IR 05000321/2015007

U. S. Nuclear Regulatory Commission Component Design Bases Inspection - Inspection Report 05000321/2015007 and 05000366/2015007

ML15341A320
Person / Time
Site:	Hatch
Issue date:	12/07/2015
From:	Bartley J NRC/RGN-II/DRS/EB1
To:	Vineyard D Southern Nuclear Operating Co
Linda K. Gruhler 404-997-4633
References
IR 2015007
Download: ML15341A320 (28)

Text

December 7, 2015

SUBJECT:

EDWIN I. HATCH NUCLEAR PLANT - U. S. NUCLEAR REGULATORY COMMISSION COMPONENT DESIGN BASES INSPECTION - INSPECTION REPORT 05000321/2015007 AND 05000366/2015007

Dear Mr. Vineyard:

On October 23, 2015, U. S. Nuclear Regulatory Commission (NRC) completed an inspection at your Edwin I. Hatch Nuclear Plant, Units 1 and 2, and discussed the results of this inspection with you and other members of your staff. The inspection team documented the results in the enclosed inspection report (IR).

The NRC inspectors documented five findings of very low safety significance (Green) in this report. These findings involved violations of NRC requirements. If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this IR with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region II; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Edwin I. Hatch Nuclear Plant.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region II; and the NRC resident inspector at the Edwin I. Hatch Nuclear Plant.

In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390, Public inspections, exemptions, requests for withholding, of the NRC's "Agency Rules of Practice and Procedure," a copy of this letter, its Enclosure, and your response if any, will be available electronically for public inspection in the NRC Public Document Room, or from the Publicly Available Records (PARS) component of NRC's Agencywide Documents Access and Management System (ADAMS); accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Jonathan H. Bartley, Chief Engineering Branch 1 Division of Reactor Safety

Docket Nos. 50-321 and 50-366 License Nos. DPR-57 and NPF-5

Enclosure:

NRC IR 05000321 and 05000366/2015007 w/Attachment: Supplementary Information

REGION II==

Docket Nos:

05000321 and 05000366

License Nos:

DPR-57 and NPF-5

Report Nos:

05000321/2015007 and 05000366/2015007

Licensee:

Southern Nuclear Operating Company, Inc.

Facility:

Edwin I. Hatch, Units 1 and 2

Location:

Baxley, GA 31513

Dates:

September 21 - October 23, 2015

Inspectors:

T. Fanelli, Senior Reactor Inspector (Lead)

M. Riley, Reactor Inspector

S. Herrick, Reactor Inspector

G. Nicely, Contractor (Electrical)

C. Baron, Contractor (Mechanical)

Approved by:

Jonathan H. Bartley, Chief

Engineering Branch 1

Division of Reactor Safety

SUMMARY

Inspection Report (IR) 05000321/2015007 and 05000366/2015007; 9/21/2015 - 10/23/2015;

Edwin I. Hatch Nuclear Plant, Unit 1 and 2; Component Design Bases Inspection

A team of three U.S. Nuclear Regulatory Commission (NRC) inspectors and two NRC contract personnel conducted this inspection. Five Green non-cited violations (NCVs) were identified.

The significance of inspection findings are indicated by their color (Green, White, Yellow, or Red) using the NRC Inspection Manual Chapter 0609, Significance Determination Process, dated April 29, 2015. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated February 4, 2015. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 5.

Cornerstone: Mitigating Systems

Green: The NRC identified a Non-cited Violation of 10 CFR Part 50, Appendix B, Criterion XI Test Control, for the failure to perform circuit breaker as-found electromechanical testing prior to inspecting, cleaning, and lubricating the mechanical components. The licensee planned to revise the test procedures to correct the deficiencies, and entered this violation into their Corrective Action Program as Condition Reports 10137545 and 10126677.

The performance deficiency was determined to be more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective, in that inadequate periodic testing to detect deterioration toward an unacceptable condition, the likelihood that these breakers could unpredictably fail when called upon increases with time in service. The finding was determined to be of very low safety significance (Green) because it was a deficiency affecting the design or qualification of a mitigating structure, system, or component (SSC), and the SSC maintained its operability or functionality. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance (Section 1R21.2.b.1).

Green: The NRC identified a Non-cited Violation of10 CFR Part 50, Appendix B, Criterion XVI,

Corrective Action, for the licensees failure to correct non-conformances with the acceptance limits established for the emergency diesel generator (EDG) test requirements. The licensee performed an operability evaluation, and determined the EDGs were operable based on successful completion of the required Technical Specification surveillance testing. In addition, the licensee planned to revise the EDG test procedures suitable for RG 1.9-1971 testing requirements, and entered this violation into their Corrective Action Program as Condition Report 10133018.

The performance deficiency was determined to be more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective, in that the failure to ensure that non-conformances with the acceptance limits were adequately incorporated into the EDG test procedures, which affected the reliability of the EDGs. The finding was determined to be of very low safety significance (Green) because the finding was a deficiency affecting the design or qualification of a mitigating structure, system, or component (SSC), and the SSC maintained its operability or functionality.

