IR 05000397/2017008

NRC Special Inspection Report 05000397/2017008

ML17096A781
Person / Time
Site:	Columbia
Issue date:	04/06/2017
From:	Mark Haire NRC/RGN-IV/DRP/RPB-A
To:	Reddemann M Energy Northwest
Mark Haire
References
IR 2017008
Download: ML17096A781 (26)

Text

April 6, 2017

SUBJECT:

COLUMBIA GENERATING STATION - NRC SPECIAL INSPECTION REPORT 05000397/2017008

Dear Mr. Reddemann:

On March 17, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed a special inspection at your Columbia Generating Station to evaluate the facts and circumstances surrounding the December 18, 2016, reactor scram. Based upon the risk and deterministic criteria specified in NRC Management Directive 8.3, NRC Incident Investigation Program, the NRC initiated a special inspection in accordance with Inspection Procedure 93812, Special Inspection. The determination that the inspection would be conducted was made by the NRC on February 1, 2017, and the onsite inspection started on February 2, 2017. The enclosed report documents the inspection findings that were discussed on March 30, 2017, with Mr. W. Hettel, Vice President, Operations, and other members of your staff. Inspectors documented the results of this inspection in the enclosed inspection report.

The inspectors observed the follow-up actions for the reactor scram on December 18, 2016.

Several issues related to offsite power, scram response procedures, reactor core isolation cooling (RCIC) system procedures, a high pressure core spray (HPCS) system gasket failure, and reactor protection system (RPS) power supplies were identified during the post trip review.

The causes of these issues are related to deficiencies in training, maintenance, and inspection.

This inspection determined that the overall station response has been sufficient to address the root and contributing causes of these issues.

However, based on the results of this inspection, three self-revealed findings of very low safety significance (Green) were identified. All of these findings were determined to involve violations of NRC requirements. The NRC is treating these violations as non-cited violations consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC resident inspector at the Columbia Generating Station.

M. If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; and the NRC Resident Inspector at the Columbia Generating Station.

This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Mark Haire, Branch Chief Project Branch A Division of Reactor Projects Docket No. 50-397 License No. NPF-21 Enclosure:

Inspection Report 05000397/2017008 w/ Attachment:

Supplemental Information

ML17096A781 SUNSI Review ADAMS: Non-Publicly Available Non-Sensitive By: JRG/dll Yes No Publicly Available Sensitive OFFICE SRI:DRP/A RI:DRP/A SPE:DRP/A BC:DRP/A NAME GKolcum DBradley RAlexander MHaire SIGNATURE /RA/ /RA/ /RA/ /RA/

DATE 03/31/2017 03/30/2017 03/30/2017 4/6/17

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 05000397 License: NPF-21 Report: 05000397/2017008 Licensee: Energy Northwest Facility: Columbia Generating Station Location: Richland, WA Dates: February 2, 2017 to March 17, 2017 Inspectors: G. Kolcum, Senior Resident Inspector D. Bradley, Resident Inspector R. Deese, Senior Risk Analyst Approved Mark S. Haire By: Chief, Project Branch A Division of Reactor Projects Enclosure

SUMMARY OF FINDINGS

IR 05000397/2017008; 02/02/17 - 03/17/17; Columbia Generating Station; Special Inspection to review the December 18, 2016, Reactor Scram Event; Inspection Procedure 93812, Special Inspection.

A three-person U.S. Nuclear Regulatory Commission (NRC) team, comprised of resident inspectors and a regional senior reactor analyst, conducted this Special Inspection. Three findings of very low safety significance (Green) are documented in this report. The significance of inspection findings is indicated by their color (i.e., Green, greater than Green, White, Yellow, or Red), and determined using Inspection Manual Chapter 0609, Significance Determination Process, dated April 29, 2015. Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, Aspects within the Cross-Cutting Areas, dated December 4, 2014.

Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, dated July 2016.

Cornerstone: Mitigating Systems

Green.

The inspectors reviewed a self-revealed, non-cited violation of Technical Specification 5.4.1.a, Procedures, for the licensees failure to follow Procedure 3.3.1,

Reactor Scram, Revision 62. Specifically, the licensee failed to trip the main generator per Procedure PPM 3.3.1, Step 6.2.9, although it was required for a load rejection scram. As a result, during the scram on December 18, 2016, the station vital electrical busses SM-7 and SM-8 transferred to the backup transformer (and to the Division 3 Diesel Generator in the case of bus SM-4), instead of to the preferred electrical source, the startup transformer.

As immediate corrective actions, the licensee implemented operations Night Order 75 that reinforced training to trip the main generator on a reactor scram. The licensee entered this issue into the corrective action program as Action Requests 359059 and 361029.

The failure to follow Procedure 3.3.1, Reactor Scram, Revision 62, was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it adversely affected the human performance attribute of the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the performance deficiency resulted in a reduction in the offsite power sources available to supply safety-related busses. The inspectors performed the initial significance determination using NRC Inspection Manual Chapter 0609, Attachment 04, Initial Characterization of Findings, and Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated June 19, 2012. The inspectors determined that the finding was of very low safety significance (Green) because: (1) the finding was not a deficiency affecting the design or qualification of a mitigating system; (2) the finding did not represent a loss of system and/or function; (3) the finding did not represent an actual loss of function of a single train for greater than its technical specification allowed outage time; and (4) the finding does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

This finding had a cross-cutting aspect in the area of human performance, training, in that the licensee failed to provide training and ensure knowledge transfer to maintain a knowledgeable, technically competent workforce and instill nuclear safety values.

Specifically, the licensed operators did not understand the actions associated with the main generator in the scram procedure [H.9]. (Section 3.4)

Green.

The inspectors reviewed a self-revealed, non-cited violation of Technical Specification 5.4.1.a, Procedures, for the licensees failure to follow Procedure SOP-RCIC-INJECTION-QC, RCIC RPV Injection - Quick Card, Revision 5.

