IR 05000313/2016001

NRC Inspection Report 05000313/2016001 and 05000368/2016001

ML16127A366
Person / Time
Site:	Arkansas Nuclear
Issue date:	05/06/2016
From:	O'Keefe N NRC/RGN-IV/DRP/RPB-E
To:	Jeremy G. Browning Entergy Operations
O'Keefe C
References
IR 2016001
Download: ML16127A366 (46)

Text

UNITED STATES May 6, 2016

SUBJECT:

ARKANSAS NUCLEAR ONE - NRC INSPECTION REPORT 05000313/2016001 AND 05000368/2016001

Dear Mr. Browning:

On March 31, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Arkansas Nuclear One facility, Units 1 and 2. On April 13, 2016, the NRC inspectors discussed the results of this inspection with Terry Evans, General Manager Plant Operations, and other members of your staff. Inspectors documented the results of this inspection in the enclosed inspection report.

NRC inspectors documented five findings of very low safety significance (Green) in this report.

Four of the five findings involved violations of NRC requirements. Further, inspectors documented a licensee-identified violation which was determined to be of very low safety significance in this report. The NRC is treating these violations as non-cited violations (NCVs)

consistent with Section 2.3.2.a of the NRC Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at Arkansas Nuclear One.

If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at Arkansas Nuclear One.

On March 31, 2016, the NRC completed a quarterly performance review of Arkansas Nuclear One. The NRC determined that continued plant operation was acceptable and oversight in the Multiple/Repetitive Degraded Cornerstone of the Reactor Oversight Process Action Matrix remained appropriate.

In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390, Public Inspections, Exemptions, Requests for Withholding, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Neil OKeefe, Chief Project Branch E Division of Reactor Projects Docket Nos. 50-313 and 50-368 License Nos. DRP 51 and NPF-6

Enclosure:

Inspection Report 05000313/2016001 and 05000368/2016001 w/ Attachment 1: Supplemental Information Attachment 2: Detailed Risk Evaluation

REGION IV==

Docket: 05000313; 05000368 License: DPR-51: NPF-6 Report: 05000313/2016001; 05000368/2016001 Licensee: Entergy Operations Inc.

Facility: Arkansas Nuclear One, Units 1 and 2 Location: Junction of Hwy. 64 West and Hwy. 333 South Russellville, Arkansas Dates: January 1 through March 31, 2016 Inspectors: B. Tindell, Senior Resident Inspector A. Barrett, Resident Inspector M. Tobin, Resident Inspector J. Choate, Project Engineer Approved Neil OKeefe By: Chief, Project Branch E Division of Reactor Projects-1- Enclosure

SUMMARY

IR 05000313/2016001; 0500368/2015001; 01/01/2016 - 03/31/2016; Arkansas Nuclear One,

Units 1 and 2, Inspection Report, Maintenance Risk Assessments and Emergent Work Control,

Operability Determinations and Functionality Assessments, Post-Maintenance Testing, and Problem Identification and Resolution.

The inspection activities described in this report were performed between January 1 and March 31, 2016, by the resident inspectors at Arkansas Nuclear One and inspectors from the NRCs Region IV office. Five findings of very low safety significance (Green) are documented in this report. All of these findings involved violations of NRC requirements. Additionally, NRC inspectors documented one licensee-identified violation of very low safety significance. The significance of inspection findings is indicated by their color (Green, White, Yellow, or Red),

which is determined using Inspection Manual Chapter 0609, Significance Determination Process. Their cross-cutting aspects are determined using Inspection Manual Chapter 0310,

Aspects within the Cross-Cutting Areas. Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process.

Cornerstone: Initiating Events

Green.

The inspectors identified a Green finding and an associated non-cited violation of 10 CFR 50.65(a)(4), Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, for the failure to assess and manage the increase in risk due to performing hot work near risk-significant Unit 1 non-vital switchgear. Specifically, the licensee failed to identify the work as having low integrated risk, and implement required risk management actions to protect available fire pumps and brief the fire brigade. As immediate corrective actions, the licensee stopped the hot work until they completed a risk assessment and risk management actions. This finding was entered into the licensees corrective action program as Condition Report CR-ANO-1-2016-00348.

The failure to assess and manage the increase in risk of performing hot work near risk-significant Unit 1 non-vital switchgear is a performance deficiency. The finding is more than minor because it adversely affected the protection against external factors (i.e., fires)attribute of the initiating event cornerstone to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations.

Specifically, the licensee failed to assess the potential for hot work to cause a fire, and manage the risk to critical safety functions. Because the finding affects the assessment of risk associated with performing maintenance activities, NRC Manual Chapter 0609,

Attachment 4, Initial Characterization of Findings, directs significance determination using NRC Manual Chapter 0609, Appendix K, Maintenance Risk Assessment and Risk Management Significance Determination Process. A regional senior reactor analyst used Manual Chapter 0609, Appendix K, Flowchart 2, Assessment of Risk Management Actions, dated May 19, 2005, to assess the significance of the finding. The licensee site probabilistic risk assessment engineer provided information which estimated the incremental core damage probability deficit of 3.3E-10. The analyst confirmed similar results using the NRC probabilistic risk assessment model. The incremental large early release probability deficit was conservatively estimated to be equal to the incremental core damage probability deficit. Since this issue dealt only with the failure to take risk management actions,

Flowchart 2, Assessment of Risk Management Actions, of Appendix K was used. In accordance with Flowchart 2, because the incremental core damage probability deficit was less than 1E-10 and the incremental large early release probability deficit was less than 1E-7, the finding screened as having very low safety significance (Green). The inspectors determined this finding has a problem identification and resolution cross-cutting aspect in the area of Teamwork, because the most significant contributor involved the failure to communicate and coordinate activities across organizational boundaries to ensure nuclear safety is maintained. Specifically, work groups did not inform operations work control personnel that hot work was part of the intended work. (Section 1R13) [H.4]

Green.

The inspectors reviewed a self-revealing Green finding for the failure to fully understand a malfunction which resulted in putting susceptible cards back into the Unit 1 integrated control system. In 2014, a failure caused a feedwater transient, which operators successfully mitigated. Troubleshooting identified and repaired some of cards susceptible to the intermittent problem. The licensee reinstalled cards that had not been repaired in the integrated control system, which later caused a feedwater transient and subsequent manual reactor trip on December 15, 2015. The licensee documented the issue in Condition Report CR-ANO-1-2015-04178 and replaced the cards.

The failure to fully understand a malfunction, which resulted in putting susceptible cards back into the Unit 1 integrated control system, is a performance deficiency. The finding is more than minor because it adversely affected the equipment performance attribute of the initiating event cornerstone to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations.

Specifically, the licensee placed the suspect cards back into the integrated control system, which caused a feedwater transient and contributed to a subsequent manual reactor trip.

Using NRC Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 1, Initiating Events Screening Questions, the finding screened as having very low safety significance (Green) because the deficiency resulted in a reactor trip, but mitigation equipment remained unaffected.

Specifically, main feedwater remained available. The inspectors determined this finding has a problem identification and resolution cross-cutting aspect in the area of Evaluation, because the primary cause of the performance deficiency involved the failure to thoroughly evaluate a 2014 integrated control system failure so that the resolution addressed the cause commensurate with safety significance. (Section 4OA2.3) [P.2]

Cornerstone: Mitigating Systems

Green.

