IR 05000280/2009004

IR 05000280-09-004 and 05000281-09-004; 07/01/2009 - 09/30/2009; Surry Power Station, Units 1 and 2; Fire Protection, Operability Evaluations, Plant Modifications, Post Maintenance Testing, Identification and Resolution of Problems

ML093020726
Person / Time
Site:	Surry
Issue date:	10/29/2009
From:	Gerald Mccoy NRC/RGN-II/DRP/RPB5
To:	Heacock D Virginia Electric & Power Co (VEPCO)
References
IR-09-004
Download: ML093020726 (38)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION

REGION II

ber 29, 2009

SUBJECT:

SURRY POWER STATION - NRC RESIDENT INSPECTION REPORT 05000280/2009004 and 05000281/2009004

Dear Mr. Heacock:

On September 30, 2009, the United States Nuclear Regulatory Commission (NRC) completed an inspection at your Surry Power Station, Units 1 and 2. The enclosed inspection report documents the inspection results, which were discussed on October 20, 2009, with Mr. Bischof and other members of your staff.

The inspection examined activities conducted under your licenses as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your licenses. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

The report documents six NRC identified findings and one self-revealing finding of very low safety significance (Green). Six of the findings were determined to involve a violation of NRC requirements. Additionally, one licensee-identified violation which was determined to be of very low safety significance is listed in this report. However, because of the very low safety significance and because they are entered into your corrective action program, the NRC is treating these findings as non-cited violations (NCVs) consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest any NCV, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Surry Power Station.

In addition, if you disagree with the characterization of any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region II; and the NRC Resident Inspector at the Surry Power Station. The information you provide will be considered in accordance with Inspection Manual Chapter 0305.

VEPCO 2 In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRCs document system (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Gerald J. McCoy, Chief Reactor Projects Branch 5 Division of Reactor Projects Docket Nos.: 50-280, 50-281 License Nos.: DPR-32, DPR-37

Enclosure:

Inspection Report 05000280/2009004 and 05000281/2009004 w/Attachment: Supplemental Information

REGION II==

Docket Nos.: 50-280, 50-281 License Nos.: DPR-32, DPR-37 Report No: 05000280/2009004 and 05000281/2009004 Licensee: Virginia Electric and Power Company (VEPCO)

Facility: Surry Power Station, Units 1 and 2 Location: 5850 Hog Island Road Surry, VA 23883 Dates: July 1, 2009 through September 30, 2009 Inspectors: C. Welch, Senior Resident Inspector J. Nadel, Resident Inspector D. Arnett, Project Engineer Approved by: Gerald J. McCoy, Chief Reactor Projects Branch 5 Division of Reactor Projects Enclosure

SUMMARY OF FINDINGS

IR 05000280/2009-004 and 05000281/2009-004; 07/01/2009 - 09/30/2009; Surry Power

Station, Units 1 and 2; Fire Protection, Operability Evaluations, Plant Modifications, Post Maintenance Testing, Identification and Resolution of Problems.

The report covered a 3- month period of inspection by resident inspectors. Seven Green findings, six of which were non-cited violations (NCVs), were identified. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP). The cross-cutting aspect was determined using IMC 0305, Operating Reactor Assessment Program. Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The inspectors identified a Green NCV of the Surry operating license, section 3.I Fire Protection, for an inadequate procedure that resulted in compensatory continuous fire watches in MERs #3 and #4 being inadequate (CR 342078).

This finding is greater than minor because it is associated with the reactor safety mitigating systems cornerstone attribute to provide protection against external events and adversely affects the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors used Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, to analyze this finding because the condition had an adverse affect on the Fixed Fire Protection Systems element of fire watches posted as a compensatory measure for fixed fire protection system outages or degradations. A low degradation rating was assigned to this finding as the provision affected by this finding (i.e. fire watches) is expected to display nearly the same level of effectiveness and reliability. Using Manual Chapter 0609,

Appendix F, this finding was determined to be of very low safety significance (Green). A cross-cutting element was not assigned to this finding because the most significant contributor to the performance deficiency is not reflective of current performance. (Section 1R05)

Green.

The inspectors identified a Green finding for the incorrect operability determination for emergency service water pump 1-SW-P-1B on August 1, 2009, after vibrations had increased 391% in the vertical plane (CR 343396). A violation of regulatory requirements was not identified. The pump, declared inoperable on August 2, was replaced within the Technical Specification allowed outage time.

The finding is more than minor because if left uncorrected the performance deficiency could potentially lead to more significant safety concerns. The finding is associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding, evaluated per MC-0609,

Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, was determined to be of very low safety significance (Green) because it did not result in a loss of safety function or the loss of a single train of ESW for greater than the allowed outage time. This finding has a cross-cutting aspect in the area of human performance, decision making, because the licensee failed to use conservative assumptions in their operability decision for 1-SW-P-1B (H.1.b). (Section 1R15)

Green.

The inspectors identified a Green NCV of 10 CFR 50, Appendix B, Criterion III, Design Control. The design change for the emergency service water pumps (DC-SU-08-0001) was not adequate to protect the diesel-driven emergency service water pumps from damage resulting from a tornado missile as required by the UFSAR (CRs 337720, 337337, 341557). Pending resolution, interim compensatory measures have been established to provide assurance the pumps will be capable of performing their safety function.

The finding, associated with the design control attribute of the mitigating systems cornerstone, is more than minor because it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding, evaluated per MC-0609, Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations, was determined to be of very low safety significance (Green) because of the extremely low initiating event frequency for a tornado. A phase III risk analysis was performed because the finding screened potentially risk significant for a severe weather initiating event. This finding has a cross-cutting aspect in the area of human performance, resources, because the licensees design documentation for DC SU-08-0001 and ET-S-08-0032 was not complete and accurate which led to the installation of inadequate modifications on ESWPs 1-SW-P-1A/1B/1C (H.2.c). (Section 1R18)

Green.

A self-revealing Green NCV of Technical Specification 6.4, Unit Operating Procedures and Programs; was identified for the failure to provide adequate work instructions for maintenance on 1-SW-P-1B, a safety-related component, which led to the failure of the pumps packing gland on August 26, 2009 and required the pump be removed from service and repacked (CR 346268).

The finding is associated with the equipment performance attribute of the mitigating systems cornerstone and is more than minor because it adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding, evaluated per MC-0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, was determined to be of very low safety significance (Green) because it did not result in a loss of safety function or loss of a singe train of ESW for more than its allowed outage time. This finding has a cross-cutting aspect in the area of human performance, resources, in that a complete and accurate procedure was not available to assure nuclear safety during replacement of 1-SW-P-1B (H.2.c). (Section 1R19)

Green.

A Green NCV of 10 CFR 50, Appendix B, Criterion XVI, Corrective Action, was identified by the inspectors for failure to promptly identify and correct a condition adverse to quality related to a ground on emergency safety bus 1H. This resulted in the degraded condition being allowed to exist for 72 days prior to de-energizing the containment recirculation fan and correcting the adverse condition (CR 336041).

This finding is more than minor because it adversely impacted the equipment performance attribute of the reactor safety mitigating system cornerstone and its objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding, evaluated per MC-0609, Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations, was determined to be of very low safety significance (GREEN). The finding screened to a Phase II assessment on the assumption that a second ground would result in a complete loss of the safety bus and its safety function. The Phase II analysis was performed for the core damage sequence Loss of a 4.16Kv Bus (1J or 1H) utilizing an increased initiating event likelihood (IEL)value of 1 due to the degraded condition of the 1H bus. The duration of the degraded condition was 72 days. The finding was not greater than Green because full mitigation capability of the opposite train remained available. This finding has a cross cutting aspect in human performance, decision making, in that the licensee did not use conservative assumptions in their decision making process (H.1.b). (Section 4OA2)

Green.