During a complicated reactor scram on December 18, 2016, licensed operators failed to open the RCIC turbine trip valve, RCIC-V-1, prior to initiating RCIC. As a result, RCIC tripped on overspeed, required local resetting, and led to licensed operations personnel injecting with the HPCS system, a nonpreferred injection source. As immediate corrective actions, the licensee implemented operations Night Order 76 that emphasized to operators the correct valve sequence for initiating RCIC flow. To address additional training aspects of this issue, the licensee updated the RCIC quick card procedure for clarity and added a training module to the next licensed operator requalification cycle on use of RCIC during transients. The licensee entered the unexpected trip of RCIC into the corrective action program as Action Requests 359064 and 359162.

The failure to follow Procedure SOP-RCIC-INJECTION-QC, RCIC RPV Injection - Quick Card, Revision 5, was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it adversely affected the human performance attribute of the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors performed the initial significance determination using NRC Inspection Manual Chapter 0609, Attachment 04, Initial Characterization of Findings, and Appendix A, The Significance Determination Process (SDP) for Findings At-Power,

Exhibit 2, Mitigating Systems Screening Questions, dated June 19, 2012. The inspectors determined that the finding was of very low safety significance (Green) because: (1) the finding was not a deficiency affecting the design or qualification of a mitigating system; (2) the finding did not represent a loss of system and/or function; (3) the finding did not represent an actual loss of function of a single train for greater than its technical specification allowed outage time; and (4) the finding does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

This finding had a cross-cutting aspect in the area of human performance, training, in that the licensee failed to provide training and ensure knowledge transfer to maintain a knowledgeable, technically competent workforce and instill nuclear safety values.

Specifically, the licensed operator did not understand the sequence of component manipulations for restarting RCIC using the quick card [H.9]. (Section 3.4)

Green.

The inspectors reviewed a self-revealed, non-cited violation of 10 CFR Part 50,

Appendix B, Criterion XVI, Corrective Action, for failure to promptly identify and correct a condition adverse to quality. Specifically, since 2009, the licensee failed to implement prompt corrective actions to correct an adverse condition related to the use of spiral wound gaskets for restricting orifices in the HPCS system. As an immediate corrective action, the licensee replaced the gasket for restricting orifice RO-5 under Work Order 02105645. The licensee entered this issue into the corrective action program as Action Request 359066.

The failure to implement prompt corrective actions to correct an adverse condition related to the use of spiral wound gaskets for restricting orifices in the HPCS system was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it affected the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees failure to correct the use of incorrect spiral wound gaskets for restricting orifices in the HPCS system resulted in a failed gasket during the December 18, 2016 scram, introduction of foreign material into the suppression pool, and leakage into the HPCS room. The inspectors performed the initial significance determination using NRC Inspection Manual Chapter 0609, Appendix A, Exhibit 2,

Mitigating Systems Screening Questions. The inspectors determined that the finding was of very low safety significance (Green) because: (1) the finding was not a deficiency affecting the design or qualification of a mitigating system; (2) the finding did not represent a loss of system and/or function; (3) the finding did not represent an actual loss of function of a single train for greater than its technical specification allowed outage time; and (4) the finding does not represent an actual loss of function of one or more nontechnical specification trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The inspectors determined that this finding did not have a cross-cutting aspect as the descision to use incorrect spiral wound gaskets occurred in 2009 and was not reflective of current performance. (Section 3.4)

Licensee-Identified Violations

None.

REPORT DETAILS

1. Basis for Special Inspection

On December 18, 2016, at 11:24 a.m., Columbia Generating Station (CGS) experienced a scram on governor fast valve closure signal due to a load rejection. The load reject originated at the 500 kV Ashe substation, downstream of CGS, which is operated by Bonneville Power Administration (BPA). The severity of the transient in the 500 kV switchyard was exacerbated by the failure of three different high voltage breakers in the substation to isolate the fault on selective tripping. This eventually resulted in a selective relay trip of the main generator output breakers, thereby causing the load rejection.

A regional senior reactor analyst preliminarily estimated the conditional core damage probability (CCDP) for this issue to be 8.77 E-5. According to the Management Directive 8.3 matrix, this value indicates that the circumstances warrant a special inspection. Two of the deterministic criteria were met, in that the event involved (1)significant unexpected system interactions caused by the unique relaying scheme response in the Ashe substation, and

(2) questions or concerns pertaining to licensee operational performance in response to the scram conditions. Based on the preliminary CCDP and the review of deterministic criteria, the NRC determined that the appropriate level of response was a special inspection.

The NRC conducted the special inspection to better understand the circumstances surrounding the scram on December 18, 2016. The inspectors used NRC Inspection Procedure 93812, Special Inspection Procedure, dated Novmber 15, 2011, to conduct the inspection. The inspections included field walkdowns of equipment, interviews with station personnel, and reviews of procedures, corrective action documents, and design documentation. Additionally, the inspector completed a review of special inspection charter items contained in Sections 3.1 - 3.3 of this report. A list of documents reviewed is provided in Attachment 1 of this report.

2. Event Description

Following the reactor scram, several unexpected system responses occurred. Notably, because a generator lockout was not received (in that there was no fault on the Columbia generator), the main turbine and generator continued to operate and supply the station electrical loads through the normal transformer. Approximately 2 minutes later, plant operations personnel tripped the main turbine, but not the main generator though the additional action was directed by Procedure PPM 3.3.1, Reactor Scram. As such, the plant electrical busses, including SM-7, SM-8, and SM-4, the Division 1, 2, and 3 vital busses remained tied to the main generator and experienced slowly decaying voltage and frequency. Approximately 2 minutes after the turbine was tripped, voltage degraded to the setpoint of the degraded voltage relays, causing a transfer of busses SM-7 and 8 from the normal transformer to the backup transformer and bus SM-4 to be supplied by the Division 3 emergency diesel generator.

