IR 05000400/2014007

IR 05000400/2014007, June 23, 2014 - July 25, 2014, Shearon Harris Nuclear Plant, Unit 1, Component Design Bases Inspection

ML14248A696
Person / Time
Site:	Harris
Issue date:	09/03/2014
From:	Nease R NRC/RGN-II/DRS/EB1
To:	Waldrep B Duke Energy Progress
References
IR 2014007
Download: ML14248A696 (26)

Text

September 3, 2014

SUBJECT:

SHEARON HARRIS NUCLEAR PLANT - NRC COMPONENT DESIGN BASES INSPECTION REPORT 05000400/2014007

Dear Mr. Waldrep:

On July 25, 2014, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Shearon Harris Nuclear Plant and discussed the results of this inspection with Mr. E. Kapopoulos and other members of your staff. Additional inspection results were discussed with Mr. M. Grantham and other members of your staff on August 14, 2014.

Inspectors documented the results of this inspection in the enclosed inspection report.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

NRC inspectors documented four findings of very low safety significance (Green) in this report.

These findings involved violations of NRC requirements. The NRC is treating these violations as a non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region II; the Director, Office of Enforcement, U.S.

Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the Shearon Harris Nuclear Plant. In accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's Agencywide Document Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA: Jason Eargle for/

Rebecca L. Nease, Chief

Engineering Branch 1

Division of Reactor Safety

Docket Nos.: 50-400 License Nos.: NPF-63

Enclosure:

Inspection Report 05000400/2014007 w/ Attachment: Supplementary Information

REGION II==

Docket No.:

50-400

License No.:

NPF-63

Report No.:

05000400/2014007

Licensee:

Duke Energy Progress, Inc.

Facility:

Shearon Harris Nuclear Plant, Unit 1

Location:

5413 Shearon Harris Road New Hill, NC 27562

Dates:

June 23, 2014 - July 25, 2014

Inspectors:

G. Ottenberg, Senior Reactor Inspector (Lead)

R. Patterson, Reactor Inspector

M. Riley, Reactor Inspector

A. Ruh, Project Engineer C. Baron, Contractor (Mechanical)

S. Kobylarz, Contractor (Electrical)

Approved by:

Rebecca Nease, Branch Chief Engineering Branch 1 Division of Reactor Safety

SUMMARY

IR 05000400/2014007; 06/23/2014 - 07/25/2014; Shearon Harris Nuclear Plant; Component

Design Bases Inspection.

This inspection was conducted by a team of four Nuclear Regulatory Commission (NRC)inspectors from Region II, and two NRC contract personnel. Four Green non-cited violations (NCVs) were identified. The significance of inspection findings is indicated by their color (Green, White, Yellow, Red) using the NRC Inspection Manual Chapter (IMC) 0609,

Significance Determination Process, dated June 2, 2011. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated January 28, 2013.

The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 5, dated February 201

Cornerstone: Mitigating Systems

Green.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B,

Criterion XI, "Test Control," for the licensees failure to establish a test program to assure that the interlocks between the Charging/Safety Injection (CSI) pump alternate miniflow block valves (1CS-745, -753) and the Residual Heat Removal (RHR) to CSI pump piggyback valves (1RH-25, -63) would perform satisfactorily in service. In response to this issue, the licensee initiated nuclear condition report 698720 and performed circuit testing of these control system interlocks during the inspection period to verify they remained operable. The licensee also verified that these interlocks had been subject to preoperational testing.

The licensees failure to establish a test program to assure that the interlocks between the CSI pump alternate miniflow block valves (1CS-745, 1CS-753) and the RHR to CSI pump piggyback valves (1RH-25, 1RH-63) would perform satisfactorily in service, as required by 10 CFR Part 50, Appendix B, Criterion XI, was a performance deficiency. The performance deficiency was determined to be more than minor because, it was associated with the mitigating systems cornerstone attribute of design control and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the lack of testing affected the objective because there was no method to determine the capability of the interlocks to perform their function in the event of a postulated single failure during an accident, which could affect the high head safety injection function. The team determined the finding to be of very low safety significance (Green) because the finding was a deficiency affecting the design or qualification of a mitigating structure, system, or component (SSC), and the SSC maintained its operability. The team determined that no cross-cutting aspect was applicable because the finding was not indicative of current licensee performance. (Section 1R21.2)

Green.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, for the licensees failure to assure that applicable regulatory requirements in technical specification surveillance requirement 4.8.1.1.2.e. were correctly translated into procedural guidance. Specifically, appropriate jacket water (JW) and lube oil (LO) standby temperature limitations, which ensured emergency diesel generator (EDG)capability to meet TS SR 4.8.1.1.2.e. requirements, were not translated into procedures for determining EDG operability. Following identification by the team, the licensee generated nuclear condition report 698245 and established administrative limits to ensure the EDG JW and LO temperatures were not allowed to drop below technically supportable limits.

