 28, 2020.

71153 - Followup of Events and Notices of Enforcement Discretion Event Report (IP Section 03.02)

The inspectors evaluated the following licensee event reports (LERs):

(1) LER 2019-002-00 for Surry, Unit 2, Auxiliary Feedwater System Loss of Safety Function due to Check Valve Failure to Close (ADAMS Accession Number ML20028D616). The inspection conclusions associated with this LER are documented in this report in the Inspection Results Section.

INSPECTION RESULTS

Failure to implement the ASME Operation and Maintenance Code (OM) Inservice Testing Program for Pumps and Valves (IST) leads to a failure of the turbine driven auxiliary feedwater pump during testing.

Cornerstone Significance Cross-Cutting Report Aspect Section Mitigating Preliminary White None (NPP) 71152 Systems AV 05000281/2020090-01 Open EA-20-057 A self-revealing apparent violation of 10 CFR 50.55a(f)(4) was discovered associated with the licensees inability to implement the ASME Operation and Maintenance Code (OM)

Inservice Testing Program for Pumps and Valves (IST). Specifically, the established check valve condition monitoring program could not detect degradation of the Unit 2 turbine driven auxiliary feedwater pump discharge check valve which led to failure of the valve and caused the pump to rotate in the reverse direction. This resulted in unrecoverable damage to the pump and turbine bearings requiring invasive maintenance to restore during surveillance testing on November 20, 2019. The condition also rendered the motor-driven auxiliary feedwater (MDAFW) pumps unable to provide FSAR minimum required flow to the steam generators due to flow being bypassed via the TDAFW line. As a result, all three Unit 2 auxiliary feedwater pumps were declared inoperable on November 20, 2019, and the safety function was considered lost until the TDAFW line was isolated.

Description:

On November 20, 2019, with Unit 1 in cold shutdown and Unit 2 in power operation, during an auxiliary feedwater (AFW) cross-tie test from Unit 2 to Unit 1, 1-OPT-FW-008, AFW Check Valve Operability Test, backflow from the Unit 2 B Motor Driven AFW pump through the Unit 2 turbine driven (TD) AFW Pump, 2-FW-P-2, caused the pump to rotate in the reverse direction resulting in unrecoverable damage to the pump and turbine bearings requiring invasive maintenance to restore. The backflow and reverse rotation of the pump was due to a self-revealing failure of the TDAFW pump discharge check valve, 2-FW-142, to check shut or closed. Upon internal inspection, the direct cause of the check valve failure was determined to be excessive wear of the disc assembly subcomponents.

The AFW system provides a safety-related (SR) means of supplying the steam generators (SGs) with feedwater. Operation of the system is automatically or manually initiated. It consists principally of a turbine-driven auxiliary feedwater pump rated for 700 gpm, two motor-driven AFW pumps rated for 350 gpm each, a 110,000-gallon storage tank, and associated piping, valves, and controls. The turbine driven pump and the electrically driven pumps represent two diverse pumping systems to deliver makeup water to the SGs to remove decay heat in the event the feedwater system is not available. The three AFW pump discharge lines are arranged in parallel with a single pump discharge check valve in each pump discharge line. Each parallel line then divides to provide flow through manual isolation valves into the two common AFW headers in each unit. Sets of supply lines from each common header later direct flow to each steam generator in containment.

The condition monitoring of AFW pump discharge check valves is based upon 10 CFR 50.55a(f)(4) which incorporates the ASME Operation and Maintenance Code (OM) Inservice Testing Program for Pumps and Valves (IST) as a regulatory requirement. Dominion Energy chose to implement this program for all of its IST check valves using the OM Mandatory Appendix II Check Valve Condition Monitoring Program (2004 edition). This appendix established the standard for implementing and maintaining a check valve condition monitoring program. Subsection II-3000 provides direction for the analysis of the test and maintenance history of a valve or group of valves in order to establish the basis for specifying inservice testing, examination, and preventive maintenance activities.