The inspectors identified a Green NCV of Surry operating licenses, section 3.I Fire Protection, for failure to promptly identify and correct a condition adverse to fire protection in regard to Appendix R emergency lighting unit performance failures, due to inadequate configuration control of the emergency lights defeat switch.

Failure to reposition the switch following maintenance and or inadvertent switch manipulation has over time led to numerous Appendix R emergency lights being discovered non-functional. Corrective action to address the failure to restore the switch following maintenance has been taken and actions to prevent inadvertent manipulation are being evaluated (CR 352214).

The finding is more than minor because it adversely affected the external factors attribute (fire) of the mitigating system cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the reliability and availability of the emergency lighting units (ELUs) was affected. The finding, evaluated per MC-0609,

Appendix F, Fire Protection Significance Determination Process, was determined to be of very low safety significance (Green). The finding affected post fire safe shutdown and was assigned a low degradation rating because the issue did not have a significant impact on safe shutdown operations because there was not a simultaneous wide spread failure of the ELUs. This finding has a cross-cutting aspect in the area of problem identification and resolution, because the licensee did not take adequate corrective action in a timely manner to address an adverse trend in ELU functionality (P.1.d). (Section 4OA2)

Green.

The inspectors identified a Green NCV of Technical Specification 6.4, Unit Operating Procedures, associated with blocking devices not being removed from piping supports following maintenance due to procedure issues related to procedure adequacy and adherence. The blocking devices were removed upon discovery and appropriate corrective actions established to address the issue (ACE 017736).

The finding is more than minor because if left uncorrected the performance deficiency could potentially lead to more significant safety concerns. The finding is associated with the procedure quality attribute of the mitigating systems cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding, evaluated per MC-0609, Attachment 4, Phase 1 -

Initial Screening and Characterization of Findings, was determined to be of very low safety significance (Green) because operability of a safety system, though challenged, was never lost. This finding has a cross-cutting aspect in the area of problem identification and resolution because the licensees corrective actions were not effective in identifying additional blocked spring hangers on safety-related systems or preventing further configuration control issues associated with spring hanger blocking devices (P.1.d). (Section 4OA2)

Licensee Identified Violations

A violation of very low safety significance, which was identified by the licensee, has been reviewed by the inspectors. Corrective actions taken or planned by the licensee have been entered into the licensees corrective action program. The violation and corrective actions are listed in Section 4OA7 of this report.

REPORT DETAILS

Summary of Plant Status

Unit 1 and 2 operated at or near full rated thermal power throughout the inspection period.

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R01 Adverse Weather Protection

.1 Evaluations of Offsite and Alternate AC Power Systems Readiness for Summer Loading

a. Inspection Scope

The inspectors reviewed plant features and station procedures for the offsite and alternate AC power systems to verify measures to monitor and maintain availability and reliability of the AC power systems were established and that communication protocols between the transmission system operator (TSO) and licensee were appropriate and addressed:

• actions to be taken when notified by the TSO that the post-trip voltage of the offsite power system (OSP) at the nuclear power plant (NPP) will not be acceptable to assure continued operation of safety-related loads without transferring to the onsite power supply;

• compensatory actions identified to be performed if it is not possible to predict the post-trip voltage at the NPP for current grid conditions;

• required re-assessment of plant risk based on maintenance activities which could affect grid reliability, or the ability of the transmission system to provide OSP; and

• required communications between the NPP and TSO when changes at the NPP could impact the transmission system or when the capability of the transmission system to provide adequate OSP is challenged.

The inspectors walked down the offsite (switchyard) and onsite alternate AC power systems and reviewed outstanding corrective maintenance work orders, condition reports, and the system health reports to assess their material conditions.

b. Findings

No findings of significance were identified.

.2 Seasonal Readiness Reviews for Hot Weather

a. Inspection Scope

The inspectors reviewed the licensees preparations for seasonal hot weather.

Inspection focused on verification of design features and implementation of the licensees procedure for hot weather conditions, 0-OSP-ZZ-003; Hot Weather Preparation. Completed copies of 0-OSP-ZZ-003, for the months April 09 - July 09, were reviewed. The inspectors walked down key structures (i.e. the turbine and auxiliary buildings, safeguards buildings, the fire pump house, the emergency switch gear rooms, and emergency battery rooms) and verified HVAC systems were operating properly and that area temperatures remained within design requirements specified in the UFSAR.

The mitigating systems reviewed during this inspection include: the auxiliary feedwater systems, emergency diesel generators, and emergency switchgear.

b. Findings

No findings of significance were identified.

1R04 Equipment Alignment

.1 Partial Walkdown

a. Inspection Scope

The inspectors performed a partial walkdown of the four risk-significant systems identified below to verify the redundant or diverse train for equipment removed from service was operable and/or that the system was properly aligned to perform its designated safety function following an extended outage. During the walkdown, the inspectors verified the positions of critical valves, breakers, and control switches by in-field observation and/or review of the main control board. To determine the correct configuration to support system operation, the inspectors reviewed applicable operating procedures, station drawings, the Updated Final Safety Analysis Report, and the Technical Specifications. The inspectors attempted to identify any discrepancies that could impact the function of the system, and, therefore, potentially increase risk. The inspectors reviewed the corrective action program to verify equipment alignment issues were being identified and resolved.

• Unit 2 125 VDC emergency battery bank 1A on July 27, 2009.

• Unit 2 emergency diesel generator (EDG) fuel oil transfer system on August 18, 2009.

• Unit 1, EDG No. 1 during maintenance on No. 3 EDG on September 21, 2009.

• Unit 2, EDG No. 2 during maintenance on No. 3 EDG on September 21, 2009.

b. Findings

No findings of significance were identified.

1R05 Fire Protection

.1 Quarterly Fire Protection Reviews

a. Inspection Scope

The inspectors conducted a defense-in-depth (DID) review for the eight fire areas listed below by walkdown and review of licensee documents. The reviews were performed to evaluate the fire protection program operational status and material condition and the adequacy of:

(1) control of transient combustibles and ignition sources;

(2) fire detection and suppression capability;

(3) passive fire protection features;

(4) compensatory measures established for out-of-service, degraded or inoperable fire protection equipment, systems, or features; and

(5) procedures, equipment, fire barriers, and systems so that post-fire capability to safely shutdown the plant is ensured. The inspectors reviewed the corrective action program to verify fire protection deficiencies were being identified and properly resolved.

• Fire Zone 45, Mechanical Equipment Room #3

• Fire Zone 54, Mechanical Equipment Room #4

• Fire Zone 13, Unit 1 Normal Switchgear Room

• Fire Zone 14, Unit 2 Normal Switchgear Room

• Fire Zone 31-Z43 Mechanical Equipment Room #1

• Fire Zone 31-Z44, Mechanical Equipment Room #2

• Fire Zone 49, Reserve Station Service Transformers

• Fire Zone 17, Auxiliary Building, 45 Elevation

b. Findings

Introduction:

The inspectors identified a Green NCV of the Surry operating license, section 3.I Fire Protection, for an inadequate procedure that resulted in compensatory continuous fire watches in MERs #3 and #4 being inadequate (CR 342078).

Description:

The licensee implemented a continuous fire watch in MERs #3 and #4, in accordance with the Fire Protection Program, as a compensatory measure due to all fire detection equipment being declared inoperable in those locations. The continuous fire watch remained in place for both areas for one week as repairs to the detection equipment were ongoing. The inspector observed the fire watch individual sitting in the emergency switchgear room, which was not under a fire watch, and transitioning into MER #3, through a dogged, alarmed, normally closed flood/fire protection door, and then into MER #4, through a normally closed fire protection door, once every 10 minutes.