The licensees failure to assure that applicable regulatory requirements in technical specification surveillance requirement SR 4.8.1.1.2.e. were correctly translated into procedural guidance, as required by 10 CFR Part 50, Appendix B, Criterion III, was a performance deficiency. The performance deficiency was determined to be more than minor because, it was associated with the mitigating systems cornerstone attribute of equipment performance and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee did not ensure the capability and reliability of the EDGs to respond to a design basis accident at the JW or LO temperature conditions at which they considered the EDGs operable. The team determined the finding to be of very low safety significance (Green) because the finding was a deficiency affecting the design or qualification of a mitigating structure, system, or component (SSC), and the SSC maintained its operability. The team determined that no cross-cutting aspect was applicable because the finding was not indicative of current licensee performance. (Section 1R21.2)

Green.

The team identified a Green non-cited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, for the licensees failure to assure that applicable regulatory requirements in technical specification (TS) 3.7.1.1 and design basis inputs in accident analyses were translated into procedural guidance. Specifically, the licensee did not follow their inservice test program guidance to account for surveillance test equipment instrument uncertainty when establishing the acceptability of Main Steam Safety Valve lift setpoints required by TS 3.7.1.1. Following identification by the team, the licensee generated nuclear condition report 697100 and performed an evaluation of the remaining available margin to the overpressure limit in the safety analysis, and discovered that, after potential instrument uncertainty was taken into account, the margin remained positive, but was reduced from approximately 19 psig to approximately 6 psig.

The licensees failure to assure that applicable regulatory requirements in TS 3.7.1.1 and design basis assumptions in accident analyses were correctly translated into procedural guidance, as required by 10 CFR Part 50, Appendix B, Criterion III, was a performance deficiency. The performance deficiency was determined to be more than minor because, if left uncorrected, it had the potential to lead to a more significant safety concern.

Specifically, by not accounting for the measurement and test equipment uncertainties as required by the inservice test program, it could have led to the actual lift setpoints exceeding the inputs used in the design basis safety analyses. The team determined the finding to be of very low safety significance (Green) because the finding was a deficiency affecting the design or qualification of a mitigating structure, system, or component (SSC), and the SSC maintained its operability. The team determined that no cross-cutting aspect was applicable because the finding was not indicative of current licensee performance. (Section 1R21.2)

Cornerstone: Barrier Integrity

Green.

The team identified a Green non-cited violation of 10 CFR Part 50.55a, Codes and Standards, for the licensees failure to categorize valves that were subject to a specific maximum leakage amount while in the closed position as Category A, as required by their American Society of Mechanical Engineers (ASME) Operation and Maintenance (OM) Code of record. Specifically, the team determined that the licensee failed to correctly categorize six valves that could allow emergency core cooling system (ECCS) leakage into the refueling water storage tank above the water level during ECCS post-accident recirculation operation. During the inspection period, the licensee generated nuclear condition report 699708, and performed an evaluation of the affected valves that verified the valves ability to meet leakage limits based on other monitoring that was in place.

The licensees failure to categorize valves that were subject to a specific maximum leakage amount while in the closed position as Category A, as required by their ASME OM Code of record, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the SSC and barrier performance attribute of the Barrier Integrity cornerstone and adversely affected the cornerstone objective of providing reasonable assurance that physical design barriers protect the public from radionuclide releases caused by accidents or events. Specifically, the reliability of the physical design barrier of the leak-tightness of valves in the release paths was not assured since leak testing was not performed due to inaccurate categorization. The team determined the finding to be of very low safety significance (Green) because the finding did not represent an actual open pathway in the physical integrity of reactor containment and did not involve an actual reduction in function of the hydrogen igniters in reactor containment.

The team determined that no cross-cutting aspect was applicable because the finding was not indicative of current licensee performance. (Section 1R21.3)

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

1R21 Component Design Bases Inspection

.1 Inspection Sample Selection Process

The team selected risk-significant components and related operator actions for review using information contained in the licensees probabilistic risk assessment. In general, this included components and operator actions that had a risk achievement worth factor greater than 1.3 or Birnbaum value greater than 1E-6. The sample included 14 components, two of which were associated with containment large early release frequency (LERF), and four operating experience (OE) items.