In 1995, during a preventive maintenance task evaluation review following challenges with failure and leakby at three of the six AFW pump discharge check valves, the licensee identified the following:

These check valves are tested OPEN/CLOSE during a refueling cycle. The testing, though, does not tell if the valves are becoming worn and how much or how fast. The check valves are located at the exit of the pump and an elbow, which is contrary to the EPRI recommendation of proximity to upstream disturbances induces turbulence and thus wear.

The inspections will determine how fast the check valves are wearing, so repair/replacement can be properly planned and scheduled.

The associated preventive maintenance activities to perform check valve internal inspections created in 1995, were removed from active status in 1996 without evaluation of the previously identified concerns. Upon implementation of the check valve monitoring program on November 23, 2005, the inspectors found that while Dominion Energy did identify some of the work orders and operating experience associated with the TDAFW pump discharge check valves, there was no indication that these prior challenges or industry standards informed the decision-making process. Therefore, the OPEN/CLOSE unit cross-feed test, 1/2-OPT-FW-008, performed every refueling cycle was established by the licensee as the IST program requirement for monitoring of the closure TDAFW discharge check valves. The quarterly IST pump test, 2-OPT-FW-003, Turbine Driven Auxiliary Feedwater Pump 2-FW-P-2, was used to establish the discharge check valve opening test.

Surry Power Station has the capability to cross-feed the output from one unit to the other.

This action is implemented from the main control room and does not have automatic actuation. During the performance of 1/2-OPT-FW-008, the licensee assesses the ability of the AFW discharge check valves to check closed in a unit during a refueling outage. This process, also, happens to test the capability of the TDAFW discharge check valve in the operating unit to check closed as well, but this test is not credited within the IST program for this function.

The last successful performance of a unit AFW cross flow test which confirmed the check closed function of valve 2-FW-142 prior to the event was test 2-OPT-FW-008, on October 28, 2018. The last successful performance of the unit 2 TDAFW IST quarterly pump test which confirmed the open function of check valve 2-FW-142 prior to the event was IST pump test 2-OPT-FW-003, on October 28, 2019.

The assessment of the inspectors is consistent with that determined by the licensees root cause analysis:

The root cause of the inoperability of the Auxiliary Feedwater System was due to an inadequate preventative maintenance of the 2-FW-142 check valve as a result of decisions made in 1996 and 2005 to cancel the WOs for open and inspect of the check valves and to place the PM in an On Demand status. As a result, the station was not monitoring the extent of the wear occurring on the valve internals.

The check valve failure to completely close was a result of excessive wear of the disc assembly parts. The PM that is used to verify the valve works in the closed direction is a back-leakage check (1/2-OPT-FW-008). The leak check method of testing was not adequate to detect the type of failure that occurred for this valve in this event. This valve was among others that had previously been identified as being installed in a location that experienced turbulence that causes wearing of the components. As a result, an Open/Inspect PM was created in 1995. However, that Open/Inspect PM was subsequently cancelled to the back-leakage check OPT (1/2-OPT-FW-008) in 1996 and 2005. When the decision was made it was thought that the leak test was sufficient to ensure the valve would function properly to prevent back-leakage."

In LER 2019-002-00, Dominion Energy identified a further violation of Surry Power Station Technical Specification, 3.6.F.3 as a consequence of the event. Specifically, the result of Dominion Energy not meeting the requirements of 10 CFR Part 50.55a(f)(4) above was that the TDAFW discharge check valve disc assembly parts experienced excessive wear which prevented the valve from checking shut during surveillance testing on October 28, 2019, and/or during earlier cycles of the valve, rendering all three AFW pumps inoperable.

Therefore, from October 28, 2019, (or earlier) to November 20, 2019, with three AFW pumps inoperable, Dominion Energy did not immediately initiate action to restore one inoperable pump to OPERABLE status.

Corrective Actions: The licensee restored the TDAFW train to operable conditions via repair to the discharge check valve as well as the pump and turbine bearings on November 23, 2019. In accordance with the root cause evaluation (CA7783062), the licensee has established corrective actions to prevent recurrence to perform preventive maintenance periodic internal inspections of all AFW pump discharge check valves in addition to other safety significant valves identified during extent of cause assessment.