The inspectors identified a Green finding and an associated non-cited violation of 10 CFR 50, Appendix B, Criterion III, Design Control, for the failure to ensure the suitability of materials used in safety-related equipment. Specifically, the licensee made a change to the material used in ten safety-related pump bearing coolers without considering the potential effects of corrosion. As a result, a drain plug corroded and caused service water to spray, rendering two safety-related pumps inoperable. This issue was entered into the corrective action program as Condition Report CR-ANO-2-2016-00550.

The failure to consider the potential for corrosion in the design of safety-related equipment is a performance deficiency. The performance deficiency is more than minor because it adversely affected the design control attribute of the mitigating system cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, in each of the three examples, the licensee made changes to the plant where the potential effects of corrosion on safety-related equipment was not considered. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, the inspectors screened this finding as Green, because the finding did not represent an actual loss of safety function. The inspectors determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance. (Section 1R15)

Green.

The inspectors documented a self-revealing Green finding with an associated non-cited violation of 10 CFR Part 50, Appendix B, Criterion XI, Test Control, for the failure to verify that the floor drains in the Unit 2 turbine-driven emergency feedwater pump room would pass the amount of water added to the drain during operation of the pump in order to prevent the pump from becoming submerged. As a result, the licensee was unaware that the turbine-driven emergency feedwater pump room drain had become blocked until water began pooling in the room during a pump test. Upon discovery, the licensee stopped the pump, declared the train inoperable, and cleared the drain. This finding was entered into the licensees corrective action program as Condition Report CR-ANO-2-2016-0384.

The failure to verify that the Unit 2 turbine-driven emergency feedwater pump room drain would pass the water added to the drains during operation of the turbine-driven emergency feedwater pump is a performance deficiency. The finding is more than minor because it adversely affected the protection against external factors (i.e., flood hazard) attribute of the mitigating systems cornerstone to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the failure to detect a clogged drain affected the availability of the emergency feedwater system by potentially flooding the room and failing the pump. The inspectors evaluated the finding using Manual Chapter 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power. The inspectors determined that the finding required a detailed risk evaluation because the finding represented an actual loss of function of a single train for greater than its technical specification allowed outage time. A senior reactor analyst performed a detailed risk evaluation and estimated the total increase in core damage frequency to be 7.7E-7/year, and therefore the finding had very low safety significance (Green). The inspectors determined that this finding did not have a cross-cutting aspect because the most significant contributor, inadequate documentation of the pump design requirements during initial plant construction, does not reflect current licensee performance. (Section 1R19)

Green.

The inspectors reviewed a self-revealing Green finding and an associated non-cited violation for the failure to follow Procedure OP-1052.007, Secondary Chemistry Monitoring,

Revision 040. Specifically, the licensee failed to inject corrosion inhibiting chemicals into Unit 2 service water during refueling outages, which resulted in increased corrosion of the service water system. This issue was entered into the corrective action program as Condition Report CR-ANO-2-2016-02879.

The failure to inject corrosion inhibitors into Unit 2 service water during refueling outages resulted in increased corrosion of the service water system is a performance deficiency.

The performance deficiency is more than minor because it adversely affected the human performance attribute of the mitigating system cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the performance deficiency adversely affected the structural strength of service water system boundaries. Using NRC

Inspection Manual Chapter 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Dated June 19, 2012, the inspectors screened the finding as having very low safety significance because it is a deficiency affecting the design or qualification of a mitigating SSC, but the SSC maintained its operability. The inspectors determined that this finding had a cross-cutting aspect in the human performance area of Avoid Complacency, because the licensee failed to recognize the potential consequences of isolating chemical injection to the service water during outages, which contributed to degradation. (Section 4OA2.3) [H.12]

Licensee-Identified Violations

A violation of very low safety significance was identified by the licensee and has been reviewed by the inspectors. Corrective actions taken or planned by the licensee have been entered into the licensees corrective action program. This violation and associated corrective action tracking number is listed in Section 4OA7 of this report.

PLANT STATUS

Unit 1 operated at 100 percent power for the entire inspection period.

Unit 2 began the period at 100 percent power. On February 5, 2016, operators reduced unit power to 80 percent power to perform maintenance on main feedwater pump B. On February 6, 2016, operators reduced unit power to 70 percent power due to high bearing temperatures on the main feedwater pump A. On February 10, 2016, the plant returned to 100 percent power.

On February 23, 2016, the plant shut down to perform maintenance on a leaking low pressure safety injection check valve. On March 4, 2016, the plant returned to 100 percent power and remained at 100 percent power through the end of the inspection period.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R01 Adverse Weather Protection

Readiness for Impending Adverse Weather Conditions

a. Inspection Scope

On February 22, 2016, the inspectors completed an inspection of the stations readiness for impending adverse weather conditions. The inspectors reviewed plant design features, the licensees procedures to respond to tornadoes and high winds, and the licensees implementation of these procedures. The inspectors evaluated operator staffing and accessibility of controls and indications for those systems required to control the plant.

These activities constituted one sample of readiness for impending adverse weather conditions, as defined in Inspection Procedure 71111.01.

b. Findings

No findings were identified.

1R04 Equipment Alignment

.1 Partial Walkdown

a. Inspection Scope

The inspectors performed partial system walkdowns of the following risk-significant systems:

• February 8, 2016, Unit 2, main feedwater pump lube oil system

• February 26, 2016, Units 1 and 2, main, auxiliary, and startup transformers

• March 3, 2016, Unit 2, low temperature over-pressure protection valves The inspectors reviewed the licensees procedures and system design information to determine the correct lineup for the systems. They visually verified that critical portions of the systems were correctly aligned for the existing plant configuration.

These activities constituted three partial system walk-down samples as defined in Inspection Procedure 71111.04.

b. Findings

No findings were identified.

.2 Complete Walkdown

a. Inspection Scope

On March 3, 2016, the inspectors performed a complete system walk-down inspection of the Unit 1 fire water system. The inspectors reviewed the licensees procedures and system design information to determine the correct system lineup for the existing plant configuration. The inspectors also reviewed outstanding work orders, open condition reports, in-process design changes, temporary modifications, and other open items tracked by the licensees operations and engineering departments. The inspectors then visually verified that the system was correctly aligned for the existing plant configuration.

These activities constituted one complete system walk-down sample, as defined in Inspection Procedure 71111.04.

b. Findings

No findings were identified.

1R05 Fire Protection

.1 Quarterly Inspection

a. Inspection Scope

The inspectors evaluated the licensees fire protection program for operational status and material condition. The inspectors focused their inspection on four plant areas important to safety:

• February 5, 2016, Fire Area I-1, 98-J corridor

• February 10, 2016, Fire Area I-3, lower north electrical penetration room

• February 11, 2016, Fire Area B-8, upper south electrical penetration room

• March 2, 2016, Fire Area X-4, Unit 1 turbine building 197 foot elevation For each area, the inspectors evaluated the fire plan against defined hazards and defense-in-depth features in the licensees fire protection program. The inspectors evaluated the control of transient combustibles and ignition sources, fire detection and suppression systems, manual firefighting equipment and capability, passive fire protection features, and compensatory measures for degraded conditions.

These activities constituted four quarterly inspection samples, as defined in Inspection Procedure 71111.05.

b. Findings

No findings were identified.

1R11 Licensed Operator Requalification Program and Licensed Operator Performance

.1 Review of Licensed Operator Requalification

a. Inspection Scope

The inspectors observed simulator training for licensed operators. The inspectors assessed the performance of the operators and the evaluators critique of their performance. The inspectors also assessed the modeling and performance of the simulator during the evaluated scenario.