The team performed a margin assessment and a detailed review of the selected risk-significant components and associated operator actions to verify that the design bases had been correctly implemented and maintained. Where possible, this margin was determined by the review of the design basis and Updated Final Safety Analysis Report (UFSAR) response times associated with operator actions. This margin assessment also considered original design issues, margin reductions due to modifications, or margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for a detailed review. These reliability issues included items related to failed performance test results, significant corrective action, repeated maintenance, maintenance rule status, Manual Chapter 0326 conditions, NRC resident inspector input regarding problem equipment, system health reports, industry OE, and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, OE, and the available defense-in-depth margins. An overall summary of the reviews performed and the specific inspection findings identified is included in the following sections of the report.

.2 Component Reviews

a. Inspection Scope

Components

• Essential Services Chilled Water (ESCW) Chillers [WC-2A, WC-2B]

• ESCW Chilled Water Recirculation Pumps [P-4A, P-4B]

• Pressurizer Power-Operated Relief Valves (PORVs) [1RC-114, 1RC-116, 1RC-118]

• Charging/Safety Injection Pumps (CSIPs) [1A-SA, 1B-SB, 1C-SAB]

• CSIP Alternate Mini-flow and Alternate Mini-flow Block Valves [1CS-745, 1CS-746, 1CS-752, 1CS-753]

• Emergency Diesel Generator Jacket Water and Fuel Oil Systems

• Refueling Water Storage Tank (RWST) Instrumentation [LT-990, LT-991, LT-992, LT-993]

• A 125 Volt (V) Battery and Associated Direct Current

(dc) Distribution Panel [1A-SA, 1DP-1A-SA]

• Emergency Diesel Generator Fuel Oil System Instrumentation [LS-2431A, LS-2431B, LS-2463A, LS-2463B]

• 6.9 kilovolt (kV) Engineered Safeguards Feature (ESF) Buses [1A-SA, 1B-SB]

• 480V Buses [1A2-SA, 1B2-SB]

• 6.9 kV - 480V Station Service Transformer [1A3-SA]

Components with LERF Implications

• Main Steam Safety Valves (MSSVs) - [MS-43, MS-44, MS-45, MS-46, MS-47, MS-48, MS-49, MS-50, MS-51, MS-52, MS-53, MS-54, MS-55, MS-56, MS-57]

• RWST [1X-SAB]

For the 14 components listed above, the team reviewed the plant technical specifications (TS), UFSAR, design bases documents (DBDs), and drawings to establish an overall understanding of the design bases of the components. Design calculations and procedures were reviewed to verify that the design and licensing bases had been appropriately translated into these documents. Test procedures and recent test results were reviewed against DBDs to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents, and that individual tests and analyses served to validate component operation under accident conditions.

Maintenance procedures were reviewed to ensure components were appropriately included in the licensees preventive maintenance program. System modifications, vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action program documents were reviewed (as applicable) in order to verify that the performance capability of the component was not negatively impacted, and that potential degradation was monitored or prevented. Maintenance Rule information was reviewed to verify that the component was properly scoped, and that appropriate preventive maintenance was being performed to justify current Maintenance Rule status. Component walkdowns and interviews were conducted to verify that the installed configurations would support their design and licensing bases functions under accident conditions and had been maintained to be consistent with design assumptions.

Additionally, the team performed the following component-specific reviews:

• The team reviewed equipment specifications, voltage tap settings, short circuit and voltage drop calculations, circuit breaker interrupting ratings, and loading for the 6.9 kV-480V transformer and load center switchgear.

• The team reviewed the 6.9 kV-480V transformer protective relay trip settings to verify adequate transformer protection and appropriate coordination margins between upstream and downstream protective devices.

• The team reviewed the 6.9 kV switchgear incoming line breaker settings and coordination with emergency diesel generator breaker and load breakers.

• The team reviewed equipment specifications, short circuit and voltage drop calculations, circuit breaker close and latch and interrupting ratings, and loading for the 6.9 kV switchgear.

• The team observed MSSV lift setpoint verification testing that was performed during the inspection to verify test conditions were consistent with design assumptions.

• The team reviewed the sizing of the RWST vent paths to evaluate the potential effect of negative pressure on level instrumentation and pump net positive suction head.

The team also reviewed previous observations to verify that the vent paths have not been obstructed.

• The team reviewed the emergency core cooling systems (ECCS) flow balance surveillance test procedure to verify that the acceptance criteria met the technical specification limits for minimum and maximum flow.

• The team reviewed the licensees evaluation of NRC Information Notice (IN) 91-56 regarding the dose consequences associated with post-accident ECCS valve leakage to verify that valve testing was adequate.