The individual also had to pass through a badge access security door to get from MER

1. 3 to MER #4. Surry procedure VPAP 2401, Fire Protection Program contains the requirements for continuous fire watches. The procedure allows a single person to fulfill the requirements of a continuous fire watch as long as the area of concern has eyes on observation once every 10 minutes. There are no restrictions for roving between multiple fire areas, through locked or key carded doors, through multiple elevations of the same building, or that the individual must wait in between roving in an affected area.

The inspectors found that the Surry practices with regard to continuous fire watches were not in accordance with positions promulgated by NRR in a letter dated August 17, 1998 that was a response to NRC Region IV TIA 96-008, Evaluation of Definition of Continuous Fire Watch (ADAMS ML012400048). In that response, NRR states that the intent of a continuous fire watch is to remain in the affected area at all times and that a deviation for roving would need a technical justification. Surry did not have a technical justification for their definition. The plant specific issue in the TIA response was also delineated in Information Notice 97-48, Inadequate or Inappropriate Interim Fire Protection Compensatory Measures.

The inspectors concluded that the procedural guidance for continuous fire watches, delineated in VPAP 2401, Fire Protection Program, was inappropriate because it did not ensure adequate compensatory actions for fire areas with degraded detection or suppression equipment. As a result, fire watch personnel were not available to promptly detect, report, and extinguish a fire while still in the incipient stage.

Analysis:

The inspectors determined that the failure to provide adequate compensatory measures and procedural guidance for the impairment of fire detection systems, which resulted in fire watch personnel not being available to promptly detect, report, and extinguish a fire while still in the incipient stage, constitutes a performance deficiency and a violation. This finding is greater than minor because it is associated with the reactor safety mitigating systems cornerstone attribute to provide protection against external events and affects the associated cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. MER #3 and MER #4 each contain two trains of service water pumps classified as Appendix R safe shutdown equipment which are required to respond to initiating events to prevent undesirable consequences. The inspectors used Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, to analyze this finding because the condition had an adverse affect on the Fixed Fire Protection Systems element of fire watches posted as a compensatory measure for fixed fire protection system outages or degradations. A low degradation rating was assigned to this finding as the provision affected by this finding (i.e. fire watches) is expected to display nearly the same level of effectiveness and reliability. Using Manual Chapter 0609, Appendix F, this finding was determined to have very low safety significance (Green).

A cross-cutting element was not assigned to this finding because the most significant contributor to the performance deficiency is not reflective of current performance.

Enforcement:

The Surry Operating License, section 3.I Fire Protection requires, in part, that the licensee shall implement and maintain in effect the provisions of the approved fire protection program as-described in the Updated Final Safety Analysis Report (UFSAR). The UFSAR requires, in part, that the fire protection program (FPP)meet Appendix A to Branch Technical Position (BTP) APCSB 9.5-1, Guidelines for Fire Protection for Nuclear Power Plants Docketed Prior to July 1, 1976," dated August 23, 1976. Section B.3 of Appendix A to BTP APCSB 9.5-1 requires, in part, that "Normal and abnormal conditions or other anticipated operations such as modifications (e.g.,

breaking fire stops, impairment of fire detection and suppression systems) and refueling activities should be reviewed by appropriate levels of management and appropriate special actions and procedures such as fire watches or temporary fire barriers implemented to assure adequate fire protection and reactor safety."

Contrary to the above, for the period of time between July 13, 2009 and July 20, 2009, the licensee failed to provide adequate procedural guidance for a continuous fire watch established in MERs #3 and #4 which resulted in the compensatory measure (i.e.

continuous fire watch) being inadequate to ensure fire protection and reactor safety.

Because this violation is of very low safety significance, has been entered into your corrective action program as CR 342078, and appropriate corrective action, revising the requirements for a continuous fire watch, has been implemented; the issue is being treated as an NCV consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000280, 281/2009004-01, Inadequate compensatory measures for the impairment of fire detection systems.

.2 Annual Fire Drill Observations

a. Inspection Scope

The inspectors observed the fire brigade respond to an actual fire event at the control room simulator on July 9, 2009. Aspects considered in the evaluation include: the control room operators response, including identification of the fire location, dispatch of the fire brigade, and sounding of alarms; the number of individuals assigned to the fire brigade; response timeliness; use of protective clothing and self-contained breathing apparatus; use of accessory equipment such as thermography cameras and smoke removal fans; the brigade team leaders command and control, use of pre-fire plan strategies, briefs, and delegation of assignments; fire hose deployment and reach; approach into the fire area; effectiveness of communications among brigade members and between the brigade and the control room; search for victims, and smoke evacuation.

b. Findings

No findings of significance were identified.

1R11 Licensed Operator Requalification Program

.1 Resident Inspector Quarterly Review

a. Inspection Scope

On September 1, 2009, the inspectors observed an evaluated licensed operator simulator training session. The training was administered using scenario RQ-09.5-SP-1 and involved both operational transients and design basis events. The inspector observed the crews performance to determine whether the crew met the scenario objectives; accomplished the critical tasks; demonstrated the ability to take timely action in a safe direction and to prioritize, interpret, and verify alarms; demonstrated proper use of alarm response, abnormal, and emergency operating procedures; demonstrated proper command and control; communicated effectively; and appropriately classified events per the emergency plan. The inspectors confirmed items for improvement were identified and discussed with the operators to further improve performance. The inspector verified the simulator conditions were consistent with the scenario and reflected the actual plant configuration (i.e. simulator fidelity).

b. Findings

No findings of significance were identified.

1R12 Maintenance Effectiveness

a. Inspection Scope

For the two equipment issues described below, the inspectors evaluated the effectiveness of the corresponding licensee's preventive and corrective maintenance.

The inspectors performed a detailed review of the problem history and associated circumstances, evaluated the extent of condition reviews, as required, and reviewed the generic implications of the equipment and/or work practice problem. Inspectors performed walkdowns of the accessible portions of the system, performed in-office reviews of procedures and evaluations, and held discussions with system engineers.

The inspectors compared the licensees actions with the requirements of the Maintenance Rule (10 CFR 50.65), VPAP 0815, Maintenance Rule Program, and the Surry Maintenance Rule Scoping and Performance Matrix. Documents reviewed are listed in the report attachment.

• Safety-related relay failures.

• Bushing failures in emergency service water pumps 1-SW-P-1A/1B/1C.

b. Findings

No findings of significance were identified.

1R13 Maintenance Risk Assessments and Emergent Work Control

a. Inspection Scope

The inspectors evaluated, as appropriate, for the six work activities listed below:

(1) the effectiveness of the risk assessments performed before maintenance activities were conducted;

(2) the management of risk;

(3) that, upon identification of an unforeseen situation, necessary steps were taken to plan and control the resulting emergent work activities; and,

(4) that maintenance risk assessments and emergent work problems were adequately identified and resolved. The inspectors verified that the licensee was complying with the requirements of 10 CFR 50.65 (a)(4) and the data output from the licensees safety monitor associated with the risk profile of Units 1 and 2. The inspectors reviewed the corrective action program to verify deficiencies in risk assessments were being identified and properly resolved.

• Unit 1 and 2 at power Green risk condition and associated high risk contingency action plan in support of service water piping inspections on August 12, 2009.

• Unit 1 and 2 at power Green risk condition with Surry County under a tornado watch and a severe thunderstorm watch on July 17, 2009.

• Unit 1 and 2 at power Green risk condition with Surry County under severe thunderstorm warning on July 27, 2009.

• Unit 1 and 2 at power Green risk condition with work associated with the replacement of backflow preventers July 28, 2009.

• Unit 1 and 2 at power Green risk condition during planned maintenance on the No. 3 emergency diesel generator on September 21, 2009.

• Unit 2 elevated risk (yellow) and Unit 1 Green risk at power conditions and associated medium risk contingency action plan for installation of the chemical injection system in the service water system in MER 4 and cleaning of component cooling water heat exchanger 1-CC-E-1C on September 30, 2009.

b. Findings

No findings of significance were identified.