Normally following a scram, the station's electrical busses would fast transfer to the startup transformer. During the event, the fast transfer did not occur for the vital busses and RPS lost power. The de-energizing of the RPS instrument busses resulted in a full nuclear steam supervisory system isolation, including closure of main steam isolation valves (MSIVs) and isolation of the reactor closed loop cooling (RCC) system. Because the MSIVs closed, the licensee lost the ability to reject steam and heat to the main condenser, requiring the use of safety relief valves (SRVs) and the suppression pool for heat removal.

Additionally, because RCC isolated, pressure and temperature in the drywell increased, eventually leading to an emergency core cooling system actuation as a result of pressure exceeding 1.68 psig in the drywell.

The licensee experienced two other operational concerns following the reactor scram.

The reactor core isolation cooling (RCIC) pump turbine tripped on an overspeed condition and had to be restarted, and the high-pressure core spray (HPCS) system developed a small leak on the minimum flow line that returns to the suppression pool.

3. Inspection Results

3.1 Charter Item 1: The inspectors developed a complete sequence of events leading to the reactor scram.

a. Inspection Scope

The inspectors conducted a detailed review of the events leading up to, during, and following the December 18, 2016, reactor scram at CGS. The team gathered information from operator narrative logs, the plant process computer, sequence of events printouts, alarm printouts, and interviews with plant operations personnel and engineering staff to develop a detailed timeline of the event. The inspectors developed the timeline, in part, through a review of action requests, station logs, and interviews with station personnel.

b. Observations On December 18, 2016, at 11:24 a.m., a fault on a transmission line over 100 miles from CGS resulted in an unusual sequence of breaker trips at the Ashe substation. Note that the Ashe substation contains non-safety circuit breakers that are not controlled by the licensee, Energy Northwest, but are instead controlled by Bonneville Power Administration (BPA). The sequence was unusual because three breakers in the Ashe substation did not function as designed due to cold weather conditions, which caused additional protection schemes to actuate. The overall sequence resulted in CGSs output breakers being opened without an associated fault signal being sent to trip the main generator. Essentially, the breaker sequence was equivalent to manually opening the generator output breakers (4888 and 4885) simultaneously at 100 percent power.

Immediately after the generator output breakers opened, CGS scrammed from a governor fast valve closure signal. The turbine and generator, however, did not trip because, as designed, no fault signal was sent from the Ashe substation.

Reactor pressure vessel (RPV) pressure reached a peak of 1089 psig before being controlled by SRV operation. Voltage transients caused the RPS breakers to open, which caused a complete loss of RPS and subsequent closure of MSIVs. RPV pressure was controlled with SRVs, and level was controlled using RCIC.

Several minutes into the event, operations personnel manually tripped the main turbine.

However, operators did not trip the main generator, and no automatic trip of the main generator occurred. The main generator still contained significant inertia energy and as a result, was still supplying the stations electrical loads. The coastdown of the main turbine and generator resulted in a slow reduction of voltage on all the busses still connected through the normal transformer. Eventually, safety-related electrical busses, SM-7, SM-8, and SM-4, undervoltage protection schemes caused them to transfer to alternate power sources. The generator was tripped automatically when the V/Hz

[voltage potential over frequency] trip setpoint was reached.

Sequence of events on December 18, 2016:

Time Notes 11:24 a.m.

Fast closure of Main Turbine Governor Valves Automatic Scram Both reactor recirculation pumps tripped Entered procedure PPM 5.1.1, RPV Control Mode switch placed in shutdown BPA called and reported they have lost Ashe substation 11:25 a.m.

MSIVs closed 11:27 a.m.

Main Turbine manually tripped by operators 11:28 a.m.

SM-7 and SM-8 Busses Undervoltage (UV) tripped Division 1, 2, & 3 diesel generators started 11:29 a.m.

Main Generator lockout and unit differential lockout tripped 11:32 a.m.

Started RCIC Pump 11:35 a.m.

Started Division 2 residual heat removal pump for suppression pool cooling 12:09 p.m.

HPCS pump started due to RCIC pump trip 12:26 p.m.

Entered procedure PPM 5.2.1, Primary Containment Control on High drywell pressure (1.68 psig)3:50 p.m.

HPCS system is shutdown - the HPCS system was in minimum flow for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and 42 minutes 3.2 Charter Items 2 and 3: The inspectors reviewed equipment and operational challenges that occurred during the post scram response, including unexpected MSIV closure, unexpected trip of the RCIC system turbine, and an unexpected leak from a flange on the HPCS system recirculation piping. In addition, the inspectors reviewed the cause of the reactor scram.

a. Inspection Scope

The inspectors reviewed and assessed the initial equipment conditions and equipment response including consistency with the plants design and regulatory requirements, and identification of any potential design deficiencies. The team reviewed the adequacy of associated operability assessments, technical evaluations, corrective and preventive maintenance, and post-maintenance testing. The team also evaluated the safety significance of equipment issues identified during the event as well as the impact on the plants license, technical specifications, regulatory requirements, and aging management programs. The team reviewed the event timeline, the post trip report, operations personnel narrative logs, corrective action program condition reports, modification packages, drawings, and component maintenance histories.

b. Observations The response to the reactor scram event on December 18, 2016, was complicated by several equipment performance issues: MSIV closure, unexpected trip of the RCIC system turbine, an unexpected leak from a flange on the HPCS system recirculation piping, Ashe substation cold weather performance, and RPS recovery.

Main steam isolation valve closure On December 18, 2016, at 11:24 p.m. when the main generator output breakers 4885 and 4888 at the Ashe substation opened during a series of breaker failures at Ashe substation, the main turbines overspeed protection circuit (OPC) of the digital-electro-hydraulic (DEH) control actuated as designed, closing the governor valves to prevent turbine overspeed trip. The main generator frequency oscillated between 56.5 Hz and 62.5 Hz.

Six Class 1E electrical protection assemblies (EPA) are provided for each normal and backup source of power to the RPS, capable of de-energizing the power supplied to the RPS bus, whenever the source voltage exceeds its limits or frequency deviates from specified trip setting, which is less than 57.8 Hz. During these frequency oscillations the main generator frequency dropped below the EPA trip setpoint of 57.8 Hz for approximately 16 seconds. This time was long enough for the RPS Motor Generator (MG) set frequency to drop below 57.8 Hz, which initiated the trip of the EPAs, which resulted in the de-energization of the power supplied to the RPS bus, and subsequent initiation of the MSIV isolation signal.