• The team reviewed the design and testing of the control interlocks associated with the CSI pump alternate miniflow and alternate miniflow block valves to verify that they would perform their required function in the event of a postulated single failure.

• The team reviewed the dose consequences of ECCS leakage outside the reactor auxiliary building emergency exhaust system ventilation boundary to verify acceptability of the results.

• The team reviewed a UFSAR change and associated 10 Code of Federal Regulations (CFR) 50.59 screening related to the bypass of motor-operated valve thermal overload relay protection under accident conditions to determine if a 10 CFR 50.59 evaluation was required.

• The team reviewed operator actions associated with the transfer of the ECCS and containment spray system to cold leg recirculation mode during a postulated loss of coolant accident (LOCA) event. This review included verification of the identified time critical actions listed in administrative procedure AP-045 and the times assumed in design calculations. The team performed a tabletop review of EOP-ES-1.3 with operations personnel.

• The team reviewed operator actions associated with a postulated steam generator tube rupture event. This review included verification of the identified time critical actions listed in administrative procedure AP-045. The team performed a tabletop review of EOP-E-3 with operations personnel and reviewed recent crew response times.

• The team observed the calibration and testing of several fuel oil day tank level switches to verify that the methodology used was sufficient to support the switches performing their design and licensing bases functions

• The team reviewed industry correspondence concerning manufacturer recommendations for minimum EDG JW and LO standby temperatures to ensure the licensee had established appropriate administrative controls.

b. Findings

b.1 Failure to Establish Test That Verified Interlock Capability

Introduction:

The team identified a Green non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," for the licensees failure to establish a test program to assure that the interlocks between the CSI pump alternate miniflow block valves (1CS-745, 1CS-753) and the residual heat removal (RHR) to CSI pump piggyback valves (1RH-25, 1RH-63) would perform satisfactorily in service. This resulted in no method to determine the capability of the interlocks to perform their function in the event of a postulated single failure during an accident which could affect the high head safety injection function.

Description:

The team reviewed the design and testing associated with the CSI pump alternate miniflow valves (1CS-746, 1CS-752) and alternate miniflow block valves (1CS-745, 1CS-753). These valves are located in the flow paths from the CSI pumps discharge piping to the RWST. The CSI pump alternate miniflow valves (1CS-746, 1CS-752) are normally closed and receive signals to automatically open and close under accident conditions, depending on reactor coolant system pressure. The alternate miniflow block valves (1CS-745, 1CS-753), located downstream of the alternate miniflow valves, are normally open and are designed to be closed from the control room if the associated alternate miniflow valve fails to close during the transfer to ECCS cold leg recirculation. The design includes control system interlocks to assure that both CSI pump minimum flow paths to the RWST are isolated, by at least one of the valves in each line, prior to allowing either of the RHR to CSI pump piggyback valves (1RH-25, 1RH-63) to be opened by the operators. These interlocks are required to prevent a radiological release path from the ECCS to the RWST from being inadvertently established during post-accident, cold leg recirculation operation.

The team reviewed the periodic testing associated with these control system interlocks and determined that the interlocks between the alternate miniflow block valves (1CS-745, 1CS-753) and the RHR to CSI pump piggyback valves (1RH-25, 1RH-63) were not being fully tested. Specifically, there was no periodic testing to assure that the RHR to CSI pump piggyback valves could be opened if one of the alternate miniflow valves (1CS-746, 1CS-752) failed to close (due to a postulated single failure), and the operators were required to close the associated alternate miniflow block valve (1CS-745, 1CS-753)as directed by EOP-ES-1.3, Transfer to Cold Leg Recirculation. As discussed in Institute of Electrical and Electronic Engineers (IEEE) Standard 379-1977, a periodic test is defined as a test performed at scheduled intervals to detect failures and verify operability. Detectable failures are failures that will be identified through periodic testing or will be revealed by alarm or anomalous indication. Standard IEEE 379-1977 also states that, in the analysis of the effect of each single failure, all identified non-detectable failures shall be assumed to have occurred. IEEE 379-1977 is referenced in UFSAR Sections 8.1.4.3 and 8.3.1.2.28. Based on IEEE 379-1977, failure of the interlocks that were not being periodically tested would be considered non-detectable failures, and should be postulated in addition to the failure of one of the alternate miniflow valves to close. This postulated failure would result in the RHR to CSI pump piggyback valves (1RH-25, 1RH-63) failing to open and could cause a loss of CSI pump function.