Corrective Action References: CR1136400, CA7783062

Performance Assessment:

Performance Deficiency: Inspectors found that Dominion Energy did not analyze common failure or maintenance patterns to determine their significance and to identify potential failure mechanisms of the Unit 2 turbine driven auxiliary feedwater pump discharge check valve, 2-FW-142, when establishing its check valve condition monitoring program in accordance with the 2004 ASME Code for Operation and Maintenance of Nuclear Power Plants, Mandatory Appendix II. The inspectors determined that this was a performance deficiency reasonably within Dominion Energys ability to foresee and prevent since program establishment in 2005 and identification of valve failure during testing on November 20, 2019.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the actual failure of the Unit 2 turbine driven auxiliary feedwater pump, adversely affected the heat removal function of the auxiliary feedwater system.

Significance: The inspectors assessed the significance of the finding using Appendix A, The Significance Determination Process (SDP) for Findings At-Power. The condition represented a loss of the PRA function of one train of a multi-train TS system for greater than its TS allowed outage time, therefore a detailed risk evaluation was required. A regional Senior Reactor Analyst (SRA) conducted a detail risk assessment in accordance with NRC Inspection Manual Chapter (IMC) 0609 Appendix A. The following assumptions were made.

EXPOSURE TIME: Discharge check valve was last functionally tested and verified to be closed during the last Unit AFW cross connect test 12 months prior to the discovery of this condition. Since the valve could only stick open following a TDAFW pump run, the exposure period (T) began the first TDAFW run after the functional test which was on December 4, 2018. Therefore, T= December 4, 2018 until discovery on November 20, 2019, a period of 350 days. Since the failure mechanism has been established, wear on the valve allows the disc to catch and stay open 25% and the valve could have been stuck following any TDAFW pump surveillance run during this period. In accordance with the Risk Assessment Standardization Project (RASP) manual, it is most appropriate to assign and exposure time of T/2 or 175 days in this case. It is known for a fact the valve was stuck open since the last TDAFW test and the date of discovery a period of 22 days. Post event lab analysis was able to repeat the failure and found it stuck 3 of 5 tests. The wear and corrosion conditions would have been present for the full 12 months. Per RASP Manual Volume 1 Section 2.4, T/2 should be applied in this case.

RISK ANALYSIS/CONSIDERATIONS The SRA used SAPHIRE 8 version 8.2.1 and the Surry Unit 1 Model Revision 8.55 which was an all hazards analysis and incorporated FLEX dated January 28, 2019. The model was modified with assistance from Idaho National Engineering Laboratory personnel to incorporate a stuck open discharge check valve into the fault trees of each of the Unit 1 AFW pumps. The Unit 1 model was used vice the Unit 2 model because the Unit 1 model includes fire, flooding, hurricane, seismic, and tornado sequences; models the AFW unit cross connect function; and models FLEX strategies and equipment.

Major Assumptions:

1) TDAFW Discharge check valve is stuck 25% open and will remain in this position unless TDAFW forward flow is established.

2) If TDAFW flow is established the condition of the check valve no longer has any adverse impact on TDAFW or MDAFW flow rates. If the TDAFW receives a start signal within 6 seconds of the MDAFW start, the TDAFW will have an opportunity to self-recover with no operator action.

3) If TDAFW flow is not established via self-recovery in the first 10 seconds, the TDAFW is assumed to fail due to bearing damage (no self-lubrication when spinning in reverse direction) and is no longer recoverable.

4) MDAFW pumps will provide 85 gpm flow with the TDAFW check valve stuck open, TDAFW failed, and bearings seized. This is adequate to remove decay heat for a normal transient if the running reactor coolant pumps are tripped and the atmospheric dump valves function properly.

5) The TDAFW will receive a start signal before the MDAFWs for Loss Of Offsite Power (LOOP) and Station Blackout (SBO) sequences. These sequences were not considered because there would be no change in baseline risk.