MSIV closure associated with the loss of power to the RPS busses caused automatic containment isolation, which resulted in a high pressure condition inside containment.

These conditions required additional operator action to mitigate the transient and required entry in to several emergency operation procedures. Therefore, the inspectors concluded that the closure of the MSIVs was the expected response for the CGS design.

Unexpected trip of the RCIC system turbine During the December 18, 2016, scram, licensed operators failed to open the RCIC turbine trip valve, RCIC-V-1, prior to initiating RCIC. As a result, RCIC tripped on overspeed, required local resetting, and led to licensed operations personnel injecting with the HPCS system. Step 2.3 of licensee Procedure SOP-RCIC-INJECTION-QC, RCIC RPV Injection - Quick Card, Revision 5, states the following to initiate RCIC:

2.3.1 Close RCIC-V-45 (Steam to Turbine)2.3.2 When RCIC-V-45 indicates full close, then immediately open RCIC-V-1 (Turbine Trip)2.3.3 If RCIC-V-45 did not open, then arm and depress the RCIC manual initiation pushbutton.

The inspectors determined the control room staff failed to perform Step 2.3.2 to open RCIC-V-1 prior to performing Step 2.3.3 to initiate RCIC. As a result of the incomplete initiation of RCIC, the RCIC turbine speed control signal remained at rated speed, the RCIC turbine overshot the speed setpoint, and the system tripped on overspeed. The RCIC system was unavailable for 13 minutes until reset locally at the pump. During this time, reactor water level dropped from +13 inches to +1 inch. As a result, plant operators transitioned to the use of the HPCS system for RPV level control. The inspectors determined that the failure to follow Procedure SOP-RCIC-INJECTION-QC was a non-cited violation of Technical Specification 5.4.1.a, Procedures, which is documented in Section 3.4 of this report.

Unexpected leak from a flange on the HPCS system recirculation piping During the December 18, 2016, scram, following the RCIC pump trip on overspeed described above, the HPCS system was started at 12:09 p.m. to provide an additional high pressure injection source to the RPV. Following the initial injection from the HPCS system to control RPV water level, the injection line valve, HPCS-V-4, was closed, and the minimum flow isolation valve, HPCS-V-12, automatically opened, which put the HPCS system into minimum flow mode. In minimum flow mode, the HPCS pump discharges to the suppression pool. Prior to entering the suppression pool, flow goes through four restricting orifices (HPCS-RO-1, 5, 6, and 7). After the single injection of HPCS to the RPV for approximately one minute, HPCS was operated in the minimum flow configuration for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and 42 minutes.

Later on December 18, 2016, during the forced outage, a leak and loose bolts were identified on the first flange downstream of HPCS-V-12, associated with restricting orifice RO-5. The licensee initiated Action Request 359066 and Engineering Change Evaluation 016291 to evaluate the issue.

The licensee determined that the root cause for the observed leakage from the flange associated with restricting orifice RO-5 was due to inadequate gasket and flange design for the HPCS system operating conditions.

The gasket for RO-5 had been in service since initial plant construction; the licensee was unable to locate any documented maintenance on this mechanical joint. When the flange was disassembled, it was discovered that half of the nuts on the flange were loose. When the gaskets were removed, the upstream side of the gasket was found to be missing its inner winding, which is the gasket surface between the flange and the orifice. The licensee concluded the spiral wound gasket unwound over time and eventually resulted in a loss of compression at the flange and loosening of the bolts.

Flange leakage occurred as the gasket material eroded.

The RO-5 flanged joint incorporated a Flexitallic gasket, style CG. Flexitallic manufactures several types of spiral wound gaskets that are intended for specific sealing applications in fluid piping systems. The style CG has a solid centering ring that fits the diameter formed by the flange bolts, and maintains the sealing material in the area of the flange face. The style CGI is identical to the style CG with the addition of an internal solid ring. The solid rings serve to prevent the gasket from being over-compressed as a result of excessive torque applied to the flange bolting. This prevents unwinding of the gasket which occurred on RO-5. The inspectors determined that the failure to select the proper gasket material after operating experience revealed that Flexitallic style CG gaskets are not well suited for the HPCS-RO-5 flange location was a non-cited violation of 10 CFR 50, Appendix B, Criterion XVI, Corrective Action, which is documented in Section 3.4 of this report.

The licensee calculated the leak rate at the HPCS-RO-5 flange to be approximately 4.7 gallons per minute with the HPCS pump in minimum flow mode. The inspectors determined that despite the failure of the gasket for RO-5, the HPCS system was capable of performing its safety function.

Ashe Substation Cold Weather Performance The inspectors reviewed the operation and maintenance of the Ashe substation to evaluate the impact of the substation on the event. The inspectors interviewed the system engineer and reviewed previous corrective actions. The inspectors interviewed operations personnel and managers and verified that CGS coordinated with the transmission operator, Bonneville Power Administration (BPA), frequently during the December 18, 2016, scram event. The inspectors reviewed the documentation of the substation inspection which occurred after the plant shutdown and prior to re-energizing the substation to verify that the inspection was thorough. The inspectors also performed a review of relevant operating experience to assess CGSs effectiveness at identifying and correcting issues related to offsite power.

Following the scram, CGS worked with the grid operator, BPA, to review substation maintenance and to perform thorough inspections of substation components prior to restoring the substation to service. The inspectors concluded that the actions CGS performed were an appropriate interim action until more specific weather related modifications were implemented to improve Ashe substation performance during similar cold weather conditions.

RPS recovery training The team identified a licensed operator training weakness involving the execution of repowering RPS busses during the recovery to the December 18, 2016, reactor scram event. Specifically, the control room operations crew did not effectively implement procedure ABN-RPS, Loss of RPS, Revision 11, in a timely manner. Inspectors reviewed the past 2 years of simulator based training and determined no complete loss and subsequent recovery of RPS was used during training activities. The RPS training focused on individual aspects of ABN-RPS and not ensuring recovery of at least one RPS bus.