In response to this issue, the licensee initiated nuclear condition report (NCR) 698720 and performed circuit testing of these control system interlocks during the inspection period to verify they remained operable. The licensee also verified that these interlocks had been subject to preoperational testing. The team reviewed the circuit testing performed by the licensee and determined it was adequate.

Analysis:

The licensees failure to establish a test program to assure that the interlocks between the CSI pump alternate miniflow block valves (1CS-745, 1CS-753) and the RHR to CSI pump piggyback valves (1RH-25, 1RH-63) would perform satisfactorily in service, as required by 10 CFR Part 50, Appendix B, Criterion XI, was a performance deficiency. The performance deficiency was determined to be more than minor because, it was associated with the mitigating systems cornerstone attribute of design control and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the lack of testing impacted the objective because there was no method to determine the capability of the interlocks to perform their function in the event of a postulated single failure during an accident which could affect the high head safety injection function. The team used NRC Inspection Manual Chapter (IMC) 0609, Att. 4, Initial Characterization of Findings, issued June 19, 2012, for Mitigating Systems, and IMC 0609, App. A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was a deficiency affecting the design or qualification of a mitigating structure, system, or component (SSC), and the SSC maintained its operability. The team determined that no cross-cutting aspect was applicable because the finding was not indicative of current licensee performance.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion XI, Test Control, required, in part, that a test program shall be established to assure that all testing required to demonstrate that SSCs will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Contrary to the above, since initial plant startup until July 19, 2014, the licensee failed to establish a test program to assure that the interlock between the CSI pump alternate miniflow block valves (1CS-745, 1CS-753) and the RHR to CSI pump piggyback valves (1RH-25, 1RH-63) would perform satisfactorily in service. Specifically, the permissive path was not being tested, nor was it included in any testing program. The licensees immediate corrective actions included performing interlock circuit testing to demonstrate the interlocks remained functional. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. The violation was entered into the licensees corrective action program as NCR 698720. (NCV 05000400/2014007-01, Failure to Establish Test That Verified Interlock Capability)

b.2 Failure to Establish Appropriate Procedural Limitations Based on Design Requirements of the Emergency Diesel Generators

Introduction:

The team identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to assure that applicable regulatory requirements in technical specification (TS) surveillance requirement (SR) 4.8.1.1.2.e.

were correctly translated into procedural guidance. Specifically, appropriate jacket water (JW) and lube oil (LO) standby temperature limitations, which ensured emergency diesel generator (EDG) capability to meet TS SR 4.8.1.1.2.e. requirements, were not translated into procedures for determining EDG operability.

Description:

Procedure OP-155, Diesel Generator Emergency Power System, was revised on December 30, 1991, to include administrative limits on minimum JW and LO temperatures (40°F and 70°F respectively), below which the EDG would be considered to be in an inoperable standby condition. Additionally, alarm response procedure APP-DGP-001, Diesel Generating Panels, contained the same guidance for declaring the EDGs inoperable. These limits were established based on a documented phone conversation between the licensee and a vendor representative; however, this documentation did not include a discussion that the EDG was able to satisfy the requirements of TS SR 4.8.1.1.2.e at the selected low temperatures. The requirements in TS SR 4.8.1.1.2.e. included the ability of the EDG to start (from a standby condition),and achieve voltage and frequency of 6900V +/- 690V, and 60Hz +/-1.2Hz (respectively)in less than or equal to 10 seconds after the start signal. During the inspection, the team questioned the EDGs ability to meet the TS SR requirements if JW and/or LO temperatures were allowed to reduce to the licensees procedurally established limits.

The licensee was unable to supply documentation of testing or analysis of EDG performance at the lower standby temperatures allowed by OP-155 and APP-DGP-001, which supported the ability of the EDGs to meet the requirements of TS SR 4.8.1.1.2.e.

System temperatures were reviewed for the past three years which showed that the JW and LO systems have not been less than 128°F. Although 128°F is less than the normal standby temperatures of 145-170°F for JW (UFSAR section 9.5.5) and 150°F for LO (UFSAR section 9.5.7), operability was assured at 128°F because a letter from the EDG vendor supported operability at LO temperatures of 120°F. Following identification by the team, the licensee generated NCR 698245 and on August 11, 2014, established administrative limits to ensure the EDG JW and LO temperatures were not allowed to drop below technically supportable limits.