• March 9, 2016, Unit 2, evaluated simulator scenario performed by operating crew

• March 22, 2016, Unit 1, simulator training for operating crew These activities constitute completion of two quarterly licensed operator requalification program samples, as defined in Inspection Procedure 71111.11.

b. Findings

No findings were identified.

.2 Review of Licensed Operator Performance

a. Inspection Scope

The inspectors observed the performance of on-shift licensed operators in the plants Units 1 and 2 main control rooms. At the time of the observations, the plants were in periods of heightened activity and risk. The inspectors observed the operators performance of the following activities:

• February 6, 2016, Unit 2, plant shutdown for forced outage

• February 11, 2016, Unit 1, emergency diesel generator A remote start and surveillance run In addition, the inspectors assessed the operators adherence to plant procedures, including the conduct of operations procedure and other operations department policies.

These activities constitute completion of two quarterly licensed operator performance samples, as defined in Inspection Procedure 71111.11.

b. Findings

No findings were identified.

1R12 Maintenance Effectiveness

a. Inspection Scope

The inspectors reviewed three instances of degraded performance or condition of safety-related structures, systems, and components (SSCs):

• March 9, 2016, Unit 2, condition of the chemical volume control system

• March 15, 2016, Units 1 and 2, condition of the alternate AC diesel generator system

• March 19, 2016, Unit 1, condition of the auxiliary, main and start up transformers The inspectors reviewed the extent of condition of possible common cause SSC failures and evaluated the adequacy of the licensees corrective actions. The inspectors reviewed the licensees work practices to evaluate whether these may have played a role in the degradation of the SSCs. The inspectors assessed the licensees characterization of the degradation in accordance with 10 CFR 50.65 (the Maintenance Rule), and verified that the licensee was appropriately tracking degraded performance and conditions in accordance with the Maintenance Rule.

These activities constituted completion of three maintenance effectiveness samples, as defined in Inspection Procedure 71111.12.

b. Findings

No findings were identified.

1R13 Maintenance Risk Assessments and Emergent Work Control

a. Inspection Scope

The inspectors reviewed six risk assessments performed by the licensee prior to changes in plant configuration and the risk management actions taken by the licensee in response to elevated risk:

• January 6, 2016, Unit 2, remote start capability of alternate AC diesel unavailable due to maintenance

• January 7, 2016, Unit 1 and Unit 2, heavy work in switchyard

• February 5, 2016, Unit 1, emergency diesel generator maintenance during turbine building hot work

• February 18, 2016, Unit 2, low pressure in safety injection tank D

• February 24, 2016, Unit 2, forced outage risk assessment

• March 18, 2016, Units 1 and 2, dry fuel cask heavy lift The inspectors verified that these risk assessments were performed timely and in accordance with the requirements of 10 CFR 50.65 (the Maintenance Rule) and plant procedures. The inspectors reviewed the accuracy and completeness of the licensees risk assessments and verified that the licensee implemented appropriate risk management actions based on the results of the assessments.

The inspectors also observed portions of one emergent work activity that had the potential to both cause an initiating event and to affect the functional capability of mitigating systems:

• February 8, 2015, Unit 2, main feed water pump reduced oil pressure caused by clogged filters and subsequent operator response The inspectors verified that the licensee appropriately developed and followed a work plan for this activity. The inspectors verified that the licensee took precautions to minimize the impact of the work activity on unaffected SSCs.

These activities constitute completion of seven maintenance risk assessments and emergent work control inspection samples, as defined in Inspection Procedure 71111.13.

b. Findings

Introduction.

The inspectors identified a Green finding and an associated non-cited violation of 10 CFR 50.65(a)(4), Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, for the failure to assess and manage the increase in risk caused by hot work near the Unit 1 risk-significant non-vital switchgear.

Description.

On January 27, 2016, the inspectors observed licensee personnel performing hot work on a handrail near Unit 1 non-vital switchgear A-2, a risk-significant power supply. By questioning operators and reviewing the approved work schedule, the inspectors determined that the licensee had not assessed and managed the increased risk of the hot work. The licensee immediately stopped the hot work until they could appropriately assess and manage the work.

From a fire protection perspective, the licensee controlled the hot work with fire retardant barriers and a continuous fire watch. Nonetheless, the hot work still represented an increased risk of fire to the nearby switchgear. Unit 1 Standing Order, Compensatory Measures for Changing License Basis for Fires, dated February 17, 2014, stated, in part, that if hot work was required near the A-2 switchgear, the licensee was to protect available fire pumps, conduct an operations and fire brigade briefing, and elevate the integrated risk score to low so that appropriate mitigation actions would be added to the planning process.

The inspectors determined that the personnel performing the hot work failed to communicate and coordinate with operations to ensure that the correct planning and mitigation actions occurred.

Analysis.

The failure to assess and manage the increase in risk caused by hot work near the Unit 1 non-vital switchgear is a performance deficiency. The finding is more than minor because it adversely affected the protection against external factors attribute of the initiating event cornerstone to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations.

Specifically, the licensee failed to assess the potential for hot work to cause a fire, and manage the risk to critical safety functions. Because the finding affects the licensees assessment of risk associated with performing maintenance activities, NRC Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, directs using NRC Manual Chapter 0609, Appendix K. A regional senior reactor analyst used Manual Chapter 0609, Appendix K, Maintenance Risk Assessment and Risk Management Significance Determination Process, Flowchart 2, Assessment of Risk Management Actions, dated May 19, 2005, to assess the significance of the finding. The licensee probabilistic risk assessment engineer provided information which estimated the incremental core damage probability deficit of 3.3E-10. The analyst confirmed similar results using the NRC probabilistic risk assessment model. The incremental large early release probability deficit was conservatively estimated to be equal to the incremental core damage probability deficit. Since this issue dealt only with the failure to take risk management actions, Flowchart 2, Assessment of Risk Management Actions, of Appendix K was used. In accordance with Flowchart 2, because the incremental core damage probability deficit was less than 1E-6 and the incremental large early release probability deficit was less than 1E-7, the finding screened as having very low safety significance (Green). The inspectors determined this finding has a cross-cutting aspect in the area of H.4, Teamwork, because the most significant contributor involved the failure to communicate and coordinate activities across organizational boundaries to ensure nuclear safety is maintained.

Enforcement.

Title 10 CFR 50.65(a)(4), states, in part, that before performing maintenance activities (including but not limited to surveillance, post-maintenance testing, and corrective and preventive maintenance), the licensee shall assess and manage the increase in risk that may result from the proposed maintenance activities.

Contrary to the above, before performing maintenance activities on January 27, 2016, the licensee failed to assess and manage the increase in risk associated with performing hot work near risk-significant Unit 1 nonvital switchgear. For immediate corrective actions, the licensee stopped the hot work until they completed a risk assessment and risk management actions. This finding was entered into the licensees corrective action program as Condition Report CR-ANO-1-2016-00348. Because the finding was of very low safety significance and has been entered into the corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000313/2016001-01 Failure to Assess and Manage Hot Work Risk.

1R15 Operability Determinations and Functionality Assessments

a.

a. Inspection Scope

The inspectors reviewed five operability determinations that the licensee performed for degraded or nonconforming SSCs:

• January 12, 2016, Unit 2, containment operability determination for isolation actuation system spurious relay actuation

• January 15, 2016, Units 1 and 2, operability determination for corrosion in emergency diesel generator exhaust piping internal to diesel generator rooms

• January 21, 2016, Unit 1, operability determination for B safety injection tank in-leakage

• February 2, 2016, Units 1 and 2, functionality assessment for alternate AC diesel starting air compressor not able to maintain design pressure

• February 19, 2016, Unit 2, operability assessment for low pressure coolant injection pump seal cooler plug failure and repair The inspectors reviewed the timeliness and technical adequacy of the licensees evaluations. Where the licensee determined the degraded SSC to be operable, the inspectors verified that the licensees compensatory measures were appropriate to provide reasonable assurance of operability. The inspectors verified that the licensee had considered the effect of other degraded conditions on the operability of the degraded SSC.