1R15 Operability Evaluations

a. Inspection Scope

The inspectors reviewed the six operability evaluations listed below affecting risk-significant mitigating systems, to assess, as appropriate:

(1) the technical adequacy of the evaluations;

(2) whether continued system operability was warranted;

(3) whether other existing degraded conditions were considered;

(4) if compensatory measures were involved, whether the compensatory measures were in place, would work as intended, and were appropriately controlled; and

(5) where continued operability was considered unjustified, the impact on TS Limiting Conditions for Operation and the risk significance.

The inspectors review included verification that determinations of operability followed procedural requirements of OP-AA-102 (Rev. 5), Operability Determination. The inspectors reviewed the corrective action program to verify deficiencies in operability determinations were being identified and corrected.

• Operability determination 000311 (Rev 1 & 2); service water fouling of MER #3 chillers.

• Operability determination 000310; component cooling water pump 1-CC-P-1B cloudy oil.

• Operability determination 000329; adequate support remains for 2-SW-P-10B with 6 of 8 anchor bolts missing.

• Immediate operability determination CR 343396; step change in emergency service water pump 1-SW-P-1B vibration.

• Immediate operability determinations CR 349378, 349380, and 349383; unsealed penetrations for 1-SW-E-8, 1-SW-E-7, 1-SW-E-6 in ESW building.

• Past operability determination CR 346268, surveillance test for 1-SW-P-1B secured prematurely due to packing failure.

b. Findings

Introduction:

The inspectors identified a Green finding for the licensees incorrect operability determination for emergency service water pump 1-SW-P-1B, on August 1, 2009, after vibrations increased 391% in the vertical plane (CR 343396). A violation of regulatory requirements was not identified. The pump, declared inoperable on August 2, was replaced within the Technical Specification allowed outage time.

Description:

On August 1, pump 1-SW-P-1B vibrations significantly increased in a step like manner. Vibrations in the vertical plane increased by 391% rising from 0.128 inches per second (IPS) to a peak of 0.682 IPS. Vibrations increased in the horizontal plane by 92% and in the axial plane by 23%. An immediate operability determination (IOD) was documented in CR 343396 and identified 1-SW-P-1B as operable with evaluation. A final OD was due on August 4. The basis for operability stated vibrations stabilized and reduced slightly, horizontal and vertical points are in alert with an upper limit of 0.7 IPS.

The IOD was inadequate because the licensee did not identify the cause for the step change in vibration and therefore could not provide an adequate technical basis for why vibrations would not continue to increase during subsequent pump operation, nor did they fully evaluate the effect of additional pump start(s) on the pumps vibration due to potential further wear/damage to the upper shaft bushings; the shafts upper bushings initially run dry during which point they experience the greatest friction wear / damage potential, a prior known issue. Additionally, the evaluation did not provide justification as to the pumps ability to fulfill the required 30 day mission time. On August 2, 1-SW-P-1B was started to acquire additional vibration data, approximately 30 minutes into the run vibration exceeded the operability limit of 0.7 IPS in the vertical plane. The pump was secured and declared inoperable. Investigation identified that the two upper shaft bushings had failed.

Standards for operability determinations are set forth in OP-AA-102, Operability Determination, which states in part that conservative decision making shall apply at all times when making a determination of operability and that the standard for reasonable expectation is a high standard. Paragraph 5.3.30 in part states when system capability is degraded to a point where it cannot perform with reasonable expectation or reliability, the system should be judged inoperable, even if at this instantaneous point in time the system could provide the specified safety function. Attachment 1 step 3.c requires that the IOD assess how the degraded or nonconforming condition affects the ability of the component to perform its specified safety function for its required mission time.

Analysis:

The failure to provide adequate technical justification for continued operability as required by the standards in procedure OP-AA-102, Operability Determination was a performance deficiency and was within the licensees ability to foresee and correct, and which led to the incorrect operability determination for 1-SW-P-1B on August 1, 2009, which should have been prevented.

The finding is more than minor because if left uncorrected the performance deficiency could potentially lead to more significant safety concerns. The finding is associated with the human performance attribute of the mitigating systems cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding, evaluated per MC-0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, was determined to be of very low safety significance (Green) because it did not result in a loss of safety function or the loss of a single train of ESW greater than the allowed outage time.

This finding has a cross-cutting aspect in the area of human performance decision making because the licensee failed to use conservative assumptions in their operability decision for 1-SW-P-1B (H.1.b).

Enforcement:

Enforcement action does not apply because the performance deficiency did not involve a violation of a regulatory requirement. The issue was entered into the licensees corrective action program as CR 352214. Because the Finding does not involve a violation of regulatory requirements and has very low safety significance, it is identified as: FIN 05000280, 281/2009004-02; Failure to provide an adequate basis for operability of 1-SW-P-1B.

1R18 Plant Modifications

a. Inspection Scope

The inspectors reviewed the three identified plant modifications listed below to verify:

(1) that the design and licensing bases, and performance capability of risk-significant systems, structures, and components (SSCs) were not degraded through modification;

(2) that modifications performed during increased risk-significant configurations do not place the plant in an unsafe condition; and,

(3) that the modification did not affect system operability or availability as described by the TS and UFSAR. The inspectors reviewed applicable procedures, engineering calculations, the modification design and implementation package, work orders, drawings, corrective action documents, the UFSAR and TS, supporting analyses, and design basis information. Inspectors witnessed aspects of the modification implementation and observed/reviewed aspects of the post-modification testing.

• Design change (DC) SU-08-0001, ESW Pump Diesel Engine Exhaust Piping Modifications, Low Level Intake, SPS.

• Limited Scope Modification (LSM) SU-0-07-016, Replace Emergency Diesel Generator Speed Sensing Relays.

• Temporary plant modification S1-09-138, Temporary repair of Zone 5 Security E-Field.

b. Findings

Introduction:

The inspectors identified a Green NCV of 10 CFR 50, Appendix B, Criterion III, Design Control. The design change for the emergency service water pumps (DC-SU-08-0001) was not adequate to protect the diesel-driven emergency service water pumps from damage resulting from a tornado missile as required by the UFSAR. Pending resolution, interim compensatory measures have been established to provide assurance the ESW pumps will be capable of performing their safety function.

Description:

UFSAR Table 15.2-1 lists the engine-driven emergency service water pumps as being components that will not fail during a tornado since they are protected by tornado resistant structures. The lack of tornado missile protection for the diesel engine exhaust pipes was initially identified on March 22, 2007, and documented in CR 009115. To address the non-conforming condition, the licensee installed roof-top exhaust enclosure sub-assemblies in accordance with DC-SU-08-0001 on ESWPs 1-SW-P-1A and 1C. A less robust design installed on 1-SW-P-1B was to be replaced with DC-SU-08-0001 in the fall 2009.

The inspectors review of DC-SU-08-0001 and its supporting documents identified the 1300 pound sub-assemblies are secured to the roof-top by four anchor bolts embedded in the concrete roof. The sub-assembly is designed top heavy and intended to break off at the bolts and fall over out of the way so as to not block the engine exhaust if impacted by a tornado-generated missile. The inspectors identified the analysis, which concluded that in the event of a missile strike of sufficient force to sever the anchor bolts the enclosure sub-assembly would fall over rather than slide and obscure the diesel exhaust port, was inadequate because this conclusion was reached without any supporting quantitative assessment or calculations which used tornado-generated missiles of a reduced force below the maximum design missile strike to verify there was not a possibility of sliding the roof-top sub-assembly and blocking the engine exhaust in a way that would render the engine inoperable. The inspectors also identified the analysis had not considered and evaluated interaction of the missile shield, once broken free from its anchor bolts, with the adjacent structures on the roof-top.