Analysis:

The licensees failure to assure that applicable regulatory requirements in TS SR 4.8.1.1.2.e. were correctly translated into procedural guidance, as required by 10 CFR Part 50, Appendix B, Criterion III, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the mitigating systems cornerstone attribute of equipment performance and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the licensee did not ensure the capability and reliability of the EDGs to respond to a design basis accident at the JW or LO temperature conditions at which they considered the EDGs operable. The team used IMC 0609, Att. 4, Initial Characterization of Findings, issued June 19, 2012, for Mitigating Systems, and IMC 0609, App. A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was a deficiency affecting the design or qualification of a mitigating SSC, and the SSC maintained its operability. The team determined that no cross-cutting aspect was applicable because the finding was not indicative of current licensee performance.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, required, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into procedures and instructions. Contrary to the above, since OP-155 was revised on December 30, 1991, and APP-DGP-001 was revised on July 9, 1993, until August 11, 2014, the licensee failed to assure that applicable regulatory requirements were translated into specifications, procedures, or instructions. Specifically, appropriate JW and LO temperature limitations, which ensured EDG capability to meet TS SR 4.8.1.1.2.e.

requirements, were not translated into procedures for determining EDG operability. The licensees immediate corrective actions included establishing standing orders for operations, which provided guidance to prevent the EDG temperatures from dropping below 120°F. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. The violation was entered into the licensees corrective action program as NCR 698245. (NCV 05000400/2014007-02, Failure to Establish Appropriate Procedural Limitations Based on Design Requirements of the Emergency Diesel Generators)b.3 Failure to Establish Appropriate Procedural Limitations to Prevent Exceeding TS Limits and Safety Analysis Assumptions

Introduction:

The team identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to assure that applicable regulatory requirements in TS 3.7.1.1 and design basis inputs in accident analyses were translated into procedural guidance. Specifically, the licensee did not follow their inservice test (IST) program guidance to account for instrument uncertainty when establishing the acceptability of Main Steam Safety Valve (MSSV) lift setpoints required by TS 3.7.1.1.

Description:

During the inspection, the team noted that the licensee did not account for surveillance test equipment instrument uncertainties when determining surveillance test acceptance criteria specified in test procedures. Specifically, the licensee did not account for measurement and test equipment (M&TE) uncertainty when establishing the acceptability of MSSV lift setpoints required by TS 3.7.1.1. The licensee performed surveillance tests to demonstrate the MSSVs were operable using procedure EST-223, Insitu Main Steam Safety Valve Test Using Assist Device. The licensee considered the MSSVs to be operable when the nominal, as-measured, setpoint determined during performance of EST-223 was within the band allowed by TS Table 3.7-2, which was a band of plus or minus one percent of the specified setpoint for each MSSV. However, the acceptance criteria in EST-223 and the TS Table 3.7-2 values were the same as the nominal setpoints plus allowable tolerance used to perform safety analyses for UFSAR Chapter 15 events. No adjustment to the test acceptance criteria in EST-223 was performed to account for M&TE inaccuracy to prevent the lift setpoints from exceeding either the TS required lift setpoints or the assumed lift setpoints in safety analyses.

The team noted that the licensees controls over M&TE associated with the equipment used in EST-223 was contained in the licensees IST program and its governing procedures, namely, HNP-IST-003, HNP IST Program Plan-3rd Interval, Rev. 10; ISI-801, Inservice Testing of Valves, Rev. 70; and ISI-802, Inservice Testing of Pressure Relief Devices, Rev. 26. The IST program document, HNP-IST-003, section 4.4, Acceptance Criteria, stated in part, acceptance criteria established for IST are based on the American Society of Mechanical Engineers (ASME) Operation and Maintenance (OM) Code provisions or limits specified in technical specifications, FSAR, or other licensing basis, whichever are more conservative. Acceptance criteria derived from ranges or multiples of reference values in the OM Code shall be truncated, if necessary, to ensure limits specified in the licensing basis are not exceeded. The specific IST program requirements for valves were located in ISI-801, which stated in section 5.6.13, Instrumentation accuracy shall be considered when establishing valve test acceptance criteria. Further program requirements for safety valves were located in ISI-802, which stated in section 5.4, Set Pressure Measurement Accuracy-Test equipment, readability, and accuracy, inclusive of gages, transducers, load cells, assist devices, calibration standards, etc., used to determine valve set-pressure, shall have an overall combined accuracy not to exceed +/-1 percent of the indicated (measured) set-pressure. While the licensee established that they were keeping the overall accuracy within the limits of ISI-802, they did not consider this instrument accuracy when establishing the valve acceptance criteria in EST-223 as required by ISI-801, nor did they ensure limits in the licensing basis were not exceeded as required by HNP-IST-003. Following identification by the team, the licensee generated NCR 697100 and performed an evaluation of the remaining available margin to the overpressure limit in safety analysis, and discovered that, after potential instrument uncertainty was taken into account, the margin remained positive, but was reduced from approximately 19 psig to approximately 6 psig.