This finding has a cross-cutting aspect in the area of Problem Identification and Resolution (P.2)

because the licensee failed to thoroughly evaluate issues to ensure that resolutions address causes, and extent of conditions, commensurate with their safety significance (PI.2) (Section 1R21.2.b.2).

Green: The NRC identified a Non-cited Violation of 10 CFR Part 50, Appendix B, Criterion VII,

Control of Purchased Material, Equipment, and Services, for the licensees failure to ensure that adequate environmental test requirements were satisfied before relying on safety-related components to perform their intended safety functions. As an immediate corrective action, the licensee performed an operability evaluation and determined the components were operable. In addition, the licensee indicated that they planned to determine adequate corrective actions to restore full qualification of these commercial grade components, and entered this issue into their Corrective Action Program as Condition Report 10138133.

The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective, in that the licensee failed to verify the environmental qualification of safety-related components to ensure their performance up to the expected temperature of 150 degrees F. The finding was determined to be of very low safety significance (Green) because it was a deficiency affecting the design or qualification of a mitigating SSC, and the SSC maintained its operability or functionality. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance (Section 1R21.2.b.3).

Green: The NRC identified a Non-cited Violation of 10 CFR Part 50, Appendix B, Criterion III,

Design Control, for the licensees failure to evaluate if transients in control power voltage could affect the design basis margins for the timing of safety-related motor operated valves (MOVs).

The licensee planned to perform corrective actions to ensure that the safety analysis remains bounded, and entered this violation into their Corrective Action Program as Condition Report 10138053.

The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective, in that the failure to evaluate transients that effect the timing margins for NOVs affected the established reliability and capability of the valves. The finding was determined to be of very low safety significance (Green) because the deficiency did not result in actual loss of safety function. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance (Section 1R21.2.b.4).

Green: The NRC identified a Non-cited Violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, for the failure to classify components in accordance with Regulatory Guide 1.26 as specified by the Unit 2 Updated Final Safety Analysis Report, Section 3.2.2. As an immediate corrective action, the licensee performed an operability evaluation, and determined that the reactor core isolation cooling (RCIC) was operable.

In addition, the licensee planned to reclassify the relief valve as safety-related, and entered this issue into their Corrective Action Program as Condition Reports 10132353, 10136685, and 10141965.

The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone, and affected the cornerstone objective, in that inadequate classification of the relief valves affected the reliability of safety-related function of the RCIC system. The finding was determined to be of very low safety significance (Green) because it was a deficiency affecting the design or qualification of a mitigating SSC, and the SSC maintained its operability or functionality. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance (Section 1R21.2.b.5).

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

1R21 Component Design Bases Inspection

.1 Inspection Sample Selection Process

The team selected risk-significant components and related operator actions for review, using information contained in the licensees probabilistic risk assessment. In general, this included components and operator actions that had a risk achievement worth factor greater than 1.3, or Birnbaum value greater than 1 X10-6. The sample included 16 components and 8 operating experience items. Two of the components were associated with containment large early release frequency.

The team performed a margin assessment and a detailed review of the selected risk-significant components and associated operator actions, to verify that the design bases had been correctly implemented and maintained. Where possible, this margin was determined by the review of the design basis, and Updated Final Safety Analysis Report (UFSAR). This margin assessment also considered original design issues, margin reductions due to modifications, or margin reductions identified because of material condition issues. Equipment reliability issues were also considered in the selection of components for a detailed review. These reliability issues included items related to failed performance test results, significant corrective action, repeated maintenance, maintenance rule status, Inspection Manual Chapter (IMC) 0326 conditions, NRC resident inspector input regarding problem equipment, system health reports, industry operating experience (OE), and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, OE, and the available defense-in-depth margins. An overall summary of the reviews performed, and the specific inspection findings identified, are included in the following sections of the report.

.2 Component Reviews

a. Inspection Scope

Structures, Systems, or Components (SSCs)

• Ultimate Heat sink Dredging activities (Temperature Increase & Level)

• Unit 2 Residual Heat Removal (RHR) Service Water Pumps/Motors

• Unit 2 DC Switch Gear 2S016 and 2S017

• Unit 2 Reactor Protection System (RPS)

• Primary Containment and Reactor Pressure Valve (RPV) Isolation Control System

• Unit 2 RHR Service Water Heat Exchanger

• Unit 2 RHR/CS, HPCI and Reactor Core isolation Cooling (RCIC) Room Coolers

• Unit 1 and 2 RCIC Pump System Performance

• Unit 1 & 2 RCIC Pump System Logic

• Unit 2 600 Volt (600V) Bus D 2R23-S004

• Plant Electrical Overload Component Design

• Unit 2 Diesel 2A

• Unit 2 Diesel 2C Logic and Batteries

• Unit 2 4KV Bus E

Components with LERF Implications

• Unit 1 and 2 RCIC Pump System Performance

• Unit 1 & 2 RCIC Pump System Logic

For the components listed above, the team reviewed the plant technical specifications (TSs), UFSAR, design bases documents, and drawings to establish an overall understanding of the design bases of the components. Design calculations and procedures were reviewed to verify that the design and licensing bases had been appropriately translated into these documents. Test procedures and recent test results were reviewed against design bases documents, to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents, and that individual tests and analyses served to validate component operation under accident conditions.