Additionally, a second noted design deficiency, applicable to both installed designs, was the failure to evaluate for and address the impact of rain water intrusion into the exhaust pipe, and subsequently the diesel engine, once the missile enclosure was struck by a tornado generated missile and dislodged per design from the exhaust port. Water intrusion into the exhaust pipe of 1-SW-P-1A resulted in a bent piston rod and broken cylinder liner on May 30, 2009.

Analysis:

The inspectors determined the failure to assess all potential failure modes and their effect on operability of the emergency service water pumps, for DC SU-08-0001, constituted a performance deficiency that was within the licensees ability to foresee, prevent, and correct which resulted in the installation of an inadequate modification that affected operability of ESWPs 1-SW-P-1A, and 1C.

The finding, associated with the design control attribute of the mitigating systems cornerstone, is more than minor because it adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding, was evaluated per MC-0609, Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations. A Phase III risk analysis was performed because the finding screened as potentially risk significant for a severe weather initiating event.

A regional Senior Reactor Analyst evaluated the performance deficiency under Phase III of the Significance Determination Process resulting in a finding of very low safety significance (Green). The major assumptions of the analysis were that the Emergency Service Water pumps would require missile protection in tornadoes of at least F2 intensity and there was no possibility of offsite power recovery. The NRCs probabilistic risk analysis model for Surry was used with the basic event SWS-EDP-CF-F-SALL3, All Emergency Service Water Pumps Fail To Start, designated as the surrogate for the performance deficiency. In this analysis the designated basic events failure probability was set to always fail. The dominant accident sequence involved a tornado causing a Loss of Offsite Power and a failure of the Emergency Service Water pumps. Then a common cause failure of Service Water Isolation Valves 200A and 206A to close caused the ultimate heat sink to drain without makeup capability. Eventually, the ultimate heat sink failed and core damage ensued.

This finding has a cross-cutting aspect in the area of human performance, resources, because the licensees design documentation for DC SU-08-0001 and ET-S-08-0032 was not complete and accurate which led to the installation of inadequate modifications on ESWPs 1-SW-P-1A/1B/1C (H.2.c).

Enforcement:

10 CFR 50, Appendix B, Criterion III, Design Control, states, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis for structures, systems, and components shall be correctly translated into specifications, drawings, procedures, and instructions. UFSAR Table 15.2-1 lists the engine-driven emergency service water pumps as being components that will not fail during a tornado since they are protected by tornado resistant structures. Contrary to this, the design change DC-SU-08-0001, for the engine-driven emergency service water pumps was not adequate to protect the diesel engine exhausts from being blocked by tornado missile damage or subject to water intrusion. Corrective action to remove the modification from the A pump was completed and reasonable compensatory measures established for all three pumps pending removal / alteration of the exhaust piping modifications. Because this finding is of very low safety significance and was entered into your corrective action program as CRs 337720, 337337 and 341557, this violation is being treated as a NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy, NCV 05000280, 281/2009004-03, Inadequate Tornado Protection for Engine-Driven Emergency Service Water Pumps 1-SW-P-1A/B/C.

1R19 Post Maintenance Testing

a. Inspection Scope

For the five risk-significant maintenance activities listed below, the inspectors reviewed the associated post maintenance testing (PMT) procedures and either witnessed the testing and/or reviewed completed records to assess whether:

(1) the effect of testing on the plant had been adequately addressed by control room and/or engineering personnel;

(2) testing was adequate for the maintenance performed;

(3) test acceptance criteria were clear and adequately demonstrated operational readiness consistent with design and licensing basis documents;

(4) test instrumentation had current calibrations, range, and accuracy consistent with the application;

(5) test were performed as written with applicable prerequisites satisfied;

(6) jumpers installed or leads lifted were properly controlled;

(7) test equipment was removed following testing; and

(8) equipment was returned to the status required to perform its safety function. The inspectors reviewed the corrective action program to verify PMT deficiencies were being identified and corrected.

• Charging pump 2-CH-P-1B 10 year preventive maintenance replacement of breaker 25J5 per work orders 38077652201 and 38102532665.

• ASME code weld repair of CVCS letdown piping per work order 38102592735.

• Charging pump 1-CH-P-1A two year preventive maintenance package per work order 38102474763.

• Emergency diesel generator #3 speed sensing relay replacement per work order 38079118301.

• Emergency service water pump 1-SW-P-1B replacement and subsequent re-pack per work orders 38102612527 and 38102627114.

b. Findings

Introduction:

A self-revealing Green NCV of Technical Specification 6.4, Unit Operating Procedures and Programs; was identified for the failure to provide adequate work instructions for maintenance on 1-SW-P-1B, a safety-related component, which led to failure of the pumps packing gland on August 26, 2009 and required the pump be removed from service and repacked (CR 346268).

Description:

The upper bushings in emergency service water pump 1-SW-P-1B failed on August 2, 2009, which required the pump be replaced. The configuration of the available spare pump did not support installation in the B pump position. Maintenance personnel re-configured the spare pump for installation into the B position. Work included rotation of the pumps stuffing box and foundation. Installation of the spare pump, including repack of the stuffing box, was completed on August 4, and the pump was returned to service after a 6.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> post maintenance test run.

Subsequent pump operation on August 26 resulted in failure of the pump packing when fasteners securing the two halves of the packing gland together unthreaded allowing the gland to disassemble and the packing to eject from the stuffing box due to system pressure (CR 346268). Investigation determined although the fasteners had been installed and tightened when the pump was repacked on August 3, they were not torqued. Review of procedure 0-MCM-0114-01 (Rev 15), Emergency Service Water Pump Maintenance; identified the procedure lacked specific instruction to assemble and install the packing gland and to torque the packing gland fasteners per the requirements specified under the Torque Guidelines and Torque Values in Attachments 3 and 4 of the maintenance procedure respectively.

Analysis:

The inspectors determined the failure to provide appropriate instructions for installation of the packing gland assembly was a performance deficiency that was within the licensees ability to foresee and correct which led to failure of the packing gland on 1-SW-P-1B on August 26, 2009, which should have been prevented.

The finding, associated with the equipment performance attribute of the mitigating systems cornerstone, is more than minor because it adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding, evaluated per MC-0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, was determined to be of very low safety significance (Green) because it did not result in a loss of safety function or loss of a singe train of ESW for more than its allowed outage time.

This finding has a cross-cutting aspect in the area of human performance, resources, in that a complete and accurate procedure was not available to assure nuclear safety during replacement of 1-SW-P-1B (H.2.c).

Enforcement:

Technical Specification 6.4.A states in part, detailed written procedures with appropriate instructions shall be provided for corrective maintenance which could have an effect on the safety of the reactor. Contrary to the above, procedure 0-MCM-0114-01 (Rev 15), Emergency Service Water Pump Maintenance; failed to provide appropriate instructions for the re-assembly of the emergency service water pump packing gland. As a result, following replacement of 1-SW-P-1B on August 4, the packing gland subsequently failed on August 26 resulting in the pump being declared inoperable and removed from service for repair. Because this finding is of very low safety significance and was entered into the corrective action program as CR 346268, this violation is being treated as a NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy, NCV 05000280, 281/2009004-04; Inadequate Work Instructions lead to packing failure of 1-SW-P-1B.

1R20 Refueling and Other Outage Activities

a. Inspection Scope

The inspectors observed new fuel receipt and inspection to verify fuel handling operations were being performed in accordance with technical specifications and approved procedures. Included in the inspection was verification that the security seals on the shipping containers were intact, the shipping containers accelerometers were not tripped, the fuel assemblies were being properly tracked, and that personnel who performed the work were appropriately qualified.

b. Findings

No findings of significance were identified.

1R22 Surveillance Testing

a. Inspection Scope

The inspectors witnessed and/or reviewed test records for the risk-significant surveillance tests listed below, to determine whether the SSCs selected meet the Technical Specifications (TS), Updated Final Safety Analysis Report (UFSAR), and licensee procedure requirements and demonstrate that the SSCs are capable of performing their intended safety functions (under conditions as close as practical to accident conditions or as required by TS) and their operational readiness.