6) The MDP and TDAFW receive simultaneous start signals via AMSAC system for Anticipated Transient Without Scram (AWTS) events. These sequences were not considered because there would be no change in baseline risk.

7) Exposure time is 175 days.

8) Mitigation analysis provided by the licensee did not evaluate Design Basis Accident therefore mitigation is not credited for those accidents.

9) Conditional Event and Condition Assessment (ECA) were performed for internal events with Basic Event AFW-CKV-OO-CV142 selected to True using the Surry Unit 1 SPAR model and SAPHIRE 8.

10) ECAs were also performed for selected Fire sequences, all Flooding sequences, all Seismic sequences, all Hurricane/High wind sequences, and all tornado sequences using the Surry Unit 1 SPAR model and SAPHIRE 8 since the internal event ECA was greater than 1 E-7.

11) Fire Sequences which transferred to LOOP sequences were not considered since these sequences will be the same as baseline risk.

12) SPAR model Fire and flooding sequences used IPEEE data.

13) Licensee CAFTA model data was used to estimate the risk due to internal flooding from Mechanical Equipment Room 3 and from the turbine building for cases where the flooding propagated to the switchgear rooms and results in a non-sequential LOOP/SBO. Plant modifications since the IPEEE to reduce risk from these events were not modelled in SPAR and the licensee's model is considered best available data.

14) Since the TDAFW is part of the Dominion FLEX strategy no FLEX credit can be applied if the TDAFW fails. Due to limited time available no alternate S/G injection methods can be credited.

New basic events were created:

1) AFW-CKV-OO-CV142: TDAFW Discharge check valve 142 fails to close. The SRA associated this basic event with template XT-CKV-OO for check valves failed open based on industry data. Resulting nominal failure probability was 1.57 E-4.

2) AFW-TDP-FC-SELF: TDAFW self recovers if auto start signal within 6 seconds. The SRA assigned a value of 4.23 E-2 as discussed in the white paper attached. This is one order of magnitude greater than the random failure to start probability and takes into account new failure mechanisms being introduced, analysis provided by Dominion, and the outcome of the test performed on November 20, 2019.

3) AFW-XHE-XL-TDPFTS: Operator action to diagnose and isolate TDAFW line in order to recover MDAFW pumps. Default value is 1.0. Per SPAR-H no credit given since no procedure and time concerns. However, this term is used for sensitivity analysis and some credit may be determined to be appropriate.

4) RCS-XHE-XM-RCPTRIP2: Operator action to trip the running reactor coolant pumps. SRA set to 2.2 E-2 using SPAR-H since this step is in the EOPs and AOPs.

Model changes reflect the following based upon additional analysis provided by the licensee:

If the TDAFW starts first or simultaneously with MDAFW pumps, the function is considered successful, if TDAFW self recovers on a normal sequence (i.e., start signal for TDAFW generated within 6 seconds) the function is considered successful. No operator action required.

If TDAFW fails; MDAFW pump flow would be considered successful if 1. The Atmospheric Dump Valves operated properly to limit pressure, 2. Both MDAFW pumps started and continued running, and 3. Operators successfully tripped the running reactor coolant pumps.

4. Accident is not a DBA (SGTR)

If TDAFW and MDAFW fail; Manual action to cross connect Unit 1 and Unit 2 AFW systems is required. This equipment and operator actions are already modeled and HEP is considered accurate as in the base model.

If AFW still is unsuccessful; Operator could recover full MDAFW flows if they diagnose the stuck open check valve and isolate the TDAFW flow path.

Risk Model Results:

The change in core damage frequency (Delta CDF) for Internal Events was 1.79 E-6 so external events must be considered. Note: LOOP and ATWS sequences were not considered since PD would not change from baseline.

Fire: 1.77 E-6 Note: the six fire sequences which transfer to LOOP sequences were not considered.