Maintenance procedures were reviewed to ensure components were appropriately included in the licensees preventive maintenance (PM) program. System modifications, vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action program (CAP) documents were reviewed (as applicable),in order to verify that the performance capability of the component was not negatively impacted, and that potential degradation was monitored or prevented. Maintenance Rule information was reviewed to verify that the component was properly scoped, and that appropriate PM was being performed to justify current Maintenance Rule status.

Component walkdowns and interviews were conducted to verify that the installed configurations would support their design and licensing bases functions under accident conditions, and had been maintained to be consistent with design assumptions.

Additionally, the team performed the following specific reviews or evaluations:

• Intake structure hydrographic survey drawings and procedures for dredging the river and vacuuming the intake pit. This review included verification that the RHR service water pumps would be capable of performing their required functions during periods of low river water level.

• Design and licensing basis changes associated with increasing the maximum allowable river water temperature, and decreasing the minimum allowable river level for station operation. This review included the licensing change documentation, technical justification, and associated 10 CFR 50.59 reviews.

• The potential impact of with increasing the maximum allowable river water temperature on cooling the emergency diesel generators (EDGs). This review including the analysis of the diesel cooling water system with maximum cooling water temperature.

• The potential bypassing of primary containment through the RCIC system during post-accident conditions. This review included the control logic of the RCIC containment isolation valve, the potential release path through the RCIC barometric condenser relief valve, and associated emergency operating procedures.

• The safety classification and testing requirements of the RCIC barometric condenser relief valves. This review included a review of operation of the RCIC pump and associated lube oil cooler, without the barometric condenser available. The review also included the testing history of the installed barometric condenser relief valves.

• The stations response to 10 CFR Part 21 report; Potential for Test Induced Damage 0867F Series Main Steam Safety Relief Valves, dated June 30, 2015. This review included the stations previous and planned inspection, and testing of installed safety relief valves (SRVs) of this type.

• The stations interface and coordination with the transmission system operator for station voltages requiring plant notifications.

Protective relaying schemes to ensure that equipment is being adequately protected and operated within their specified ratings and capabilities.

b. Findings

b.1 Failure to Perform Adequate Circuit Breaker As-Found Testing

Introduction:

The NRC identified a Green Non-cited Violation (NCV) of 10 CFR Part 50, Appendix B, Criterion XI Test Control, for the failure to perform circuit breaker as-found electromechanical testing prior to inspecting, cleaning, and lubricating the mechanical components. The lack of as-found electromechanical testing could mask circuit breaker degradation that is significant in affecting the reliability and capability to perform its safety function, at the specified reduced voltages during a design basis event.

Description:

Plant Hatch was committed to Institute of Electrical and Electronics Engineers (IEEE) 308-1971, IEEE Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations per the Unit 2 UFSAR Sections 8.1.4.H.3.B and 8.3.1.2.1.B,and C. Standard IEEE 308-1971, Section 6.3 Periodic Equipment Tests, specified, in part, tests shall be performed at scheduled intervals to:

(1) Detect the deterioration of the system toward an unacceptable condition. According to the standard, these specifications required the testing of circuit breakers to determine deterioration toward an unacceptable condition while the circuit breakers are in their designed functional (electromechanical) configuration (as-found).

The team found that maintenance procedures 52PM-R22-004 for 4-kilovolt (4kV) circuit breakers and 52PM-MEL-030, -012 for 600V circuit breaker did not require performance of electromechanical as-found testing at the reduced voltages specified by the plant design basis prior to inspecting, cleaning, and lubrications of the breakers. The 4kV procedure performed electrical testing after the performance of mechanical maintenance. The 600V procedures performed only full-voltage testing after the performance of mechanical maintenance, not at the reduced voltages required by the licensees design. In addition, the circuit breaker overhaul procedures (52PM-R22-003 for 4kV, and 52PM-MEL-025 for 600V) could not be credited for adequate as-found testing. The 4kV procedure performed several operations of the breaker at full-voltage prior to performing reduced voltage testing. This could mask any deterioration of the circuit breakers that could be revealed at reduced voltages. The 600V procedure did not require reduced voltage testing prior to other maintenance because it stated, in part, that the performance sequence is at users discretion. As-found electromechanical functional testing under design basis conditions of circuit breakers is necessary to determine if the circuit breakers could have performed the specified safety functions, as credited in Plant Hatch electrical design basis calculations and safety analysis.