In-Service Testing:

• 0-OPT-VS-008 (Rev. 25); Control Room Air Conditioning System Pump and Valve In-service Testing (MER 5 Chillers).

Surveillance Testing:

• 2-OPT-EG-001 (Rev. 51), Number 2 Emergency Diesel Generator Monthly Start Exercise Test.

• 1-OPT-RX-006, Incore flux map.

• 2-OPT0CS-006 (Rev 11); RWST Chemical Addition Tank and Containment Spray System MOV Stroke Test

b. Findings

No findings of significance were identified.

Cornerstone: Emergency Preparedness

1EP6 Drill Evaluation

a. Inspection Scope

The inspector observed operator simulator training conducted on September 1, 2009, to assess licensee performance in the risk significant performance standards of emergency classification, protective action recommendations, and off-site notification. This drill evaluation is included in the Emergency Response Performance Indicator statistics.

b. Findings

No findings of significance were identified.

4OA1 Performance Indicator (PI) Verification

.1 Mitigating Systems Performance Index (MSPI)

a. Inspection Scope

The inspectors reviewed, on a sampling basis, the Mitigating Systems Performance Index performance indicators (PI) for Units 1 and 2 for the third quarter 2008 through the second quarter 2009. The purpose of the review was to assess the accuracy and completeness of the submitted PI data and whether the performance indicators were calculated in accordance with guidance contained in NEI 99-02, Regulatory Assessment Performance Indicator Guideline. The evaluation included verification of compliance with the licensees NRC Mitigating System Performance Index Basis Document, and review of selected consolidated entry forms for accuracy of information entered into the MSPI calculation computer program. Data reviewed for the monitored components included unavailability, reliability and run times; the number of starts, and failures to start and run. Information from logs and other plant documentation was used to verify the data was accurate. This inspection activity represents the following 4 samples.

• Unit 1 and 2 Emergency AC Power System

• Unit 1 and 2 Heat Removal System

b. Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems

.1 Daily Reviews of Items Entered into the Corrective Action Program:

As required by NRC Inspection Procedure 71152, Identification and Resolution of Problems, and in order to help identify repetitive equipment failures or specific human performance issues for follow-up, the inspectors performed a daily screening of items entered into the licensees CAP. This review was accomplished by reviewing daily CR report summaries and periodically attending daily CR Review Team meetings.

.2 PI&R Annual Reviews of Operator Work Arounds

a. Inspection Scope

The inspectors performed an in-depth review of operator workarounds (OWAs) to verify they were being identified at an appropriate threshold and entered into the corrective action program. Inspection focused on identification of risk significant workarounds on mitigating systems. Workarounds were reviewed and assessed for the impact on the systems ability to perform its safety function(s) and the operators ability to implement abnormal and emergency operating procedures and respond in a correct and timely manner to plant transients and accidents. Potential impacts on multiple mitigating systems were considered and the cumulative affect on system reliability and availability, as well as potential for miss operation, were reviewed.

Workarounds, formalized as long-term corrective action for a degraded or non-conforming condition, were sought out with particular attention given to identifying workarounds that increased the potential for personnel error, or:

• require operations contrary to past training,

• require more detailed knowledge of systems than routinely provided,

• require a change from longstanding operational practices,

• require operation of a system or component in a manner dissimilar from similar systems or components,

• create the potential for the compensatory action to be performed on equipment under conditions for which it is not appropriate,

• impair access to required indications, increase dependence on oral communications,

• require actions under adverse environmental conditions, and require the use of equipment and interfaces that had not been designed with consideration of the task being performed.

The inspection was accomplished by document reviews, plant tours, and interviews with licensed and non-licensed operators.

b. Findings and Observations

No findings of significance were identified.

.3 PI&R Annual Sample Emergency Bus 1H Ground

a. Inspection Scope

The inspectors reviewed the licensees response to a condition adverse to quality associated with an identified ground on the Unit 1 electrical safety bus 1H. This review included walkdown of the 1H bus, reviews of station procedures and drawings, industry guidance documents, Operational Decision Making Plan ODM000102, observation of the July 7 Plant Health Committee meeting, and discussions with station personnel.

During the review, the inspectors assessed licensee performance in addressing each of the following attributes:

• complete and accurate identification of the problem in a timely manner,

• evaluation and disposition of operability/reportability issues,

• consideration of extent of condition, generic implications, common cause, and previous occurrences,

• classification and prioritization of the resolution of the problem commensurate with its safety significance,

• identification of root and contributing causes of the problem,

• identification of corrective actions which are appropriately focused to correct the problem,

• completion of corrective actions in a timely manner commensurate with the safety significance of the issue, and

• implementation of interim corrective actions and /or compensatory measures to minimize the problem and/or mitigate its effects, until permanent action can be implemented.

b. Findings and Observations

Introduction:

A Green NCV of 10 CFR 50, Appendix B, Criterion XVI, Corrective Action, was identified by the inspectors for the failure to promptly identify and correct a condition adverse to quality related to a ground on emergency safety bus 1H. This resulted in the degraded condition being allowed to exist for 72 days prior to de-energizing the containment recirculation fan and repairing the adverse condition (CR 336041).

Description:

The power supply cable for containment ventilation fan 1-VS-F-1A was replaced from the containment penetration to the fan motor during the Unit 1 2009 spring refueling outage. On completion of the maintenance, the fan was energized on May 7, 2009. Operations reported a ground on the Unit 1 safety bus 1H and engineering investigated the ground indication on May 7, 2009, and reported the bulb associated with the B phase of the ground indicating circuit appeared blown and needed to be replaced before any assumption is made regarding the ground indication. No further action was taken in regard to the ground indication. On May 26, 2009, the inspectors questioned engineering about the ground indication and fact the bulb had not yet been replaced to confirm whether a ground existed or not. The bulb was subsequently replaced on May 26, 2009, and the ground confirmed. The inspectors questioned the licensee regarding the potential risk of operating with a ground on the safety bus, why the ground had not been located and isolated, and the fact the only load energized from the applicable portion of the 1H bus at that time was the containment recirculation fan.

Operational Decision Making (ODM) plan ODM000102 was issued on June 19, 2009.

On July 16, 2009, the inspectors contacted station management regarding continued operation with a ground on the IH safety bus, the fact 1-VS-F-1A had not been secured, and the lack of having assessed the safety risk significance associated with operating with the 1H bus ground. On July 17, 2009, the licensee secured 1-VS-F-1A and the ground on the 1H safety bus cleared. A subsequent containment entry identified and corrected the ground condition which was caused by an exposed spot on the new power supply cable in contact with the inner surface of the containment junction box. This condition had not been identified or corrected since the installation on May 7, 2009.

Analysis:

Failure to timely identify and correct the ground indication on the 1H emergency safety bus, a condition adverse to quality, is a performance deficiency that was reasonably within the licensees ability to foresee and correct and should have been prevented. The finding is more than minor because it adversely impacts the equipment performance attribute of the reactor safety mitigating system cornerstone and its objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding was evaluated per MC-0609, Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations. A regional Senior Reactor Analyst evaluated the performance deficiency under Phase 3 of the Significance Determination Process resulting in a finding of very low safety significance (Green). The NRCs probabilistic risk analysis model for Surry was used with the basic event ACP-BAC-LP-1H, DIVISION 1H AC POWER 4140V BUS 1H FAILS, designated as the surrogate for the performance deficiency. In this analysis the designated basic events failure probability was increased by an order of magnitude. A 70 day exposure period was used. The dominant accident sequence involved a Steam Generator Tube Rupture with division A failing due to the performance deficiency and division Bs Service Water Train in out of service for test and maintenance. After an extended period of time in this condition core damage ensued.