Analysis:

The licensees failure to assure that applicable regulatory requirements in TS 3.7.1.1 and design basis assumptions in accident analyses were correctly translated into procedural guidance, as required by 10 CFR Part 50, Appendix B, Criterion III, was a performance deficiency. The performance deficiency was determined to be more than minor because, if left uncorrected, it had the potential to lead to a more significant safety concern. Specifically, by not accounting for the M&TE uncertainties as required by the IST program, it could have led to the actual lift setpoints exceeding the inputs used in the design basis safety analyses. The team used IMC 0609, Att. 4, Initial Characterization of Findings, issued June 19, 2012, for Mitigating Systems, and IMC 0609, App. A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was a deficiency affecting the design or qualification of a mitigating SSC, and the SSC maintained its operability. The team determined that no cross-cutting aspect was applicable because the finding was not indicative of current licensee performance.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, required, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into procedures and instructions. Contrary to the above, since December 15, 1999, when the acceptance criteria were established, the licensee failed to assure that applicable regulatory requirements and the design basis were translated into specifications, procedures, or instructions. Specifically, appropriate procedural limits to account for M&TE instrument uncertainties associated with technical specification surveillance test equipment, were not translated into surveillance test procedures for determining compliance with TS limits and accident analysis assumptions. The licensees immediate corrective actions included performing an operability determination to ensure that there was enough available margin to the safety limit in the safety analysis to account for the M&TE uncertainties. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. The violation was entered into the licensees corrective action program as NCR 697100. (NCV 05000400/2014007-03, Failure to Establish Appropriate Procedural Limitations to Prevent Exceeding TS Limits and Safety Analysis Assumptions)

.3 Operating Experience

a. Inspection Scope

The team reviewed four operating experience issues for applicability at the Shearon Harris Nuclear Plant. The team performed an independent review of these issues and, where applicable, assessed the licensees evaluation and dispositioning of each item.

The issues that received a detailed review by the team included:

• NRC IN 1991-56, Potential Radioactive Leakage to Tank Vented to Atmosphere

• NRC IN 1991-85, Potential Failures of Thermostatic Control Valves for Diesel Generator Jacket Cooling Water,

• NRC IN 2006-24, Recent Operating Experience Associated With Pressurizer and Main Steam Safety/ Relief Valve Lift Setpoints

• NRC IN 2009-10, Transformer Failures-Recent Operating Experience

b. Findings

Inadequate Categorization of Valves in Potential Release Paths During Accidents

Introduction:

The team identified a Green NCV of 10 CFR 50.55a, Codes and Standards, for the licensees failure to categorize valves that were subject to a specific maximum leakage amount while in the closed position as Category A, as required by their ASME OM Code of record. Specifically, the team determined that the licensee failed to correctly categorize six valves that could allow ECCS leakage into the RWST above the water level during ECCS post-accident recirculation operation.

Description:

The team reviewed the licensees evaluation of NRC IN 1991-56, Potential Radioactive Leakage to Tank Vented to Atmosphere, as well as subsequent evaluations regarding post-accident leakage paths from the ECCS to the RWST. The IN addressed the potential radiological releases associated with leakage of isolation valves in the ECCS recirculation lines to the RWST, which is vented to the atmosphere, and addressed examples of licensees that had not classified these valves as Category A in their IST programs.

Engineering Service Request (ESR)94-296, dated April 1, 1996, addressed the concerns of this IN. The ESR concluded that the Category A leak testing of the ECCS isolation valves was not required because valve leakage would not significantly affect offsite dose. The team also reviewed engineering change 60881, revision 0, which was issued to control the implementation of a slight dose increase in the large break loss of coolant accident analysis of record. The Engineering Change addressed a total effective leakage allowance of 1.5 gpm from the ECCS to the RWST.

Based on these reviews, the team asked why these isolation valves, for which seat leakage is limited to a specific maximum amount, were not currently classified as Category A in the IST Program. In response, the licensee prepared calculation DPC-1227.00-00-0029, Variations on Post LOCA ESF Back-Leakage to the RWST at HNP, Revision 1, dated July 24, 2014. This calculation concluded that the maximum allowable leakage that could enter the RWST above the water level should be restricted to 0.63 gpm to meet NRC dose limits in 10 CFR 50.67. The limiting calculated dose was associated with the technical support center.