Analysis:

The failure to perform adequate as-found electromechanical testing to assure that the tested equipment was capable of performing its design function in accordance with IEEE 308-1971, Section 6.3, was a performance deficiency (PD). The PD was determined to be more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective, in that inadequate periodic testing to detect deterioration increases likelihood that these breakers could fail when called upon, which affected their reliability. The finding was assessed using IMC 0609, Attachment 4, Initial Characterization of Findings, issued June 19, 2012, for Mitigating Systems, and IMC 0612, Appendix A, The Significance Determination Process for Findings At-Power, issued June 19, 2012, and determined to be of very low safety significance (Green),because it was a deficiency affecting the design or qualification of a SSC, and the SSC maintained its operability or functionality. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion XI, Test Control, requires, in part, A test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. The Hatch Unit 2 UFSAR, Sections 8.1.4.H.3.B and 8.3.1.2.1.B and C stated the licensee would conform to Standard IEEE 308-1971. Standard IEEE 308-1971, Section 6.3 Periodic Equipment Tests, specified, in part, tests shall be performed at scheduled intervals to:

(1) Detect the deterioration of the system toward an unacceptable condition. Contrary to the above, since October 2011, the licensee failed to assure that all testing required to demonstrate that SSCs would perform satisfactorily in service, was identified and performed in accordance with written test procedures, which incorporate the requirements and acceptance limits contained in IEEE 308-1971, the applicable design document. The licensee failed to demonstrate that circuit breakers could satisfactorily perform electromechanically in service with the established requirements, and acceptance limits of the plant design basis. The licensee planned to revise the test procedures to correct the deficiencies. Because this violation was of very low safety significance (Green) and was entered into the licensees CAP as Condition Reports (CRs) 10137545 and 10126677, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC

Enforcement.

This violation is identified as05000366/2015007-01, Failure to Perform Adequate Circuit Breaker As-Found Testing.

b.2 Failure to Correct Non-conformances with Regulatory Guide 1.9-1971

Introduction:

The NRC identified a Green NCV of10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, for the licensees failure to correct non-conformances with the acceptance limits established for the EDG test requirements. Specifically, after the licensee identified non-conformances with Regulatory Guide (RG) 1.9-1971, they failed to incorporate suitable acceptance limits, as established by the RG, into the EDG test procedures.

Description:

Hatch Unit 2 UFSAR Chapter 8.3.1.2 committed the licensee to conformance with RG 1.9-1971. The RG 1.9-1971 described an acceptable basis for the selection of diesel generator sets of sufficient capacity and margin to implement General Design Criterion (GDC) 17. Regulatory position C.4 of RG 1.9-1971, specified At no time during the loading sequence should the frequency and voltage decrease to less

than 95 percent of nominal and 75 percent of nominal respectively. Voltage should be restored to within 10 percent of nominal and frequency should be restored to within 2 percent of nominal in less than 40 percent of each load sequence time interval.

The licensee identified non-conformances related to EDG performance testing and RG 1.9-1971 testing specifications in October 2014, and documented them in CR 880596.

The licensee documented that during a surveillance test the 1A EDG frequency decreased below the frequency acceptance limit established in RG 1.9, because of starting the RHR pump 1A. As a result, the licensee performed an immediate operability determination, and concluded that the diesel was operable because the required Tech Spec surveillance testing continues to have successful results indicating that the presumption of operability is not in question given the information available. The CR was closed to corrective action report (CAR) 213128, which was completed and established the need for a more detailed review by System Engineering.

In January 2015, CR 10010974 documented, in part, that the EDG Logic System Functional Tests (LSFTs) should be revised to require recorded minimum voltage and frequency to be following loading of large pump motors and ensure that the frequency and voltage do not decrease to less than 95 percent and 75 percent respectively of the steady state voltage and frequency just prior to the perturbation. This CR was closed to CAR 249422, which established that the procedure writers would update the affected procedures. The licensee issued technical evaluation (TE) 910919 in February 2015 for system engineering to provide markups of the procedures under revision, and the procedures were revised by June 2015. The team reviewed the revised test procedures, 42SV-R43-021-1, 42SV-R43-024-1, 42SV-R43-027-1, 42SV-R43-008-2, 42SV-R43-012-2, and 42SV-R43-016-2. These procedures specified the acceptance limits for the EDG Loss of Coolant Accident/Loss of Off Site Power (LOCA/LOSP) LSFTs. The team determined that the procedures did not conform to the RG 1.9 performance specifications associated with each loading step, nor contain specifications to ensure that voltage was restored to within 10 percent of nominal, and frequency was restored to within 2 percent of nominal in less than 40 percent of each load sequence time interval.