The inspectors determined that there were several knowledge and training issues that occurred or became evident during the recovery of RPS. However, this issue did not result in a failure to comply with the emergency operating procedures or other abnormal response procedures. Action Request 359072 was written to address and improve operator knowledge and training for recovery of RPS.

3.3 Charter Items 4 and 5: The inspectors evaluated pertinent industry operating experience and potential precursors to the event, including the effectiveness of any action taken in response to the operating experience. In addition, the inspectors reviewed the licensee's immediate and longer term corrective actions, including extent of condition.

a. Inspection Scope

The inspectors reviewed the issues that had been entered into the CGS corrective action program related to the December 18, 2016, scram event. The inspectors review focused on if the licensees actions would provide assurance that the causes of risk-significant performance issues are understood and addressed in a manner commensurate with the significance of the problem. The inspectors reviewed historical corrective action documents to assure that the extent of condition and extent of cause of risk-significant performance issues were appropriately identified by the licensee. Finally, the inspectors reviewed the licensees corrective actions for risk-significant performance issues to ensure they were sufficient to address causes and prevent recurrence. The inspectors interviewed key station personnel from operations, design and system engineering, maintenance, and the corrective action program.

b. Observations Root Cause Evaluations and Operating Experience The inspectors reviewed the following root cause evaluations and historical licensee event reports (LERs) related to the December 18, 2016, scram:

• Root Cause AR 359059, Complicated Scram due to loss of RPS

• Root Cause AR 359066, Leak From HPCS Min Flow Line

• LER 2000-003-00, Unit Trip and Reactor Scram Due to Protective Relay Control Circuit Failure

• LER 90-031-00, Reactor Scram Due to Main Generator Trip Caused by Shorted Main Transformer Output Line Insulator - Less than Adequate Corrective Action Plan/Plant Design

• LER 89-002-00, Turbine Control Valve Fast Closure Reactor Scram Due to Main Generator Trip Caused by Equipment Failure - Shorted Main Transformer Output Line Insulator The inspectors determined the licensee appropriately classified the Action Requests as Root Causes per their corrective action procedures. The inspectors reviewed the timeline for corrective actions and spoke with key personnel in the various divisions implementing those actions. The inspectors concluded the corrective actions are appropriate to the circumstances and will be implemented in a timely manner.

The inspectors reviewed the history of events at CGS for those involving loss of offsite power and loss of RPS. The LERs listed represent the most similar events. None of those events, however, involved multiple failures of Ashe substation circuit breakers which occurred on December 18, 2016. The licensee appropriately recognized enhancements for procedures used to recover RPS and will be implementing those changes in a timely manner.

Specifically, for the December 18, 2016, scram, the breaker failures at Ashe substation resulted in a cascade of trips which opened all breakers on the north and south busses at the Ashe substation, including the 4888 and 4885 breakers (Ashe CGS north and south bus breakers) causing a loss of load event for CGS. Since there were no trips that originated within the CGS bay at Ashe, the main generator lockout relays did not initiate a generator trip and fast transfer of the generator loads to the startup transformer. The inspectors determined the observed response of the main generator was by design.

3.4 Specific findings identified during this inspection.

(1) Operators Fail To Follow Reactor Scram Procedure

Introduction.

The inspectors reviewed a Green, self-revealed, non-cited violation of Technical Specification 5.4.1.a, Procedures, for the licensees failure to follow Procedure 3.3.1, Reactor Scram, Revision 62. Specifically, the licensee failed to trip the main generator per Procedure PPM 3.3.1, Step 6.2.9, although it was required for a load rejection scram. As a result, during the scram on December 18, 2016, the station vital electrical busses SM-7 and SM-8 transferred to the backup transformer (and to Division 3 Diesel Generator in the case of bus SM-4), instead of to the preferred electrical source, the startup transformer.

Description.

On December 18, 2016, Columbia Generating Station experienced a scram from full power when several circuit breakers at the Ashe substation failed due to cold temperatures. The licensee placed the reactor in a safe condition by entering Procedure 5.1.1, RPV Control, Revision 21, and Procedure 3.3.1, Reactor Scram, Revision 62.

Licensed control room operators manually tripped the main turbine at 11:27 a.m.;

however, operators did not trip the main generator and no automatic trip of the main generator occurred because the fault did not originate in the Columbia switchyard.

Following the main turbine trip, the turbine generator coasted down, resulting in an undervoltage condition. At 11:28 a.m., safety-related busses SM-7 and SM-8 transferred to the backup transformer on undervoltage. Simultaneously, the Division 1 and 2 emergency diesel generators started and operated at rated speed without loading.

Safety bus SM-4 tripped on undervoltage; the Division 3 emergency diesel generator started and loaded SM-4 in approximately 10 seconds, as designed. Main generator terminal voltage and frequency continued to degrade until 11:29 a.m. when the main generator tripped on volts to hertz (V/Hz) protection. The turbines generator trip initiated the fast transfer logic and non-safety busses SM-1, SM-2, SM-3, SH-5, and SH-6 transferred to the startup transformer.

Earlier in the electrical transient, at 11:25 a.m., the RPS lost power. As a result, the MSIVs received an isolation signal and shut. The closure of MSIVs caused the licensee to lose the main condenser as a heat sink and transition to the suppression pool via SRVs. Since the main feedwater pumps are steam-driven, the licensee also lost main feed although motor-driven condensate pumps were available to inject if plant pressure was lowered. Also due to this complication, the non-safety reactor closed loop cooling system (RCC) isolated. This system provides cooling to the drywell air coolers and to other non-safety systems. As a result of losing RCC cooling, the drywell pressure increased and eventually exceeded the 1.68 psig accident signal. Due to the result of the high drywell pressure accident signal, all emergency core cooling systems actuated, containment isolation signals actuated, and HPCS injected into the reactor vessel. The licensee recovered from the complications, cooled down the reactor to Mode 4 on December 19, 2017, 4:04 p.m., and manned the outage control center.