These activities constitute completion of five operability review samples, as defined in Inspection Procedure 71111.15.

b. Findings

Introduction.

The inspectors identified a Green finding and an associated non-cited violation of 10 CFR 50, Appendix B, Criterion III, Design Control, for the failure to ensure the suitability of materials used in safety-related equipment. Specifically, the licensee made a change to the material used in ten safety-related pump bearing coolers without considering the potential effects of corrosion.

Description.

The inspectors identified three examples of inadequate design control in safety-related equipment for Unit 2.

On February 11, 2016, during a planned low pressure safety injection pump surveillance, operators observed minor leakage (approximately one drop per minute) from the drain plug on the low pressure safety injection pump seal cooler. The operators reported the leakage to control room personnel. The control room supervisor instructed the operators to verify the tightness of the drain plug. The operators used a wrench to check the tightness of the drain plug. The drain plug turned 1/8 of a full revolution and then ejected from the seal cooler causing service water to spray into the room and wet the containment spray pump and motor and one motor operated valve. The operators isolated service water supply to the seal cooler locally, stopping the leakage. During the event, the room flooded to approximately one inch depth. This level of water did not adversely affect other safety-related plant equipment located in the room.

The licensee declared the low pressure safety injection pump, the low pressure safety injection pump seal cooler, and the containment spray pump inoperable. The licensee inspected the drain plug and seal cooler and determined that the threads on the drain plug had severely corroded. The licensee performed a cause evaluation and an extent-of-condition review and determined that in 1992, ten safety-related pump seal coolers, including the low pressure safety injection pump seal cooler, had been upgraded from carbon steel to stainless steel shells without changing the shell vent and drain plugs to stainless steel as well.

The inspectors reviewed the modification package and identified that the licensee failed to address the potential for galvanic corrosion between the shell and the vent and drain plugs due to having the dissimilar metals in a raw water environment. In addition, since the modifications in 1992, the inspectors noted that the licensee had documented severe corrosion of seal cooler plugs in several condition reports and work orders, but had failed to identify and correct this adverse trend prior to the drain plug failure. The licensee documented these deficiencies in CR-ANO-2-2016-00550.

The licensee replaced the low pressure safety injection pump seal cooler drain plug and performed inspections and testing of the containment building spray pump and motor prior to returning the systems to service. The licensee replaced the plugs on six of the ten safety-related seal coolers with new carbon steel plugs, and planned to complete the other four replacements by May 18, 2016. The remaining drain plugs were visually inspected and were not showing signs of leakage nor had they been in service as long as the plug that failed. The licensee planned to perform design changes to replace all of the plugs in the seal coolers with stainless steel plugs during future system outages.

Procedure EN-DC-141, Design Inputs, required licensee engineers to consider corrosion resistance and galvanic corrosion in design considerations. Contrary to this requirement, design engineering failed to consider corrosion resistance or galvanic corrosion of the carbon steel plugs installed in the stainless steel coolers.

During this inspection period, the inspectors also identified two other examples where the station failed to ensure the suitability of materials in the design of safety-related equipment. The two examples, which were determined to be minor, included carbon steel anchor bolts on the Unit 2 stainless steel containment recirculation sump screens and a copper pipe cap on the Unit 2 containment emergency escape air lock.

Analysis.

The failure to ensure the suitability of materials in the design of safety-related equipment is a performance deficiency. The performance deficiency is more than minor because it adversely affected the design control attribute of the mitigating system cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage).

Specifically, for each of the three examples described above, the licensee made changes to the plant where the potential effects of corrosion on safety-related equipment was not considered. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 2, Mitigating Systems Screening Questions, the issue screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk significant due to seismic, flooding, or severe weather. The inspectors determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that for those SSCs to which this appendix applies, measures shall be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the SSCs. Contrary to the above, from December 18, 1992, until February 12, 2016, for quality-related components associated with the Unit 2 low pressure safety injection pump, to which 10 CFR Part 50, Appendix B applies, the licensee failed to select and review for suitability of application the materials, parts, equipment, and processes that are essential to the safety-related function of the component. Specifically, the licensee failed to consider the effects of corrosion during material selection to ensure that the safety-related low pressure injection pump seal cooler would remain functional, resulting in the corrosion-related failure of the drain plug. The licensee replaced the failed plug with a new carbon steel plug, and planned to either replace all of the plugs with stainless steel plugs, or replace prior to plugs becoming susceptible to galvanic corrosion failure.

Because this finding is of very low safety significance and was entered into the corrective action program as Condition Report CR-ANO-2-2016-00550, this violation is being treated as a noncited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000368/2016001-02, "Failure to Follow Design Control Requirements for Pump Seal Cooler Replacements."

1R18 Plant Modifications

a. Inspection Scope

On February 29, 2016, the inspectors reviewed a temporary modification to allow removal of the normally installed blind flange to implement the FLEX beyond design basis accident mitigation strategy for venting containment, which was performed during Unit 2 forced outage that affected risk-significant SSCs.

The inspectors verified that the licensee had installed and removed this temporary modification in accordance with technically adequate design documents. The inspectors verified that this modification did not adversely impact the operability or availability of affected SSCs. The inspectors reviewed design documentation and plant procedures affected by the modification to verify the licensee maintained configuration control.

This activity constitutes completion of one sample of temporary modifications, as defined in Inspection Procedure 71111.18.

b. Findings

No findings were identified.

1R19 Post-Maintenance Testing

a. Inspection Scope

The inspectors reviewed seven post-maintenance testing activities that affected risk-significant SSCs:

• January 7, 2016, Unit 1, valve stroke following preventative maintenance on emergency feedwater steam supply valve

• February 3, 2016, Unit 2, turbine driven emergency feedwater post-maintenance test following emergency feedwater floor drain system blockage removal

• February 10, 2016, Unit 1, emergency diesel generator A output breaker test following pawl roller clip replacement

• March 4, 2016, Unit 2, breaker testing following service water pump B breaker failure

• March 11, 2016, Unit 2, valve stroke following timing adjustment to main steam isolation valve following failed stroke time test

• March 17, 2016, Unit 2, valve stroke following preventative maintenance on emergency feedwater steam supply valve

• March 18, 2016, Unit 2, charging pump test following charging pump suction dampener seal repair The inspectors reviewed licensing- and design-basis documents for the SSCs and the maintenance and post-maintenance test procedures. The inspectors observed the performance of the post-maintenance tests to verify that the licensee performed the tests in accordance with approved procedures, satisfied the established acceptance criteria, and restored the operability of the affected SSCs.

These activities constitute completion of seven post-maintenance testing inspection samples, as defined in Inspection Procedure 71111.19.

b. Findings

Introduction.

The inspectors documented a self-revealing Green finding and an associated non-cited violation of 10 CFR Part 50, Appendix B, Criterion XI, Test Control, for the failure to verify that the floor drains in the Unit 2 emergency feedwater pump rooms would pass the amount of water added to the drain during operation of the pump in order to prevent the pump from being submerged.

Description.