During the licensees corrective actions, no hold was placed on the LOCA/LOSP LSFT procedures, and in March of 2015, the tests were performed with the procedures that they had previously identified as non-conforming in 2014. The team evaluated the data from these tests, and could not determine that the non-conforming transient frequency responses identified in CR 880596 were resolved. The licensee accepted the condition as being operable but non-conforming. The team determined that the completed corrective actions failed to meet 10 CFR Part 50, Appendix B, Criterion XVI because they had several opportunities to correct the non-conformance with RG 1.9 as documented in their CAP.

Analysis:

Failure to correct conditions adverse to quality was a PD. Specifically, in 2014 and 2015, licensee personnel identified non-conformances with RG 1.9 in the CAP as CRs 880596, 213128, 10010974, 249422, and TE 910919, but failed to correct the non-conformances. The PD was determined to be more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective, in that failure to ensure that non-conformances with the acceptance limits established in RG 1.9-1971 were adequately incorporated into the EDG test procedures, affected the reliability of the EDGs to perform their function when called upon. Using IMC 0609, Attachment 4, Initial Characterization of Findings, issued June 19, 2012, for Mitigating Systems, and IMC 0612, Appendix A, The Significance Determination Process for Findings At-Power, issued June 19, 2012, the finding was determined to be of very low safety significance (Green) because the finding was a deficiency affecting the design or qualification of a mitigating SSC, and the SSC maintained its operability or functionality. This finding has a cross-cutting aspect in the area of Problem Identification and Resolution P.2, because Hatch failed to thoroughly evaluate issues to ensure that resolutions address causes, and extent of conditions, commensurate with their safety significance (PI.2).

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Actions, required, in part, that measures shall be established to assure that conditions adverse to quality, such as non-conformances are promptly identified and corrected. The Plant Hatch Unit 2 UFSAR Chapter 8.3.1.2 committed Hatch to conformance with RG 1.9-1971. The RG, 1.9-1971, described an acceptable basis for the selection of diesel generator sets of sufficient capacity and margin to implement GDC-17. Contrary to the above, since March 2015, the licensee failed to correct non-conformances with the acceptance limits established in RG 1.9-1971. The licensee performed an operability evaluation, and determined the EDGs were operable based on successful completion of the required TS surveillance testing. In addition, the licensee planned to revise the EDG test procedures suitable for RG 1.9-1971 testing requirements. This violation is being treated as an NCV consistent with Section 2.3.2 of the Enforcement Policy. Because this violation was of very low safety significance (Green) and was entered into the licensees CAP as CR 10133018, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy. This violation is identified as NCV 05000366/2015007-02, Failure to Correct Non-conformances with Regulatory Guide 1.9-1971.

b.3 Failure to Assure that Class 1E Components were Qualified for Design Temperatures

Introduction:

The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion VII, Control of Purchased Material, Equipment, and Services, for the licensees failure to ensure that adequate environmental test requirements were satisfied before relying on safety related components to perform their intended safety functions.

Description:

In January 2014 and March 2015, the licensee approved changes to install new pan assemblies comprised of commercial components into the safety-related motor control centers (MCCs) located in the Unit 1 and Unit 2 diesel building and intake structures, respectively. The licensee considered these areas as mild environments.

These new MCC pan assemblies were constructed, dedicated, and qualified by Nuclear Logistics Inc. (NLI) using commercial components. This was documented in the NLI qualification report (QR-05815030-1, NLI Replacement Allis Chalmers Value Line Mark 1 MCC Starter and Breaker Pan Assemblies and Overload Relays, Rev. 1). The report indicated that the pan assemblies were qualified up to temperatures of 106 degrees F.

The commercial design of the components used in these assemblies limited their functional capability to environments up to 104 degrees F. The team noted that licensee specification to NLI (HE-S-06-001, Specification for MCC Starter and Breaker Pan Assemblies, Version 4.0), indicated that the maximum external ambient temperature was 105 degrees F and that the internal assembly temperature was expected to be 18 degrees F higher, resulting in a normal service temperature of 123 degrees F.

Additionally, Calculation MC-H-12-0101, Maximum Allowable AC Motor Starter Control Circuit Lengths, Version 1.0, indicated that the minimum verified voltage to the A200 motor starters was 95 Volts of alternating current (Vac) at 123 degrees F. Eaton commercially designed the A200 motor starter with a functional capability with a minimum voltage of 102Vac at 104 degrees F. Due to the teams questions, the licensee determined that NLI did not meet the qualification criteria established in purchase documents. The licensee entered this issue into their CAP as CR 10138133.

Further, the licensee determined that their established acceptance criteria in HE-S-06-001 was incorrect because the maximum temperature in the mild environments was 132 degrees F externally not 106 degrees F, which corresponded to 150 degrees F internally, not 123 degrees F. The team determined that the licensee failed to ensure that testing requirements were satisfied before relying on the items to perform their intended safety functions. The team noted that commercial manufacturers could change the critical characteristics associated with their components over time. For this reason, each purchased lot of commercial grade components must be tested, and evaluated, to be capable of performing their intended safety function.