The inspectors reviewed the scram event logs and procedures and noted that control room operators failed to follow Procedure PPM 3.3.1, Reactor Scram, Revision 62.

Step 6.2.9 of Procedure PPM 3.3.1 states:

When the Main Generator is LT [less than] 50 MWE [megawatts electric], then perform the following:

a. If the Main Turbine is not tripped, then simultaneously depress both Emergency Trip pushbuttons (H13-P820).

b. If the Main Generator has not tripped, then depress either Unit Emergency Trip pushbutton or Unit Overall Trip pushbutton (H13-P800)c. Verify power transfers to TR-S [startup transformer].

d. Refer to ABN-TURBINE, and perform concurrently with this procedure The inspectors determined the control room staff performed Step 6.2.9.a by tripping the main turbine but failed to perform Steps 6.2.9.b and 6.2.9.c to trip the main generator and verify the busses transfered to the startup transformer. Instead, the main generator continued to power non-vital and vital busses without steam being applied to the associated turbine. After a few minutes, the inertial rotation of the main turbine slowed resulting in degraded voltage and frequency and a complicated electrical transient with the loss of preferred power to 4160 VAC vital busses.

Although the vital busses were repowered, the available power sources were reduced.

Specifically, SM-4 was being powered by its only remaining source - the Division 3 emergency diesel generator. Further, SM-7 and SM-8 were being powered by the backup transformer with their respective emergency diesel generators idling. Electrical busses SM-7 and SM-8 no longer had the startup transformer power source available as a result of the performance deficiency. As immediate corrective actions, the licensee implemented operations Night Order 75 that reinforced training to trip the main generator on a reactor scram. The licensee entered this issue into their corrective action program as Action Requests 359059 and 361029.

Analysis.

The failure to follow Procedure PPM 3.3.1, Reactor Scram, Revision 62, was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it adversely affected the human performance attribute of the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the performance deficiency resulted in a reduction in the offsite power sources available to supply safety related busses. The inspectors performed the initial significance determination using NRC Inspection Manual Chapter 0609, Attachment 04, Initial Characterization of Findings, and Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated June 19, 2012. The inspectors determined that the finding was of very low safety significance (Green) because:

(1) the finding was not a deficiency affecting the design or qualification of a mitigating system;

(2) the finding did not represent a loss of system and/or function;

(3) the finding did not represent an actual loss of function of a single train for greater than its technical specification allowed outage time; and

(4) the finding does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

This finding had a cross-cutting aspect in the area of human performance, training, in that the licensee failed to provide training and ensure knowledge transfer to maintain a knowledgeable, technically competent workforce and instill nuclear safety values.

Specifically, the licensed operators did not understand the actions associated with the main generator in the scram procedure [H.9].

Enforcement.

Technical Specification 5.4.1.a requires, in part, that written procedures shall be established, implemented and maintained covering the applicable procedures recommended in Appendix A of Regulatory Guide 1.33, Revision 2. Sections 6.q and 6.u of Appendix A of Regulatory Guide 1.33, Revision 2, requires procedures for combating emergencies and other significant events including turbine and generator trips and reactor trips. The licensee established Procedure PPM 3.3.1, Reactor Scram, Revision 62, to meet the Regulatory Guide 1.33 requirement. Contrary to the above, on December 18, 2016, the licensee failed to follow Procedure PPM 3.3.1, Reactor Scram, Revision 62. Specifically, the licensee failed to perform Steps 6.2.9.b and 6.2.9.c to trip the main generator as required in Procedure PPM 3.3.1, Reactor Scram, Revision 62. As a result, during the scram on December 18, 2016, the station vital electrical busses SM-7 and SM-8 transferred to the backup transformer (and to Diesel Generator-3 in the case of bus SM-4), instead of to the preferred electrical source, the startup transformer.

The licensee entered this issue into their corrective action program as Action Requests 359059 and 361029. Because this finding is of very low safety significance (Green) and was entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy. (NCV 05000397/2017008-01, Operators Fail To Follow Reactor Scram Procedure)

(2) Operators Fail To Follow Procedure Causes RCIC Overspeed Trip

Introduction.

The inspectors reviewed a Green, self-revealed, non-cited violation of Technical Specification 5.4.1.a, Procedures, for the licensees failure to follow Procedure SOP-RCIC-INJECTION-QC, RCIC RPV Injection - Quick Card, Revision 5.

During a complicated reactor scram on December 18, 2016, licensed operators failed to open the RCIC turbine trip valve, RCIC-V-1, prior to initiating RCIC. As a result, RCIC tripped on overspeed, required local resetting, and led to licensed operations personnel injecting with the HPCS system.

Description.

On December 18, 2016, Columbia Generating Station experienced a reactor scram from full power when breakers at the Ashe substation failed due to cold temperatures. The licensee placed the reactor in a safe condition by entering Procedure PPM 3.3.1, Reactor Scram, Revision 62.

As required to maintain reactor coolant system inventory, the licensee started the RCIC system in accordance with SOP-RCIC-INJECTION-QC, RCIC RPV Injection - Quick Card, Revision 5. Because the MSIVs were shut, the licensee manually started and stopped the RCIC system to maintain RPV level within the desired level band. On the third iteration of manually starting RCIC, the RCIC pump turbine tripped on overspeed.

Because of the need to maintain RPV level, the licensee manually started the HPCS system and injected into the RPV vessel.

Step 2.3 of licensee Procedure SOP-RCIC-INJECTION-QC, RCIC RPV Injection -

Quick Card, Revision 5, states the following to initiate RCIC:

2.3.1 Close RCIC-V-45 (Steam to Turbine)2.3.2 When RCIC-V-45 indicates full close, then immediately open RCIC-V-1 (Turbine Trip)2.3.3 If RCIC-V-45 did not open, then arm and depress the RCIC manual initiation pushbutton.