Flood: 1.00 E-6 using licensee CAFTA data. Note SPAR calculates 1.12 E-9 however 3 sequences transfer directly to CD-FLI so equipment failure result in no change to CCDP. These are dominate sequences per the licensees CAFTA model which incorporate plant modifications to mitigate the impact of these flood. Using licensee data these sequences result in 7.44 E-7 for flooding in Mech Room 3 which propagates to the Switchgear room and 2.75 E-7 for flooding from Turbine building CW or SW propagating to the switchgear room. Both sequences result in a non-sequential LOOP. Internal flooding from Mech Room 3 which propagating to the switchgear room where the TDAFW fails to self-recover prior to the resulting LOOP/SBO is the dominate core damage sequence.

Seismic: 4.18 E-8 Tornado: 1.18 E-11 Hurricane/High Wind: 1.70 E-9 LARGE EARLY RELEASE FREQUENCY (LERF) IMPACT In accordance with IMC 0609 Appendix H, for a type A finding SGTR and ISLOCA sequences have a 1.0 LERF factor all other affected sequences screen out in phase 1. The SRA ran an ECA for only the above sequences and since LERF factor was 1.0 Delta CDF = Delta LERF. The result was 8.20 E-9 for delta CDF and Delta LERF which corresponds to very low safety significance (Green) for LERF.

Significant Influence Factor and Sensitivity: TDAFW self-recovery term is the most sensitive term. The pump could fail to start due to mechanical stresses from having to reverse direction of turbine and pump against significant flow. TDAFW tripped on overspeed in the reverse direction on the date of discovery thus this is another failure mechanism, and flow induced vibrations and impacts due to reversing flow could also mechanically trip the overspeed mechanism and lack of mini flow valve protection during start up. AFW-TDP-FC-SELF was varied from 5E-1 to 1E-2. The Yellow-White Threshold was slightly below 1E-1 and the Green-White Threshold was slightly below 1E-2 Sensitivity was also performed allowing for recovery credit to be applied (AFW-XHE-XL-TDPFTS -Varied from 1.0 to 0.1) and for Human Error probability for operators tripping the running RCPs (RCS-XHE-XM-RCPTRIP2-varied from 1E-2 to 5E-2). Neither sensitivity changed the overall result.

CONCLUSION Significance Determination (i.e., Color): Preliminary White due to Delta CDF between 3 and 5 E-6 using best available information.

Cross-Cutting Aspect: Not Present Performance. No cross-cutting aspect was assigned to this finding because the inspectors determined the finding did not reflect present licensee performance.

Enforcement:

Violation: Section 50.55a(f)(4) of Title 10 of the Code of Federal Regulations, states in part, Throughout the service life of a boiling or pressurized water-cooled nuclear power facility, pumps and valves that are within the scope of the ASME OM Code must meet the inservice test requirements (except design and access provisions) set forth in the ASME OM Code and addenda .

ASME OM Code, 2004 Edition (the Code of record for Surry Power Station Unit 2),

Mandatory Appendix II, Check Valve Condition Monitoring Program, subsection II-3000, states, in part, The Owner shall perform an analysis of the test and maintenance history of a valve or group of valves in order to establish the basis for specifying inservice testing, examination, and preventive maintenance activities. The analysis shall include the following:

Identify any common failure or maintenance patterns. Analyze these patterns to determine their significance and to identify potential failure mechanisms.

Surry Power Station Technical Specification, 3.6.F.3, states in part, With three auxiliary feedwater pumps inoperable, immediately initiate action to restore one inoperable pump to OPERABLE status. Specification 3.0.1 and all other required actions directing mode changes are suspended until one inoperable pump is restored to OPERABLE status.

Contrary to 10 CFR Part 50.55a(f)(4) above, from November 23, 2005, to November 20, 2019, the Dominion Energy Surry Power Station Unit 2 TDAFW discharge check valve did not meet the inservice test requirements set forth in the ASME OM Code, 2004 Edition. Specifically, the analysis performed by Dominion Energy of the test and maintenance history of the valve in order to establish the basis for specifying inservice testing, examination, and preventive maintenance activities did not identify known failure and maintenance patterns nor did Dominion Energy analyze the known patterns to determine their significance and to identify potential failure mechanisms.