The licensee noted that several of the components used in the NLI pan assemblies in

~1991 were previously qualified for harsher environments than those in the diesel building and intake structure. Based on this, there was reasonable assurance for operability that these components could perform their intended safety-related function up to the required 150 degrees F temperature.

Analysis:

The team determined that the licensees failure to ensure that adequate environmental test requirements were satisfied before relying on safety-related components to perform their intended safety functions, was a PD. The team determined the PD to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective of ensuring the reliability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to verify the environmental qualification of safety-related components to ensure their performance up to the expected temperature of 150 degrees F, which effected their reliability in those environments. The team used IMC 0609, Attachment 4, Initial Characterization of Findings, issued June 19, 2012, for Mitigating Systems, and IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green) because the finding was a deficiency affecting the design or qualification of a mitigating structure, SSC, and the SSC maintained its operability or functionality. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion VII, Control of Purchased Material, Equipment, and Services, required, in part, that measures be established to assure that purchased material, equipment, and services, whether purchased directly or through contractors and subcontractors, conform to the procurement documents.

Contrary to the above, since December 2011, the licensee failed to assure that the MCC electrical components installed in the Unit 1 and Unit 2 diesel building, and intake structures, conformed to the procurement documents specifications in HE-S-06-001.

The licensee performed an operability evaluation and determined the components were operable, because some of the commercial components used in the NLI pan assemblies were, at one time, qualified for harsher environments than those environments in the diesel building and intake structure; therefore, there was reasonable assurance that these components could perform their intended safety-related function. In addition, the licensee indicated that they planned to determine adequate corrective actions to restore full qualification of these commercial grade components. Because this violation was of very low safety significance (Green) and was entered into the licensees CAP as CR 10138133, this violation is being treated as an NCV consistent with Section 2.3.2 of the Enforcement Policy. This violation is identified as NCV 05000321/2015007-03 and 05000366/2015007-03, Failure to Assure that Class 1E Components Were Qualified for Design Temperatures.

b.4 Failure to Verify Design Basis Timing Margins for Safety Related Motor Operated Valves

Introduction:

The NRC identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to evaluate if transients in control power voltage could affect the design basis margins for the timing of safety-related motor operated valves (MOVs).

Description:

The team assessed the margin requirements established for the Hatch RPS including emergency core cooling system (ECCS). The Hatch Unit 1 UFSAR Chapter 7.4, Emergency Core Cooling System Control and Instrumentation, Subsection 7.4.1 Safety Objective, stated, in part, the ECCS network conforms to the IEEE Proposed Criteria for Nuclear Power Plants Protection Systems (IEEE 279). In case of conflict, IEEE 279 prevails. The Unit 2 UFSAR Chapter 7.2 Emergency Core Cooling System, Subsection 7.3.1.1 Design Bases, stated, in part, The instrumentation and control meets the requirements of IEEE 279-1971. Standard IEEE 279-1971 Section 3, Design Basis, required that the protection system design basis shall be provided [and] shall be available, as needed, for making judgments on system functional adequacy. The design basis shall document the margin with appropriate interpretive information between each operational limit considered to mark the onset of unsafe conditions; the range of transient and steady-state conditions of both the energy supply and the environment (for example, voltage, frequency, temperature, humidity, pressure, vibration, etc.) during normal, abnormal, and accident circumstances throughout which the system must perform. This requirement included the documented timing margins established in the safety analysis for the operation of MOVs that must actuate automatically during design basis events.

The team identified that the licensee failed to evaluate if safety-related MOVs, during power system transients (offsite or onsite), would have adequate control voltage to the MOV contactors to operate within the established time designated by the safety analysis.

Electrical calculations, MC-H-12-0101 and BH2-E-0037, used steady-state post-event MCC voltages to evaluate the most limiting voltage drop on the control circuits. The use of steady-state voltages instead of transient voltages would predict higher control circuit voltages than would actually exist during transients. As a result, the control circuit contactor might not energize until after the voltage recovered from the perturbations of the upstream 4.16 kV loads. This delay would have the potential to effect the safety analysis assumptions for valve stroke timing. Many of the MOVs at Hatch start on permissive logic independent of, or in addition to, the safety injection (SI) signal, such as pressure or water level. The team evaluated two different scenarios. The first being an accident using offsite power where the resulting SI loading block starts four reactor heat removal pump motors, and two core spray pump motors simultaneously resulting in a voltage transient below steady-state for up to 8 seconds. The safety analysis assumptions did not consider an 8-second delay in valve movement because of potentially inadequate control voltage. The second scenario, an accident using onsite power when sequencing the large 4kV motors onto the emergency diesel generator.

Some MOVs can get an actuation signal at the same time as some of the 4kV loads. In this case, the MOV contactor may not pickup, or if already actuated, the 4kV voltage dip may pull down the voltage enough to drop out the contactor until the voltage recovers.