This finding has a cross cutting aspect in human performance, decision making, in that the licensee did not use conservative assumptions in their decision making process (H.1.b).

Enforcement:

10 CFR 50, Appendix B, Criterion XVI, requires in part that conditions adverse to quality be promptly identified and corrected. Contrary to the above, a ground condition apparent on May 7, 2009, on emergency switchgear safety bus 1H, a condition adverse to quality, was not identified and corrected until July 17, 2009. Because this finding is of very low safety significance, has been entered into your corrective action program as CR 336041, and has been corrected; this violation is being treated as a NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy, NCV 05000280/2009004-05; Failure to promptly identify and correct a ground on safety bus 1H.

.4 PI&R Annual Sample Emergency Light Configuration Control

a. Inspection Scope

The inspectors performed an in-depth review of the licensees actions in response to an adverse performance trend in Appendix R emergency lighting units. This review included walkdown of emergency lighting and the review of station procedures and documents. During the review, the inspectors assessed licensee performance in addressing each of the following attributes:

• complete and accurate identification of the problem in a timely manner,

• evaluation and disposition of operability / reportability issues,

• consideration of extent of condition, generic implications, common cause, and previous occurrences,

• classification and prioritization of the resolution of the problem commensurate with its safety significance,

• identification of root and contributing causes of the problem,

• identification of corrective actions which are appropriately focused to correct the problem,

• completion of corrective actions in a timely manner commensurate with the safety significance of the issue, and

• implementation of interim corrective actions and /or compensatory measures to minimize the problem and/or mitigate its effects, until permanent action can be implemented.

b. Findings and Observations

Introduction:

The inspectors identified a Green NCV of Surry operating licenses, section 3.I Fire Protection, for failure to promptly identify and correct a condition adverse to fire protection in regard to Appendix R emergency lighting unit performance failures due to inadequate configuration control of the emergency lights defeat switch. Failure to reposition the switch following maintenance and or inadvertent switch manipulation has over time led to numerous Appendix R emergency lights being discovered non-functional. Corrective action to address the failure to restore the switch following maintenance has been taken and actions to prevent inadvertent manipulation are being evaluated (CR 352214).

Description:

In 2008, seven Appendix R and two safety-code emergency lighting units (ELUs) were declared non-functional following discovery of their defeat toggle switch in the defeat position. In the defeat position, the emergency lighting unit will not energize on demand. To ensure proper operation of the ELUs, the battery must be charged for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the defeat switch has been returned to the normal position. An apparent cause evaluation (ACE 13846) was issued August 27, 2008 and established corrective actions to address the adverse trend. In review of the ACE, it is clear to the inspectors this issue has been long standing, as the ACE references seventeen prior condition reports/plant issue documents as repeat occurrences dating back to 2002. The prior corrective actions have not been fully effective and corrective action to remove or protect the toggle switch from inadvertent operation has yet to be initiated.

The inspectors identified the defeat toggle switch on ELUs 1-ELT-LF-120 and 1-ELT-LF-082 was in the defeat position on February 2, and August 10, 2009, respectively (CR 322141 & 344325). As of January, a total of four Appendix R and one code safety emergency lighting unit have been declared non-functional due to its defeat switch being found in the defeat position. The licensee initiated ACE 017736 on August 11, which has not been completed.

Analysis:

The inspectors identified the failure to effectively correct the configuration control issue with the emergency lighting units defeat switch is a performance deficiency within the ability of the licensee to foresee and correct that led to multiple Appendix R ELUs being non-functional which should have been prevented.

The finding is more than minor because it adversely affected the external factors attribute (fire) of the mitigating system cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically the reliability and availability of the ELUs was affected. The finding, evaluated per MC-0609, Appendix F, Fire Protection Significance Determination Process, was determined to be of very low safety significance (Green).

The finding affected post fire safe shutdown and was assigned a low degradation rating because the issue did not have a significant impact on safe shutdown operations because there was not a simultaneous wide spread failure of the ELUs.

This finding has a cross-cutting aspect in the area of problem identification and resolution because the licensee did not take adequate corrective action in a timely manner to address an adverse trend in ELU functionality (P.1.d).

Enforcement:

The Surry Operating License, section 3.I Fire Protection requires, in part, that the licensee shall implement and maintain in effect the provisions of the approved fire protection program as-described in the Updated Final Safety Analysis Report (UFSAR). The UFSAR requires, in part, that the fire protection program (FPP)meet Appendix A to Branch Technical Position (BTP) APCSB 9.5-1, Guidelines for Fire Protection for Nuclear Power Plants Docketed Prior to July 1, 1976," dated August 23, 1976. Section C.8 of Appendix A to BTP APCSB 9.5-1 requires, in part, that measures be established to assure conditions adverse to fire protection, such as failures, malfunctions, deficiencies, are promptly identified, reported, and corrected. Contrary to the above, for the period of time between January 2008 and October 2009, the licensee failed to correct the configuration control issues associated with the Appendix R emergency lighting units which caused the ELUs to non-functional, an adverse fire protection condition. Because this violation is of very low safety significance, has been entered into your corrective action program (CR 352214), the issue is being treated as an NCV consistent with Section VI.A.1 of the NRC Enforcement Policy, NCV 05000280, 281/2009004-06, Ineffective action for ELU performance deficiencies.

.5 PI&R Annual Sample Pipe Support Configuration Control

a. Inspection Scope

The inspectors performed an in-depth review of the licensees actions in response to an adverse performance trend for control of blocking devices installed in piping supports/hangers. This review included plant walkdowns and the review of station procedures and documents. During the review, the inspectors assessed licensee performance in addressing each of the following attributes:

• complete and accurate identification of the problem in a timely manner,

• evaluation and disposition of operability/reportability issues,

• consideration of extent of condition, generic implications, common cause, and previous occurrences,

• classification and prioritization of the resolution of the problem commensurate with its safety significance,

• identification of root and contributing causes of the problem,

• identification of corrective actions which are appropriately focused to correct the problem,

• completion of corrective actions in a timely manner commensurate with the safety significance of the issue, and

• implementation of interim corrective actions and /or compensatory measures to minimize the problem and/or mitigate its effects, until permanent action can be implemented.

b. Findings and Observations

Introduction:

The inspectors identified a Green NCV of Technical Specification 6.4, Unit Operating Procedures, associated with blocking devices not being removed from piping supports following maintenance due to procedure issues related to procedure adequacy and adherence. The blocking devices were removed upon discovery and appropriate corrective actions established to address the issue (ACE 017736).

Description:

On January 15, 2008, the inspectors identified spring hanger #10, on drawing 11448-MKS-118G2, was blocked and unloaded leaving a 1/16 inch gap between the pipe support and the auxiliary feedwater pipe (CR 028771). On February 25, operations identified spring hanger H078, located downstream of power operated relief valve (PORV) 1-MS-RV-101B, was blocked. Piping analysis performed by corporate engineering demonstrated both lines remained operable while in this degraded condition.

The issue was addressed in apparent cause evaluation (ACE) 000926 which identified the blocking device left in the AFW piping support resulted from inadequate instructions in maintenance procedure 0-MCM-1801-01. The procedure did not require that hangers blocked be properly identified and recorded in the procedure thereby providing a means to ensure that all blocking devices installed would be subsequently removed. The work steps, general in nature, simply stated to install and remove blocking devices as required. Both steps to install and remove the blocking devices were marked as complete. Spring hanger H078 was blocked without procedure or work order direction, by the mechanic assigned to perform the first work package on the PORV. The blocking device was not removed following the final work package as there were no instructions identifying the need to do so. Corrective actions, established in ACE 000926, included:

generating a new procedure to better control installation and removal of hangar blocking devices (0-MCM-1206-01, Spring Hanger Pipe Support Blocking and Unblocking);inserting additional guidance for blocking and unblocking spring hanger supports in procedures 0-MCM-1801-01 and 0-MCM-0407-01; and requiring specific steps be added to the work order to block and unblock spring hangers. An extent of condition review, limited to the AFW system and PORV tailpipes, was performed with no other issues identified.