Consequently, contrary to Surry Power Station Technical Specification, 3.6.F.3 above, from October 28, 2019, (or earlier) to November 20, 2019, with three auxiliary feedwater pumps inoperable, Dominion Energy did not immediately initiate action to restore one inoperable pump to OPERABLE status. The result of Dominion Energy not meeting the requirements of 10 CFR Part 50.55a(f)(4) above was that the TDAFW discharge check valve disc assembly parts experienced excessive wear which prevented the valve from checking shut during surveillance testing on October 28, 2019, and/or during earlier cycles of the valve, rendering all three auxiliary feedwater pumps inoperable. This condition was discovered during AFW check valve operability testing on November 20, 2019.

Enforcement Action: This violation is being treated as an apparent violation pending a final significance (enforcement) determination.

EXIT MEETINGS AND DEBRIEFS

The inspectors verified no proprietary information was retained or documented in this report.

• On May 13, 2020, the inspectors presented the Surry Unit 2 turbine driven auxiliary feedwater pump discharge check valve misposition inspection results to Fred Mladen, Site Vice President and other members of the licensee staff.

DOCUMENTS REVIEWED

Inspection Type Designation Description or Title Revision

Procedure or Date

71152 Calculations 0114-0122- Turbine-Driven AFW Pump R1

CALC-001 Reverse Rotation

0114-0122- TDAFWP Turbine Torque and R0

MEMO-002 Steam Flow

Engineering 0114-0122- Turbine-Driven AFW Pump R0

Evaluations RPT-001 Reverse Rotation

SPS-RA.066 MAAP Analysis for SPS TD SDP R0

SU-SDBD- Aux Feed Water System Design

000-SDBD- Basis Document

SPS-AFW

Miscellaneous 2004 ASME Code for Operation and 2004

OM Code Maintenance of Nuclear Power

Plants

71153 Corrective CR1136400

Action

Documents

Attachment: Turbine Driven Auxiliary Feedwater Pump Self Recovery Term

The term self-recovery is an estimation of the non-success probability of the TDAFW pump to

start from a state where backflow from the MDAFW is spinning the steam turbine and the pump

in the reverse direction. The turbine will be wind milling in the reverse direction at approximately

4000 rpm being driven by reverse rotation of the pump due to backflow of approximately 600

gpm at rated pressure felt at the pump discharge.

From the TDAFW pump to successfully restart the following must not happen:

1. The pump must not over speed in the reverse direction as was observed to have

happened on November 20, 2019.

2. The turbine must not mechanically fail due to additional stresses being placed on the

turbine blade when steam is admitted to stop and reverse rotation. (0114-0122-CALC-

001)

3. The pump must not mechanically fail due to reverse rotation and additional stresses felt

when reversing direction of flow and overcoming a shutoff head. (0114-0122-CALC-

001)

4. The TDAFW pump is not able to lubricate itself when rotating in the reverse direction

and must successfully self prime once forward flow is established. The TDAFW

bearings were wiped on November 20, 2019, when it was spinning in the reverse

direction. This could cause the turbine to seize.

5. The TDAFW governor must function properly after being driven in the reverse direction

to prevent the turbine from overspeeding in the forward direction during the startup.

6. The hydraulic transient to the pump and piping must not cause the mechanical

overspeed latch to trip.

7. TDAFW pump failing due to mini flow protection not being available, i.e., the mini flow

line will not provide protection during start up and while the pump is dead headed.

The failure to start probability for a TDAFW is 4.23 E-3 under normal standby conditions. Given

the abnormal conditions being faced in this scenario, the new failure mechanisms being

introduced, and the very limited amount of data available to inform this event, the SRA chose to

assign a non-success probability one order of magnitude greater than the nominal FTS

probability. This takes into account the licensee analysis with respect to items 2, 3, and 6 which

is a mitigating factor and acknowledges the actual failures observed on November 20, 2019

(items 1 and 4), and post-event forensic testing of the governor (item 5).

The SRA acknowledges this term has a great deal of uncertainty and performed a sensitivity

analysis for this term.

13