In either of these two scenarios, the safety analysis assumptions did not consider delays in valve movement because of potentially inadequate control voltage. The team determined that the licensee failed to perform an analysis to verify that the safety analysis assumptions for MOV timing remained valid during the range of transient conditions of both the energy supply and the environment throughout which the system must perform, and that their established margins were maintained. The team reviewed the safety analysis and determined that adequate margin remained for a reasonable assurance that the system safety function could be met.

Analysis:

The failure to provide documented design basis margins appropriate for the range of transient conditions throughout which the protection system must perform was a PD. The PD was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone, and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the failure to evaluate transients that effect the timing margins for MOVs affected the established reliability and capability of the valves to mitigate the consequences of an accident. The finding was screened in accordance with NRC IMC 0609, Significance Determination Process, dated April 29, 2015, Appendix A, The Significance Determination Process for Findings At-Power, dated June 19, 2012. Using IMC 0609, Appendix A, Exhibit 2, Mitigating Systems Screening Questions, the finding screened to green, because the deficiency did not result in actual loss of safety function.

This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, required, in part, that design control measures provide for verifying or checking the adequacy of design. The Hatch Unit 1 UFSAR Chapter 7.4, Emergency Core Cooling System Control and Instrumentation, Subsection 7.4.1 Safety Objective, stated, in part, the ECCS network conforms to the IEEE Proposed Criteria for Nuclear Power Plants Protection Systems (IEEE 279). In case of conflict, IEEE 279 prevails. The Unit 2 UFSAR Chapter 7.2 Emergency Core Cooling System, Subsection 7.3.1.1 Design Bases, stated, in part, The instrumentation and control meets the requirements of IEEE 279-1971. Contrary to the above, since October 2012, the licensees design control measures failed to verify conformance to IEEE 279-1971 for adequate design margins effecting safety-related MOV timing that is required to mitigate accidents. The licensee planned to perform corrective actions to ensure that the safety analysis remains bounded. Because the finding was of very low safety significance (Green) and was entered into the licensees CAP as CR 10138053, this violation is being treated as an NCV consistent with Section 2.3.2 of the NRC enforcement policy. This violation is identified as NCV 05000321/2015007-04 and 366/2015007-04, Failure to Verify Design Basis Timing Margins for Safety Related Motor Operated Valves.

b.5 Failure to Classify Reactor Core isolation Cooling Sub-components as Safety-Related

Introduction:

The NRC Identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the failure to classify components in accordance with RG 1.26, as specified by the Unit 2 UFSAR Section 3.2.2. The licensee classified the RCIC system as safety-related, but did not assign the appropriate safety-related quality classification to the Unit 2 RCIC barometric condenser relief valve.

Description:

The Hatch Unit 2 UFSAR Section 3.2.2, System Quality Group Classifications, stated, in part, that system quality group classifications, as defined in RG 1.26 (September 1974), were determined for each water, steam, or radioactive waste containing component of those applicable fluid systems relied upon to provide safe shutdown capability of the reactor and maintain it in a safe shutdown. The RG, 1.26, described a method for determining acceptable quality standards for the remaining safety-related components containing radioactive material, water, or steam, (i.e., quality Group B, C, and D components). The RGs regulatory position C.2 stated, in part, the group C quality standards should be applied to water-, steam-, and radioactive-waste-containing pressure vessels, heat exchangers (other than turbines and condensers),storage tanks, piping, pumps, and valves not part of the reactor coolant pressure boundary or included in quality Group B, but part of cooling water and auxiliary feedwater systems or portions of these systems important to safety that are designed for (1)emergency core cooling,

(2) postaccident containment heat removal,

(3) postaccident containment atmosphere cleanup, or

(4) RHR from the reactor and from the spent fuel storage pool (including primary and secondary cooling systems).

According to the UFSAR, Section 7.4.1, the RCIC system provides core cooling during reactor shutdown upon a loss of flow from the main feed system, and was classified as safety-related. The RCIC system was designed to pump makeup water from either of the condensate storage tank, or the suppression pool, into the reactor pressure vessel (RPV). The RCIC systems must be activated in time to preclude conditions, which lead to inadequate core cooling. The licensees UFSAR, Chapter 17, also listed the RCIC system as a safe shutdown system.

The licensee classified the RCIC barometric condenser and associated components as nonsafety-related, even though these components may be required to support the RCIC system safety-related function. The team reviewed the barometric condenser components and determined that the barometric condenser relief valve should have been classified as safety-related. The barometric condenser relief valve was primarily designed to provide overpressure protection. The licensee credited relief valve to provide an alternate flow path for the lube oil cooling water exhaust if the condensate pump was not available. If the relief valve failed to open, this alternate flow path for the lube oil cooling water exhaust would not be available. Due to the teams questions, the licensee determined that the relief valve should have been classified a safety-related component.