The licensee is required to perform quarterly surveillance testing of the turbine-driven emergency feedwater pump. The drain became blocked some time prior to the surveillance test performed on February 2, 2016. Approximately 30 minutes after starting the system, operators discovered water pooling about 2 inches deep on the floor of the room.

Upon the discovery of water building up in the room, the licensee declared the pump inoperable. After review, the licensee determined that the pump would not have been capable of meeting its mission time, and without operator action the room would have flooded within four to ten hours. An alarm alerts the control room at 2.5 inches of water pooling in the room. The drain was cleared and the pump quarterly surveillance was re-run to verify operability of the pump. The inspectors noted that the licensee unclogged the drain without examining the clog, so the source of material was not determined.

The drains functioned normally during the previous pump surveillance performed on December 2, 2015. By design, the turbine-driven emergency feedwater pump releases approximately 12 gallons of water per minute down the floor drain while the system is in operation. The motor driven emergency feedwater pump room shares a common drain system with the turbine-driven emergency feedwater pump room. Both emergency feedwater pumps are located in separate water-tight rooms to protect the pumps from the effects of flooding from outside the respective rooms, while the floor drains are designed to remove water from inside each room. The drains are also equipped with backflow preventer valves that keep water from backing up from the drain line and flooding the rooms. This backflow preventer worked as designed in the motor driven emergency feedwater room, and prevented any water from entering. However, because the turbine driven emergency feedwater pump was the water source, when the drain line filled, the added input began filling the room. Operators did not immediately notice because they normally stay outside the room, entering periodically to monitor conditions.

The source of water that was filling the blocked drains was bearing cooling water, which was designed to flow out of the turbine driven feedwater pump. The inspectors researched the design flow rate and the drains flow requirement, but were unable to find clear design documentation. CR-ANO-C-2016-1852 documented the lack of clear design documentation.

• Procedure 2106.006, Emergency Feedwater System Operations, Revision 90, stated that an emergency feedwater actuation signal opens the turbine bearing cooling water isolation valve when the pump starts.

• Vendor Manual TDT147 006, Instruction Manual for Terry Steam Turbine, Revision 8, also stated that bearing cooling water is required.

• Drawing M-2202 Sheet 4, Piping & Instrument Diagram, Lube Oil, Lube Oil Cooling, Electric/Hydraulic Controls & Main Steam, Revision 20, showed that the water from turbine bearing cooling empties into the floor drain in the emergency feedwater pump room.

• Safety Analysis Report, Amendment 23, Section 10.4.9, Emergency Feedwater System (EFWS), stated, in part, that the EFWS is designed to provide means of supplying water to the intact steam generator(s) following a postulated main steam line rupture or loss of main feedwater to remove reactor decay heat and provide for cooldown of the reactor coolant system to within the temperature and pressure at which the shutdown cooling system can be placed in operation. The inspectors noted that it could take over 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to reach shutdown cooling conditions.

• The definition of Operable/Operability in the ANO Unit 2 Technical Specifications states that a system, subsystem, train, component or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified function(s).

Implicit in this definition shall be the assumption that all necessary attendant instrumentation, controls, normal and emergency electrical power sources, cooling or seal water, lubrication or other auxiliary equipment that are required for the system, subsystem, train, component or device to perform its function(s) are also capable of performing their related support function(s).

Based on the design of the turbine-driven EFW pump, the inspectors concluded that to be considered operable, bearing cooling is required, and the floor drain system must remove the expected flow of bearing cooling water. Therefore, the bearing cooling water flow rate is a design requirement for the floor drain system.

None of the references stated the design flow rate for bearing cooling, so the licensee measured the actual flow rate while the system was in operation and determined that it was 12 gpm.

Inspectors reviewed previous condition reports involving this drain being blocked and discovered two reports. Condition Report CR-ANO-2-2006-02147 was written October 15, 2006, due to a blocked drain in the turbine-driven emergency feedwater pump room, while CR-ANO-2-2006-02680 was written three months later and documented the same issue still existed in the room during the next quarterly surveillance. The licensee took no action at that time to ensure that the drains were maintained after the repeat failure.

Analysis.

The failure to verify that the Unit 2 turbine-driven emergency feedwater pump room floor drains are capable of passing the amount of water added to the drains during system operation is a performance deficiency. The finding is more than minor because it adversely affected the protection against external hazards (i.e., flooding hazards)attribute of the mitigating systems cornerstone to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the failure to conduct periodic testing resulted in a failure to detect the fact that the drain had clogged, rendering the turbine-driven emergency feedwater pump inoperable. The inspectors evaluated the finding using Manual Chapter 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power, and determined that a detailed risk evaluation was required because the finding represented an actual loss of function for greater than the technical specification allowed outage time. The loss of a function of at least a single train for greater than its allowed outage time is based on the assumption that since the length of time the drain was plugged is not known, the inspectors assumed that it was at least half of the time since the last successful demonstration of the pumps operability.

A senior reactor analyst performed a detailed risk evaluation and estimated the total increase in core damage frequency to be 7.7E-7/year, and therefore the finding had very low safety significance (Green). See Attachment 2 for details.

The inspectors determined that this finding did not have a cross-cutting aspect because the most significant contributor, the failure to maintain complete and accurate documentation, did not reflect current licensee performance.

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion XI, Test Control, states, in part, that a test program shall be established to assure that all testing required to demonstrate that SSCs will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Contrary to the above, as of February 2, 2016, the licensee failed to establish a test program to assure that all testing required to demonstrate that SSCs will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents.

Specifically, the licensee failed to demonstrate that the floor drains in the Unit 2 turbine-driven emergency feedwater pump room would perform the design requirement to drain bearing cooling water flow and prevent pump submergence. The licensee planned to implement a method to ensure that the drains are clear and capable of performing their required support function to drain the room. This finding was entered into the licensees corrective action program as Condition Report CR-ANO-2-2016-0384. Because this finding is of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000368/2016001-03, Blocked Drain Results in Emergency Feedwater Pump Inoperability.

1R20 Refueling and Other Outage Activities

a. Inspection Scope

During the stations forced outage between February 23 and March 3, 2016, the inspectors evaluated the licensees outage activities. The inspectors verified that the licensee considered risk in developing and implementing the outage plan, appropriately managed personnel fatigue, and developed mitigation strategies for losses of key safety functions. This verification included the following:

• Monitoring of operator performance during reactor shut-down and plant cool-down activities

• Verification that the licensee maintained defense-in-depth during outage activities

• Observation and review of reduced-inventory

• Monitoring of operator performance during plant heat-up and reactor startup activities These activities constitute completion of one outage activities sample, as defined in Inspection Procedure 71111.20.

b. Findings

No findings were identified.

1R22 Surveillance Testing

a. Inspection Scope

The inspectors observed five risk-significant surveillance tests and reviewed test results to verify that these tests adequately demonstrated that the SSCs were capable of performing their safety functions:

In-service tests:

• March 16, 2016, Unit 2, auxiliary feedwater pump in-service test Other surveillance tests:

• January 13, 2016, Unit 1, emergency diesel generator A 24-hour endurance test

• January 27, 2016, Unit 1, emergency diesel generator B monthly test

• January 28, 2016, Unit 2, reactor protection system trip circuit breaker testing

• February 22, 2016, Unit 2, inside auxiliary operator daily operating logs The inspectors verified that these tests met technical specification requirements, that the licensee performed the tests in accordance with their procedures, and that the results of the tests satisfied appropriate acceptance criteria. The inspectors verified that the licensee restored the operability of the affected SSCs following testing.

These activities constitute completion of five surveillance testing inspection samples, as defined in Inspection Procedure 71111.22.

b. Findings

No findings were identified.