The inspectors determined the control room staff failed to perform Step 2.3.2 to open RCIC-V-1 prior to performing Step 2.3.3 to initiate RCIC. As a result, the turbines speed control circuit did not receive the expected ramp of the speed setpoint per design.

Note that RCICs ramp generator signal is designed to slowly raise the RCIC turbines speed from idle to rated speed over a 12 second period and avoid the overspeed trip.

As a result of the incomplete initiation of RCIC, the RCIC turbine speed control signal remained at rated speed, the RCIC turbine overshot the speed setpoint, and the system tripped on overspeed. The RCIC system was unavailable for 13 minutes until reset locally at the pump. During this time, reactor water level dropped from +13 inches to

+1 inch and operations personnel transitioned to using HPCS for level control.

As immediate corrective actions, the licensee implemented operations Night Order 76 that emphasized to operators the correct valve sequence for initiating RCIC flow. To address additional training aspects of this issue, the licensee updated the RCIC quick card procedure for clarity and added a training module to the next licensed operator requalification cycle on use of RCIC during transients. The licensee entered the unexpected trip of RCIC into the corrective action program as Action Requests 359064 and 359162.

Analysis.

The failure to follow Procedure SOP-RCIC-INJECTION-QC, RCIC RPV Injection - Quick Card, Revision 5, was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it adversely affected the human performance attribute of the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors performed the initial significance determination using NRC Inspection Manual Chapter 0609, Attachment 04, Initial Characterization of Findings, and Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated June 19, 2012. The inspectors determined that the finding was of very low safety significance (Green) because:

(1) the finding was not a deficiency affecting the design or qualification of a mitigating system;

(2) the finding did not represent a loss of system and/or function;

(3) the finding did not represent an actual loss of function of a single train for greater than its technical specification allowed outage time; and

(4) the finding does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

This finding had a cross-cutting aspect in the area of human performance, training, in that the licensee failed to provide training and ensure knowledge transfer to maintain a knowledgeable, technically competent workforce and instill nuclear safety values.

Specifically, the licensed operator did not understand the sequence of component manipulations for restarting RCIC using the quick card [H.9].

Enforcement.

Technical Specification 5.4.1.a requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Appendix A of Regulatory Guide 1.33, Revision 2. Section 4.g of Appendix A of Regulatory Guide 1.33, Revision 2, requires procedures for startup, shutdown, and changing modes of operation of the RCIC system. The licensee established Procedure SOP-RCIC-INJECTION-QC, RCIC RPV Injection - Quick Card, Revision 5, to meet the Regulatory Guide 1.33 requirement. Contrary to the above, on December 18, 2016, the licensee failed to follow Procedure SOP-RCIC-INJECTION-QC, RCIC RPV Injection - Quick Card, Revision 5. The inspectors determined the control room staff failed to perform Step 2.3.2 to open RCIC-V-1 prior to performing Step 2.3.3 to initiate RCIC. As a result, on December 18, 2016, RCIC tripped on overspeed, required local resetting, and led to licensed operations personnel injecting with the HPCS system.

The licensee entered this issue into the corrective action program as Action Requests 359064 and 359162. Because this finding is of very low safety significance (Green) and was entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy.

(NCV 05000397/2017008-02, Operators Fail To Follow Procedure Causes RCIC Overspeed Trip)

(3) Inadequate Corrective Actions Causes Failure of HPCS Restricting Orifice

Introduction.

The inspectors reviewed a Green, self-revealed, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, for failure to promptly identify and correct a condition adverse to quality. Specifically, since 2009, the licensee failed to implement prompt corrective actions to correct an adverse condition related to the use of spiral wound gaskets for restricting orifices in the HPCS system.

Description.

During the Columbia Generating Station scram event on December 18, 2016, RCIC pump tripped on overspeed, and HPCS was started at 12:09 p.m. to provide an additional high pressure injection source to the RPV.

Following the initial injection with HPCS into the RPV, HPCS-V-4, the HPCS injection line valve, was closed and the minimum flow isolation valve, HPCS-V-12, automatically opened, which put the HPCS system into minimum flow mode. In minimum flow mode, the HPCS pump discharges to the suppression pool. Prior to entering the suppression pool, flow goes through four restricting orifices (HPCS-RO-1, 5, 6, and 7) that reduce the pressure of the water going to the suppression pool. These four orifices are all on the vertical section of minimum flow pipe just downstream of HPCS-V-12. The minimum flow line orifices prevent pump damage. After the single injection of HPCS to the RPV for approximately 1 minute, HPCS was in minimum flow for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and 42 minutes.

The primary purpose of HPCS is to maintain reactor vessel inventory after small breaks which do not depressurize the reactor vessel. The system is initiated by either high drywell pressure or low water level in the vessel. The HPCS system allows for complete plant shutdown by maintaining sufficient reactor water inventory until the reactor is depressurized to a level where the low pressure coolant injection system can be placed into operation. The HPCS system is powered by its own emergency diesel generator if auxiliary power is not available, and the system may also be used as a backup for the RCIC system. The HPCS is one of two systems that provide spray cooling heat transfer during breaks which uncover the core. In the event the HPCS system is in any other mode than standby and an automatic initiation signal is received, all valves will realign for the injection mode of operation.

Later on December 18, 2016, during the forced outage, a leak and loose bolts were identified on the first flange downstream of HPCS-V-12, associated with restricting orifice RO-5.

The gasket for RO-5 had been in service since initial plant construction, and no documented maintenance could be identified. When the flange was disassembled it was discovered that half of the nuts on the flange were loose. When the gaskets were removed the upstream side was found to be missing its inner winding, which is the gasket surface between the flange and the orifice. The gasket material eroded over time, which accelerated the failure of this gasket. The spiral wound gasket unwound over time and eventually resulted in a loss of compression at the flange and loosening of the bolts. Flange leakage occurred as the gasket material eroded.