Being classified as nonsafety-related, the PM for the U2 relief valve did not receive the same quality control as other safety-related components. As a result, two PMs were missed for the Unit 2 relief valve. These relief valves were scheduled to be tested on a 4-year PM (2E51F0181) frequency. The licensee suspected that the missed job plan for

2E51F0181 went unnoticed due to a transition between work control software. The team determined that this oversight was a result of the non-safety quality classification of the valves.

Analysis:

The licensees failure to adequately classify the RCIC barometric condenser relief valves as safety-related based on their supporting safety function, in accordance with RG 1.26 as specified by the UFSAR Section 3.2.2, was a PD. The PD was more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone, and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the inadequate classification of the relief valves affected the reliability of safety-related function of the RCIC system. The team used IMC 0609, Attachment 4, Initial Characterization of Findings, issued June 19, 2012, for Mitigating Systems, and IMC 0612, Appendix A, The Significance Determination Process for Findings At-Power, issued June 19, 2012, and determined the finding to be of very low safety significance (Green), because the finding was a deficiency affecting the design or qualification of a mitigating SSC, and the SSC maintained its operability or functionality. This finding was not assigned a cross-cutting aspect because the issue did not reflect current licensee performance.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, required, in part, that design control measures shall provide for verifying or checking the adequacy of design. The Hatch Unit 2 UFSAR Section 3.2.2, System Quality Group Classifications, stated, in part, that system quality group classifications, as defined in RG 1.26 (September 1974), were determined for each water, steam, or radioactive waste containing component of those applicable fluid systems relied upon to provide safe shutdown capability of the reactor, and maintain it in a safe shutdown. Contrary to the above, since the operating license was issued on June 13, 1978, the licensee failed to establish design control measures to provide for verifying or checking the adequacy of design. Specifically, the licensee failed to classify the barometric condenser relief valves in accordance with RG 1.26. The licensee determined RCIC was operable based on the U2 relief valve PM test results in 2000 and 2005, and also the historical testing results of other U1 and U2 RCIC relief valves installed in similar operating conditions and environments. In addition, the licensee planned to reclassify the relief valve as safety-related. Because this violation was of very low safety significance (Green), and was entered into the licensees CAP as CR 10132353, CR 10136685, and CR 10141965, this violation is being treated as a NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy. This violation is identified as NCV 05000366/2015007-05, Failure to Classify RCIC Sub-components as Safety-Related.

.3 Operating Experience

a. Inspection Scope

The team reviewed five operating experience issues for applicability at the Edwin I.

Hatch Nuclear Plant. The team performed an independent review for these issues, and where applicable, assessed the licensees evaluation and dispositioning of each item.

The issues that received a detailed review by the team included:

• Bulletin 88-4, Potential Safety-Related Pump Loss

• IN 2012-06, Ineffective Use of Vendor Technical Recommendations

• RIS 2011-12 R1, Adequacy of Station Electric Distribution System Voltages

• IN 92-53 Potential Failure of Emergency Diesel Generators Due to Excessive

Rate of Loading

• IN 88-04, Potential Safety-Related Pump Loss, dated 7/11/1988

• IN 89-08 Pump Damage Caused by Low-Flow Operation

• IN 90-61 Potential for RHR Pump Damage Caused by Parallel Pump Interaction

• 10 CRF Part 21 Report, Potential for Test Induced Damage 0867F Series Main

Steam Safety Relief Valves, June 30, 2015

b. Findings

No findings were identified.

4OA6 Meetings, Including Exit

On October 23, 2015, the team presented the inspection results to Mr. David R.

Vineyard and other members of the licensees staff. The inspectors verified that they retained no proprietary information before exiting the site.

ATTACHMENT:

SUPPLEMENTARY INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

A. Giancatarino, Engineering Director

B. Anderson, Health Physics Manager

B. Wainwright, Operations Training Manager

C. Vonier, Shift Operations Manager

D. Vineyard, Vice President

G. Johnson, Regulatory Affairs Manager

J. Collins, Principal Licensing Supervisor

J. Rathod, Site Projects Manager

K. Long, Work Management Director

M. Torrance, Design Manager

M. Torrance, Nuclear Oversight Manager

T. Lynn, Engineering Supervisor

T. Spring, Plant Manager

NRC personnel

J. Bartley, Branch Chief, Engineering Branch 1

LIST OF ITEMS OPENED, CLOSED, DISCUSSED, AND UPDATED

Opened and Closed

05000366/2015007-01 NCV Failure to Perform Adequate Circuit Breaker As-Found Testing

05000366/2015007-02 NCV Failure to Correct Nonconformances with Regulatory Guide 1.9-1971

05000321 & 366/2015007-03 NCV Failure to Assure that Class 1E Components were Qualified for Design Temperatures

05000321 & 366/2015007-04 NCV Failure to Verify Design Basis Timing Margins for Safety Related Motor Operated Valves

05000366/2015007-05 NCV Failure to Classify RCIC Sub-components as Safety-Related