1EP6 Drill Evaluation

Training Evolution Observation

a. Inspection Scope

On February 18, 2016, the inspectors observed simulator-based licensed operator requalification training that included implementation of the licensees emergency plan.

The inspectors verified that the licensees emergency classifications, off-site notifications, and protective action recommendations were appropriate and timely. The inspectors verified that any emergency preparedness weaknesses were appropriately identified by the evaluators and entered into the corrective action program for resolution.

These activities constitute completion of one training observation sample, as defined in Inspection Procedure 71114.06.

b. Findings

No findings were identified.

OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Security

4OA1 Performance Indicator Verification

.1 Unplanned Scrams per 7000 Critical Hours (IE01)

a. Inspection Scope

The inspectors reviewed licensee event reports (LERs) for the period of January 1, 2015, through December 31, 2015, to determine the number of scrams that occurred.

The inspectors compared the number of scrams reported in these LERs to the number reported for the performance indicator. Additionally, the inspectors sampled monthly operating logs to verify the number of critical hours during the period. The inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, to determine the accuracy of the data reported.

These activities constituted verification of the unplanned scrams per 7000 critical hours performance indicator for Units 1 and 2, as defined in Inspection Procedure 71151.

b. Findings

No findings were identified.

.2 Unplanned Power Changes per 7000 Critical Hours (IE03)

a. Inspection Scope

The inspectors reviewed operating logs, corrective action program records, and monthly operating reports for the period of January 1, 2015, through December 31, 2015, to determine the number of unplanned power changes that occurred. The inspectors compared the number of unplanned power changes documented to the number reported for the performance indicator. Additionally, the inspectors sampled monthly operating logs to verify the number of critical hours during the period. The inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, to determine the accuracy of the data reported.

These activities constituted verification of the unplanned power changes per 7000 critical hours performance indicator for Units 1 and 2, as defined in Inspection Procedure 71151.

b. Findings

No findings were identified.

.3 Unplanned Scrams with Complications (IE04)

a. Inspection Scope

The inspectors reviewed the licensees basis for including or excluding in this performance indicator each scram that occurred between January 1, 2015, and December 31, 2015. The inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, Regulatory Assessment Performance Indicator Guideline, Revision 7, to determine the accuracy of the data reported.

These activities constituted verification of the unplanned scrams with complications performance indicator for Units 1 and 2, as defined in Inspection Procedure 71151.

b. Findings

No findings were identified.

4OA2 Problem Identification and Resolution

.1 Routine Review

a. Inspection Scope

Throughout the inspection period, the inspectors performed daily reviews of items entered into the licensees corrective action program and periodically attended the licensees condition report screening meetings. The inspectors verified that licensee personnel were identifying problems at an appropriate threshold and entering these problems into the corrective action program for resolution. The inspectors verified that the licensee developed and implemented corrective actions commensurate with the significance of the problems identified. The inspectors also reviewed the licensees problem identification and resolution activities during the performance of the other inspection activities documented in this report.

b. Findings

No findings were identified.

.2 Semiannual Trend Review

a. Inspection Scope

The inspectors reviewed the licensees corrective action program, performance indicators, system health reports, and other documentation to identify trends that might indicate the existence of a more significant safety issue. The inspectors verified that the licensee was taking corrective actions to address identified adverse trends.

These activities constitute completion of one semiannual trend review sample, as defined in Inspection Procedure 71152.

b. Observations and Assessments The inspectors reviewed examples of safety system unavailability in condition reports to determine if a causal trend existed.

The inspectors identified the following examples where the licensee did not evaluate or take corrective actions for safety system unavailability:

• Condition Report CR-ANO-2-2015-05036 reported that the licensee tagged out the 2P-4C service water pump, but no work was performed because the crane needed for the work was also unavailable, rendering the service water pump unnecessarily unavailable for several hours. The licensee took no documented actions for the unnecessary unavailability or the organizational and programmatic causes.

• The licensees internal unavailability performance indicator turned red for the Unit 1 emergency diesel generator in August 2015, (CR-ANO-1-2015-03337);

November 2015, (CR-ANO-1-2015-04118); and December 2015, (CR-ANO-1-2016-00037). In each case, emergent events resulted in unplanned system unavailability that drove the performance indicators to red. The licensee took corrective action for the physical issues and organizational and programmatic causes that resulted in the unplanned unavailability, but the licensee took no action for the performance indicator results or the potential unavailability trend.

• Condition Report CR-ANO-2-2015-00470 reported that the Unit 2 startup transformer 3 exceeded maintenance rule unavailability performance criteria due to planned maintenance and an unplanned failure. The licensee had taken corrective action for the emergent work that caused the unplanned unavailability.

The licensee determined that the subsequent planned maintenance was appropriate; the licensee had appropriately controlled transformer performance in accordance with 50.65(a)(2). The inspectors concluded that the licensee had enough information to anticipate exceeding the unavailability performance criteria, and could have reviewed the plan prior to the planned maintenance to ensure it was appropriate to accumulate the unavailability.

In contrast, the inspectors noted some examples where the licensee did evaluate and take corrective actions for safety system unavailability:

• Condition Report CR-ANO-2-2015-00398 reported that the Unit 2 service water pump B approached 75 percent of the Maintenance Rule unavailability performance criteria due to motor operated disconnect maintenance issues. The licensee took corrective action for the maintenance issues, and evaluated the trend to ensure the corrective action timing appropriately accounted for pump unavailability.

• Condition Reports CR-ANO-C-2015-00817 and CR-ANO-C-2016-00703 documented unnecessary safety equipment unavailability due to switchyard work coordination issues. The licensee addressed planning, scheduling, and risk management issues associated with switchyard work in an apparent cause evaluation in Condition Report CR-ANO-C-2016-00703, partially to address the unnecessary unavailability.

• After the licensee unsuccessfully attempted to change a Unit 2 service water pump motor, the licensee addressed the increased unavailability in an apparent cause evaluation in Condition Report CR-ANO-2-2016-00035. The licensee addressed the organizational and programmatic issues that led to the increased unavailability.

The maintenance department has taken actions to strengthen work readiness, which has led to unnecessary safety equipment unavailability, as documented in Condition Report CR-ANO-C-2015-4765. The inspectors determined that the licensee has demonstrated mixed sensitivity to safety system unavailability, although no specific performance deficiency or trend was identified. The licensee documented the inspectors observations in Condition Report CR-ANO-C-2016-01889.

c. Findings

No findings were identified.

.3 Annual Follow-up of Selected Issues

a. Inspection Scope

The inspectors selected three issues for an in-depth follow-up:

• On September 21, 2015, during the Unit 2 refueling outage, shutdown cooling heat exchanger 2E-35B developed a shell leak of service water; the licensee declared the heat exchanger inoperable, which resulted in a significant delay in the refueling outage schedule while a repair could be developed and implemented. The licensee performed a root cause evaluation that identified the cause of the leak to be corrosion due, in part, to long-term exposure to untreated water in the service water system.

• On March 29, 2016, the inspectors reviewed the licensees causal evaluation related to the December 15, 2015, Unit 1 reactor trip. Specifically, the inspectors reviewed the licensees causal evaluation related to the Unit 1 integrated control system contribution to the main feedwater upset that led to the reactor trip.

• On March 14, 2016, the inspectors reviewed the licensees causal evaluation for the October 20, 2015, and December 7, 2015, breaker failures for Unit 2 containment spray pump A. The licensee performed maintenance prior to the October failure to adjust the operating mechanism. The December failure was related to a defective part from the vendor. The licensee performed an apparent cause for the breaker failures.