Based on the results of calculation DPC-1227.00-00-0029, the team determined that the isolation valves associated with the flow paths that entered the RWST above the water line were not correctly categorized. Valves 1CS-745, -746, -752, -753 and 1CT-47, -95 were subject to a specific maximum leakage amount while in the closed position and should have been subject to leakage testing. During the inspection period, the licensee generated NCR 699708, and performed an evaluation of the affected valves that verified the valves ability to meet leakage limits based on other monitoring that was in place.

Analysis:

The licensees failure to categorize valves that were subject to a specific maximum leakage amount while in the closed position as Category A, as required by their ASME OM Code of record, was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the SSC and barrier performance attribute of the Barrier Integrity cornerstone and adversely affected the cornerstone objective of providing reasonable assurance that physical design barriers protect the public from radionuclide releases caused by accidents or events. Specifically, the reliability of the physical design barrier of the leak-tightness of valves in the release paths was not assured since leak testing was not performed due to inaccurate categorization. The team used IMC 0609, Att. 4, Initial Characterization of Findings, issued June 19, 2012, for Barrier Integrity, and IMC 0609, App. A, The Significance Determination Process (SDP) for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding did not represent an actual open pathway in the physical integrity of reactor containment and did not involve an actual reduction in function of the hydrogen igniters in reactor containment. The team determined that no cross-cutting aspect was applicable because the finding was not indicative of current licensee performance.

Enforcement:

Title 10 CFR Part 50.55a, Codes and Standards, section (f)(4), required in part, that throughout the service life of a pressurized water-cooled nuclear power facility, valves which are classified as Class 1, 2, or 3, must meet the IST requirements set forth in the ASME OM Code. The licensees Code of Record, OM 2001 Edition, subsection ISTC-1300, Valve Categories, required that valves within the scope [of the licensees IST program] shall be placed in one or more of the following categories, which included Category A. The licensees ASME OM Code of record defined Category A valves as valves for which seat leakage is limited to a specific maximum amount in the closed position for fulfillment of their required function(s). Contrary to the above, since April 1996, when the valves were inappropriately categorized, the licensee failed to appropriately categorize the subject valves, and therefore did not meet the ASME OM Code requirements and 10 CFR 50.55a requirements. Specifically, failure to categorize the valves as Category A resulted in the valves not being subject to leakage testing.

The licensees immediate corrective actions included performing an operability determination that verified the valves ability to meet leakage limits based on other monitoring that was in place. This violation is being treated as an NCV consistent with section 2.3.2 of the Enforcement Policy. The violation was entered into the licensees corrective action program as NCR 699708. (NCV 05000400/2014007-04, Inadequate Categorization of Valves in Potential Release Paths During Accidents)

4OA6 Meetings, Including Exit

On July 25, 2014, the team presented the inspection results to Mr. Kapopulous and other members of the licensees staff. Additional inspection results were discussed with Mr. Grantham and other members of the licensees staff on August 14, 2014. The inspectors verified that no proprietary information was retained by the inspectors or documented in this report.

ATTACHMENT:

SUPPLEMENTARY INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

R. Duval, Electrical I&C Engineer

M. Grantham, Design Engineering Director

C. Jernigan, Operations

W. McGoun, Principal Engineer

A. Morisi, Principal Engineer

I. Nordby, Senior Licensing Engineer

W. Rogers, Inservice Testing Engineer

G. Wilson, Lead Licensing Engineer

NRC personnel

J. Austin, Senior Resident Inspector, Division of Reactor Projects, Harris Resident Office

K. Bucholtz, Technical Specifications Branch, Division of Safety Systems, NRR

A. Hon, Plant Licensing Branch II-2, Division of Operating Reactor Licensing, NRR

G. Hopper, Chief, Projects Branch 4, Division of Reactor Projects

P. Lessard, Resident Inspector, Division of Reactor Projects, Harris Resident Office

G. MacDonald, Senior Reactor Analyst, Division of Reactor Projects

LIST OF ITEMS OPENED, CLOSED, DISCUSSED, AND UPDATED

Opened and Closed

05000400/2014007-01

05000400/2014007-02

05000400/2014007-03

05000400/2014007-04

NCV

NCV

NCV

NCV Failure to Establish Test That Verified Interlock Capability [Section 1R21.2]

Failure to Establish Appropriate Procedural Limitations Based on Design Requirements of the Emergency Diesel Generators [Section 1R21.2]

Failure to Establish Appropriate Procedural Limitations to Prevent Exceeding TS Limits and Safety Analysis Assumptions [Section 1R21.2]

Inadequate Categorization of Valves in Potential Release Paths During Accidents

[Section 1R21.3]