The RO-5 flanged joint incorporated a Flexitallic gasket style CG. Flexitallic manufactures several types of spiral wound gaskets that are intended for specific uses in sealing fluid piping systems. The style CG has a solid centering ring that fits the diameter formed by the flange bolts, and maintains the sealing material in the area of the flange face. The style CGI is identical to the style CG with the addition of an internal solid ring. The solid ring serves to prevent the gasket from being over compressed as a result of excessive torque applied to the flange bolting. This prevents unwinding of the gasket, which occurred on RO-5. The licensee determined that the gasket and flange design for the RO-5 were not appropriate for HPCS operating conditions.

The licensee calculated the leak rate at the HPCS-RO-5 flange to be approximately 4.7 gallons per minute with the HPCS pump in minimum flow mode. A functional HPCS floor drain system provides an allowable leak rate over a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period of 124.5 gallons per minute due to allowable water and the capacity of the two floor drain sump pumps.

The inspectors performed a review of internal operating experience and noted that the licensee missed several opportunities to identify and correct this design issue. The inspectors noted the following operating experience, including failures on other restricting orifices downstream of HPCS-RO-5 flange related to the design issue associated the incorrect gasket type:

Date Title Task June 2, 2004 HPCS-RO-6 flange leak Work Request (WR) 29039926 June 7, 2004 HPCS-RO-6 flange leak after Work Order (WO)torque 01080350 March 31, 2005 HPCS-RO-7 flange leak WR 29045803 June 3, 2005 HPCS-RO-6 & 7 leak repair with WO 01081966 gasket missing from RO-6 October 10, 2008 Evaluate the use of spiral wound Action Request-gaskets EVAL 187233 December 9, 2009 Fuel Integrity Review Visit (FIRV) Action Request related to foreign material exclusion 209203 February 24, 2010 Assignment complete by Action Request-engineering to allow style CGI EVAL 187233 gaskets Additionally, the inspectors noted that in 2007, external industry operating experience related to foreign material controls was released. This document provided guidance to the nuclear industry to help prevent fuel and equipment failures due to intrusion of foreign material. This documents key point was to, Prohibit the use of metallic crush-style gaskets without inner metal rings, and purge them from the spare parts inventory.

The recommendation was to use style CGI gaskets.

As an immediate corrective action, the licensee replaced the RO-5 gasket under Work Order 02105645. The licensee entered this issue into the corrective action program as Action Request 359066. The licensee evaluated this issue under Engineering Change Evaluation 016291. In addition, the licensee concluded in AR 360990 that previous corrective actions have not been effectively implemented.

Analysis.

The failure to implement prompt corrective actions to correct an adverse condition in spiral wound gaskets for restricting orifices for the HPCS system was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it affected the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Following the scram on December 18, 2016, this failure to implement prompt corrective actions to correct an adverse condition in spiral wound gaskets for restricting orifices for the HPCS system resulted in a failed RO-5 gasket, introduction of foreign material into the suppression pool, and leakage into the HPCS room. The inspectors performed the initial significance determination using NRC Inspection Manual Chapter 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions. The inspectors determined that the finding was of very low safety significance (Green) because:

(1) the finding was not a deficiency affecting the design or qualification of a mitigating system;

(2) the finding did not represent a loss of system and/or function;

(3) the finding did not represent an actual loss of function of a single train for greater than its technical specification allowed outage time; and

(4) the finding does not represent an actual loss of function of one or more nontechnical specification trains of equipment designated as high safety-significant in accordance with the licensees maintenance rule program for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The inspectors determined that this finding did not have a cross-cutting aspect as the descision to use incorrect spiral wound gaskets occurred in 2009 and was not reflective of current performance. (Section 3.4)

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that Measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. Contrary to this requirement, the licensee failed to assure conditions adverse to quality were promptly identified and corrected. Specifically, from June 2, 2004 through December 18, 2016, the licensee failed to promptly correct a condition adverse to quality related to the use of spiral wound gaskets for restricting orifices in the HPCS system, to which 10 CFR Part 50, Appendix B, applies. Consequently, following the scram on December 18, 2016, the licensees failure to implement prompt corrective actions to correct an adverse condition related to the use of spiral wound gaskets for restricting orifices in the HPCS system resulted in a failed gasket for RO-5, introduction of foreign material into the suppression pool, and leakage into the HPCS room.

As an immediate corrective action, the licensee replaced the RO-5 gasket under Work Order 02105645 and initiated Action Request 359066. Because this finding is of very low safety significance (Green) and was entered into the licensees corrective action program, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy. (NCV 05000397/2017008-03, Inadequate Corrective Actions Causes Failure of HPCS Restricting Orifice Gasket)

4OA3 Follow-up of Events and Notices of Enforcement Discretion

.1 (Closed) Licensee Event Report 05000397/2016-004-00, Automatic Scram Due to Off-

site Load Reject The inspectors reviewed the licensee event report associated with this event and determined that the report adequately documented the summary of the event including the potential safety consequences and corrective actions required to address issues related to the reactor scram on December 18, 2016. The enforcement aspects of this violation are listed in Section 3.4(1) of this report. This licensee event report is closed.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On March 30, 2017, the inspector conducted an exit briefing with Mr. W. Hettel, Vice President, Operations, and other members of the licensee's staff. The licensee representatives acknowledged the findings presented. The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

A. Black, Manager, Emergency Services

D. Brown, Manager, Systems Engineering

D. Gregoire, Manager, Regulatory Affairs

G. Hettel, Vice President, Operations

G. Pierce, Manager, Training

R. Prewett, Operations Manager

B. Schuetz, Plant General Manager

D. Wolfgramm, Compliance Supervisor, Regulatory Affairs

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000397/2017008-01 NCV Operators Fail To Follow Reactor Scram Procedure (Section 3.4)

05000397/2017008-02 NCV Operators Fail To Follow Procedure Causes RCIC Overspeed Trip (Section 3.4)

05000397/2017008-03 NCV Inadequate Corrective Actions Causes Failure of HPCS Restricting Orifice Gasket (Section 3.4)

Closed

05000397/2016-004-00 LER Automatic Scram Due to Off-site Load Reject (Section 4OA3)