The inspectors assessed the licensees problem identification threshold, cause analyses, and extent of condition reviews for each of these issues. The inspectors verified that the licensee appropriately prioritized the planned and taken corrective actions and that these actions were adequate to correct the condition.

These activities constitute completion of three annual follow-up samples as defined in Inspection Procedure 71152.

.1 Failure to Inject Service Water with Corrosion Inhibitors during Refueling Outages

Introduction.

The inspectors reviewed a self-revealing Green non-cited violation for the failure to follow Procedure OP-1052.007, Secondary Chemistry Monitoring, Revision 040. Specifically, the licensee failed to inject corrosion inhibiting chemicals into Unit 2 service water during refueling outages, which resulted in increased corrosion of the service water system.

Description.

On September 20, 2015, the licensee discovered a through-wall leak of service water from the shell side of Unit 2 shutdown cooling heat exchanger B. The licensee initiated Condition Report CR-ANO-2-2015-02879 and initiated an evaluation and repairs of both shutdown cooling heat exchanger shells, which had corroded below code allowable wall thickness in several local areas. The licensee restored the heat exchangers to an operable status and planned to replace them during the next refueling outage, in Spring, 2017.

The licensee performed a root cause evaluation and determined that the increased corrosion rate in the heat exchanger shells was partially caused by inadequate control of service water chemistry. The licensee operated the service water system without chemical corrosion control until approximately 1990. Since that time, chemicals have been injected to prevent corrosion during power operations. However, the licensee removed the chemistry injection system from service for the duration of refueling outages due to system tagouts since installation in approximately 1990. As a result of the root cause evaluation, the licensee initiated corrective actions to optimize chemical treatment and biocide treatment of the shutdown cooling heat exchangers during refueling outages.

The inspectors noted that the licensee had failed to follow Procedure OP-1052.007, Secondary Chemistry Monitoring, Revision 040. Attachment 6, Frequency and Guidelines for Units 1 and 2 Oxidant Analyses, requires that if oxidizing biocide system is out-of-service for greater than seven days, then raise monitoring of bioboxes, take action to restore system to service, and perform non-oxidizing biocide treatment of service water systems until system is returned to service. The licensee failed to take the required actions when the oxidizing biocide system was out-of-service for greater than seven days. The failure to inject corrosion inhibiting chemicals led to an increased corrosion rate. The inspectors concluded that the increased corrosion adversely affected the structural strength of service water boundaries, such as pipes and the shutdown cooling heat exchanger shells.

Analysis.

The failure to inject corrosion inhibitors into Unit 2 service water during refueling outages resulted in increased corrosion of the service water system, which is a performance deficiency. The performance deficiency is more than minor because it adversely affected the human performance attribute of the mitigating system cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the performance deficiency adversely affected the structural strength of service water system boundaries. Using NRC Inspection Manual Chapter 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, the inspectors screened the finding as having very low safety significance because it is a deficiency affecting the design or qualification of a mitigating SSC, but the SSC maintained its operability. The inspectors determined that this finding had a cross-cutting aspect in the human performance area of Avoid Complacency, H.12, because the licensee failed to recognize the inherent risk of isolating service water chemistry during the entirety of outages, which led to degradation.

Enforcement.

Technical Specification 6.4.1.a requires, in part, that procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978.

Section 10, Chemical and Radiochemical Control Procedures, of Appendix A to Regulatory Guide 1.33, Revision 2, requires, in part, that chemical control procedures be written to prescribe the frequency of sampling and analyses, the instructions maintaining water quality within prescribed limits, and the limitations on concentrations of agents that may cause corrosive attack. Procedure OP-1052.007, Secondary Chemistry Monitoring, Revision 040, Attachment 6, Frequency and Guidelines for Units 1 and 2 Oxidant Analyses, states, in part, that if oxidizing biocide system is out-of-service for greater than seven days, then raise monitoring of bioboxes, take action to restore system to service, and perform non-oxidizing biocide treatment of service water systems until system is returned to service. Contrary to the above, between September 20, 2015, and November 15, 2015, when the oxidizing biocide system was out-of-service for greater than seven days, the licensee did not raise monitoring of bioboxes, take action to restore the system to service, and perform non-oxidizing biocide treatment of service water systems until the system was returned to service. To correct the issue, the licensee is evaluating methods to continue service water chemical injection during outages. Because this finding is of very low safety significance and was entered into the corrective action program as CR-ANO-2-2016-02879, this violation is being treated as a noncited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy:

NCV 05000368/2016001-04, "Failure to Inject Service Water with Corrosion Inhibitors during Refueling Outages."

.2 Failure to Identify and Repair Intermittent Card Failure Leads to a Reactor Trip

Introduction.

The inspectors reviewed a self-revealing Green finding for the failure to fully understand a malfunction, which resulted in putting susceptible cards back into the Unit 1 integrated control system. In 2014, a failure caused a feedwater transient, which operators successfully mitigated. Troubleshooting identified and repaired some of cards susceptible to the intermittent problem. The licensee reinstalled cards that had not been repaired in the integrated control system, which later caused a feedwater transient and subsequent manual reactor trip on December 15, 2015.

Description.

During a planned Unit 1 power reduction on December 15, 2015, the integrated control system failed to reposition the low load control valve. Main feedwater flow began to oscillate and operators manually tripped the reactor when they were unable to control flow. After the reactor trip, main feedwater successfully fed the steam generators through the startup valves to remove core decay heat. The licensee documented the reactor trip in Condition Report CR-ANO-1-2015-04178.

Through a failure modes analysis and root cause evaluation, the licensee determined that relays on three integrated control system cards had failed to actuate as expected.

Testing indicated that normally-open contacts had become oxidized, and when closed, would not pass enough current to actuate the low load control valve until the oxide layer was reduced after some period of time.

The licensee determined that the same equipment failure had occurred in 2014, as documented in Condition Report CR-ANO-1-2014-00759, but operators had successfully mitigated the transient. The licensee had identified three suspect cards through troubleshooting in 2014 and had replaced limited subcomponents on the card, but due to the intermittent failure mode of other contacts on the cards, the cards subsequently bench tested satisfactorily and the licensee chose to place the cards in the warehouse for reuse. Technicians reinstalled those same cards into the system during the Unit 1 Spring 2015 refueling outage, and the cards failed again.

Procedure EN-MP-115, Material Issues and Returns, Revision 5, Attachment 9.4, Parts Repair Process, states, in part, that if a part is not repaired successfully, then the part should be specified as unrepairable and scrapped. The licensee determined that the technicians and engineers failed to recognize the intermittent failure mode of the cards in 2014, in part because the cards passed a bench test after they had replaced some subcomponents on the cards, but did not addressed all of the potential intermittent failure modes of the subcomponents on the cards. As a result of the inadequate evaluation in the 2014 condition report, the personnel returned the cards to the warehouse without scrapping or fully repairing the cards.

The inspectors noted that while the integrated control system was risk-significant because it can cause plant transients, it had no safety-related function.

Analysis.

The failure to fully understand a malfunction, which resulted in putting susceptible cards back into the Unit 1 integrated control system, is a performance deficiency. The finding is more than minor because it adversely affected the equipment performance attribute of the initiating event cornerstone to limit the likelihood of events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the licensee placed the suspect cards back into the integrated control system, which caused a feedwater flow transient and contributed to the subsequent manual reactor trip. Using NRC Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, Exhibit 1, Initiating Events Screening Questions, the finding screened as having very low safety significance (Green) because the deficiency resulted in a reactor trip, but mitigation equipment remained unaffected. Specifically, main feedwater remained available. The inspectors determined this finding has a problem identification and resolution cross-cutting aspect in the area of Evaluation, because the primary cause of the performance deficiency involved the failure to thoroughly evaluate a 2014 integrated control system failure so that the resolution addressed the cause commensurate with safety significance.

Enforcement.

This finding did not involve enforcement action because no regulatory requirements were violated. Although the licensee failed to follow procedure EN-MP-115, the inspectors determine that this was a self-imposed standard and did not constitute a regulatory requirement. The licensee documented the issue in Condition Report CR-ANO-1-2015-04178. The failed integrated control system cards were replaced and scrapped. FIN 05000313/2016001-05 Failure to Identify and Repair Intermittent Card Failure Leads to a Reactor Trip.

4OA3 Follow-up of Events and Notices of Enforcement Discretion

.1 (Closed) LER 05000313/2015-001 Manual Reactor Trip Due to Oscillations in the

Feedwater System On December 15, 2015, Unit 1 manually scrammed during a planned power reduction.

The integrated control system failed to operate the low load control valve. Main feedwater flow began to oscillate and operators manually tripped the reactor. After the reactor trip, main feedwater successfully fed the steam generators.

This licensee event report is closed.

See Section 4OA2.3 of this inspection report for enforcement related to this event.

.2 (Closed) LER 05000313/2014-002 Special Report - Significant Change in Peak

Cladding Temperature On November 25, 2014, AREVA, Inc., notified the licensee of a deficiency in the Unit 1 emergency core cooling system evaluation model, which could underestimate the reactor fuel peak cladding temperature during a large break loss of coolant accident. In response, the licensee submitted Licensee Event Report 05000313/2014-002 on December 22, 2014 (ML14357A098). The licensee implemented compensatory measures on October 20, 2014, to reduce the fuels linear heat rate by 2 kilowatts per foot, which ensured that the calculated peak clad temperature would remain within limits under all conditions. AREVA, Inc. began reanalyzing the Unit 1 large break loss of coolant model.

On August 21, 2015, the NRC transmitted a closure evaluation for the licensees report (ML15232A090). As the letter states, the licensee satisfied reporting requirements, has taken compensatory action, and submitted a schedule to perform reanalysis and submit the changes to the NRC.

The issue was entered into the corrective action program as Condition Report CR-ANO-1-2014-01696. This licensee event report is closed.

These activities constitute completion of two event follow-up samples, as defined in Inspection Procedure 71153.

4OA5 Other Activities

Quarterly Performance Assessment In the NRCs 2014 annual assessment letter (ML15063A499), dated March 4, 2015, the NRC documented that the performance of Arkansas Nuclear One, Units 1 and 2, was within the Multiple/Repetitive Degraded Cornerstone Column (Column 4) of the NRCs Reactor Oversight Process Action Matrix.

In accordance with NRC Inspection Manual Chapter 0305, Operating Reactor Assessment Program, Issued December 23, 2015, a quarterly review of performance is required for a plant whose performance is in Column 4 of the Action Matrix.

On March 31, 2016, NRC management reviewed inspection and performance indicator results for Units 1 and 2. The NRC determined that continued plant operation was acceptable in the Multiple/Repetitive Degraded Cornerstone of the Reactor Oversight Process Action Matrix. In addition, no additional regulatory actions beyond those described in the annual assessment letter were identified.

4OA6 Meetings, Including Exit

Public Meeting Summary On April 6, 2016, the inspectors and regional personnel held a public meeting with the licensee to discuss the results of the 95003 inspection and 2015 annual assessment meeting.

Exit Meeting Summary

On April 13, 2016, the resident inspectors presented the inspection results to Terry Evans, General Manager Plant Operations, and other members of the licensee staff.

The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned.

4OA7 Licensee-Identified Violations

The following violation of very low safety significance (Green) was identified by the licensee and is a violation of NRC requirements which meets the criteria of the NRC Enforcement Policy for being dispositioned as a non-cited violation.

Title 10 CFR 50.65(a)(4), states in part, that before performing maintenance activities (including but not limited to surveillance, post-maintenance testing, and corrective and preventive maintenance), the licensee shall assess and manage the increase in risk that may result from the proposed maintenance activities. Contrary to the above, before performing maintenance activities on February 24, 2016, the licensee failed to assess and manage the increase in risk that resulted from maintenance activities in the switchyard. Specifically, the licensee performed maintenance on the supervisory control circuits associated with the startup transformer breakers during the Unit 2 forced outage.

This work had already begun when Entergy executives on a fleet call questioned the impact of maintenance on the breakers that supply power to safety-related buses while Unit 2 is shutdown. Further review indicated that the impact was more extensive than previously thought. For immediate corrective actions, control room operators contacted the switchyard coordinator and rescheduled the supervisory control circuit work.

Because the finding affects the licensees assessment of risk associated with performing maintenance activities, NRC Manual Chapter 0609, Attachment 4, Initial Characterization of Findings, dated June 19, 2012 directs significance determination using NRC Manual Chapter 0609, Appendix K, Maintenance Risk Assessment and Risk Management Significance Determination Process, dated May 19, 2005. The finding was determined to be Green because the incremental core damage probability deficit was less than 1E-6 and the incremental large early release frequency probability deficit was less than 1E-7. A senior reactor analyst estimated incremental core damage probability deficit to be 1.9E-8 for Unit 1 and 1.2E-8 for Unit 2 using the Standardized Plant Analysis Risk models for Unit 1 (Revision 8.19) and Unit 2 (Revision 8.26) run on SAPHIRE, Version 8.1.2.

The licensee entered the issue into the corrective action program as Condition Report CR-ANO-C-2016-00908. Licensee-identified violations are not assigned cross-cutting aspects.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

D. Barborek, Engineer

R. Barnes, Director, Regulatory Affair & Performance Indicators

L. Blocker, Nuclear Oversight Manager

J. Browning, Site Vice President

P. Butler, Design and Program Engineering Manager

B. Daiber, Recovery Manager

B. Davis, Engineering Director

T. Evans, General Manager of Plant Operations

D. James, Director, Regulatory Affairs & Recovery

D. Marvel, Radiation Protection Manager

N. Mosher, Licensing Specialist

D. Pehrson, Unit 1 Assistant Operations Manager

S. Pyle, Regulatory Assurance Manager

B. Short, Senior Licensing Specialist

J. Toben, Senior Manager, Project Management Regulatory and Performance Improvement

NRC Personnel

R. Deese, Senior Reactor Analyst

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000313/2016001-01 NCV Failure to Assess and Manage Hot Work Risk (Section 1R13)

Failure to Follow Design Control Requirements for Pump Seal

05000368/2016001-02 NCV Cooler Replacements (Section 1R15)

Blocked Drain Results in Emergency Feedwater Pump

05000368/2016001-03 NCV Inoperability (Section 1R19)

Failure to Inject Service Water with Corrosion Inhibitors during

05000368/2016001-04 NCV Refueling Outages (Section 71152)

Failure to Identify and Repair Intermittent Card Failure Leads to a

05000313/2016001-05 FIN Reactor Trip (Section 4OA2.3)

Closed

Manual Reactor Trip Due to Oscillations in the Feedwater System

05000313/2015-001 LER (Section 4OA3.1)

Special Report - Significant Change in Peak Cladding

05000313/2014-002 LER Temperature (Section 4OA3.2)

Attachment 1