On May 9, 2009, during walkdown of the main steam system prior to the 200ºF mode change; the inspectors identified blocking devices had not been removed from the two spring can hangers associated with the replacement of 1-MS-116 during the outage.

Investigations, documented in ACE 017582, identified steps in the work order and in procedure 0-MCM-1801-01 to remove the blocking devices were marked not applicable.

Who marked the steps not applicable and why was indeterminate. Though the condition was corrected prior to exceeding 200ºF, an evaluation was performed that determined the steam line remained operable with the spring cans blocked. Corrective actions, established in ACE 017582, included: removal of the instructions to block and unblock spring hangers from 0-MCM-1801-01 and 0-MCM-0407-01 and referencing procedure 0-MCM-1206-01, adding steps to startup procedure GOP-1.1 to verify spring hangers blocked during the outage have been unblocked and to evaluate using a stand alone work order to block and unblock spring hangers. A review of all other Unit 1 outage work orders related to spring can hangers found no further issues.

On September 3, 2009, workers performing maintenance on charging valves in the unit 1 C charging pump cube identified spring hanger 3-CH-3-1503 on the pumps discharge line was blocked. Spring hanger 3-CH-81-1503, on the unit 1 A charging pump discharge line, was identified blocked during the extent of condition review on September 14. Investigation, documented in ACE 017778, identified both hangers were most likely blocked during maintenance during the Unit 1 outage in November 2007.

The generic instructions to install and remove blocking devices as required, in step 6.3.2 and 6.4.6 of 0-MCM-1801-01 were marked complete without removing all the blocking devices. As previously stated, the procedure did not require that hangers blocked be properly identified and recorded in the procedure thereby providing a means to ensure that all blocking devices installed would be subsequently removed. Corrective actions, established in ACE 017778, included: adding a requirement to mark with bright ribbon blocked spring hangers using stand alone work order to install and remove spring hanger blocking devices, and to validate all spring hangers blocked over the prior two outages have been unblocked.

Analysis:

The inspectors identified the failure to provide and follow adequate procedures was a performance deficiency within the ability of the licensee to foresee and correct which led to multiple spring hangars being inoperable/non-functional. The finding is more than minor because if left uncorrected the performance deficiency could potentially lead to more significant safety concerns. The finding is associated with the procedure quality attribute of the mitigating systems cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding, evaluated per MC-0609, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, was determined to be of very low safety significance (Green) because operability of a safety system, though challenged, was never lost.

This finding has a cross-cutting aspect in the area of problem identification and resolution, because the licensees corrective actions were not effective in identifying additional blocked spring hangers on safety-related systems or preventing further configuration control issues associated with spring hanger blocking devices (P.1.d).

Enforcement:

Technical Specification 6.4.A states in part, detailed written procedures with appropriate instructions shall be provided for corrective maintenance which could have an effect on the safety of the reactor. Section 6.4.D requires these procedures be followed. Contrary to the above procedure revisions in effect in 2007 - 2008 for 0-MCM-1801-01 and 0-MCM-0407-01 lacked appropriate instructions to assure spring can blocking devices were properly identified when installed and removed following maintenance. The failure to follow the revised instructions during the Unit 1 2009 spring outage resulted in blocking devices installed to perform maintenance on 1-MS-116 not being removed. Because this finding is of very low safety significance and was entered into the corrective action program as CR 346268, this violation is being treated as a NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy, NCV 05000280/2009004-07, Failure to remove blocking devices from piping supports.

4OA3 Event Followup

(Closed) LER 05000280, 281/2009-001-00, Inoperable Emergency Service Water Pump Caused by Inadequate Design Change On May 30, 2009, with Units 1 and 2 operating at 100% reactor power, diesel engine driven emergency service water pump A failed to start due to rain water intrusion into the exhaust piping. The inspectors reviewed the LER for accuracy, adequacy of corrective actions, and violation of NRC requirements. The enforcement aspects related to this issue and the associated findings, are discussed in section 1R19 of NRC IR 2009-03 and section 1R18 of this report. This LER is closed.

4OA5 Other Activities

.1 Quarterly Resident Inspector Observations of Security Personnel and Activities

a. Inspection Scope

During the inspection period, the inspectors conducted observations of security force personnel and activities to ensure that the activities were consistent with the licensee security procedures and regulatory requirements relating to nuclear plant security.

These observations took place during both normal and off-normal plant working hours.

These quarterly resident inspector observations of security force personnel and activities did not constitute any additional inspection samples. Rather, they were considered an integral part of the inspectors normal plant status review and inspection activities.

b. Findings

No findings of significance were identified.

.2 Institute of Nuclear Power Operations (INPO) Plant Assessment Report Review

a. Inspection Scope

The inspectors reviewed the draft report of INPOs Plant Evaluation and Assessment of Surry power station which was conducted in January 2009. The inspectors reviewed the report to ensure that issues identified were consistent with NRC perspectives of licensee performance and to verify if any significant safety issues were identified that required further NRC follow-up.

b. Findings

No findings of significance were identified.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On October 20, 2009, the inspection results were presented to Mr. Bischof and other members of his staff, who acknowledged the findings. The inspectors asked the licensee whether any of the material examined during the inspection should be considered proprietary. No proprietary information was identified.

4OA7 Licensee-Identified Violations

The following violation of very low safety significance (Green) was identified by the licensee and is a violation of NRC requirements which meets the criteria of Section VI of the NRC Enforcement Policy, NUREG-1600 for characterization as an NCV:

• Surry Power Station (SPS) Operating License Condition 3.I states, in part, that the Licensee shall implement and maintain in effect the provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report.

Branch Technical Position (BTP) Chemical Engineering Branch (CMEB) 9.5-1, which incorporated the guidance of Appendix A to BTP Auxiliary Systems Branch (ASB)9.5-1 and the technical requirements of Appendix R to 10 CFR Part 50, established the regulatory and licensing requirements for the fire protection program at SPS.

Section 9.10.1 of the UFSAR states, in part, Compliance with these criteria is contained in the following documents: Fire Protection Program document. CM-AA-FPA-100, Fire Protection/Appendix R (Safe Shutdown) Program, Rev. 10, 2, Section 3.1.2.o.2 states that penetration seals must provide equal or greater fire rating than that of the fire barrier. Contrary to the above, on June 5, 2009, the licensee breached a fire barrier penetration seal that separates MER #4 (Fire Area 54) from the Turbine Building (Fire Area 31). The breach existed until it was discovered and sealed on July 29, 2009. This issue was identified in the licensees corrective action program as CR 340416. This violation is of very low safety significance because the violation did not affect ignition frequencies, detection, or suppression system performance.

ATTACHMENT: SUPPPLEMENTAL INFORMATION

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

M. Adams, Director, Station Engineering

G. Bischof, Site Vice President

B. Garber, Supervisor, Licensing

K. Grover, Manager, Operations

A. Harrow, Supervisor Electrical Systems

R. Johnson, Manager, Outage and Planning

L. Jones, Manager, Radiation Protection and Chemistry

R. Manrique, Supervisor, Primary Systems

C. Olsen, Manager, Site Engineering

L. Ragland, Supervisor, Health Physics Operations

R. Simmons, Manager, Maintenance

K. Sloane, Plant Manager (Nuclear)

B. Stanley, Director, Station Safety and Licensing

M. Wilda, Supervisor, Auxiliary Systems

LIST OF ITEMS

Opened and Closed

05000280, 281/2009004-01 NCV Inadequate compensatory measures for the impairment of fire detection systems (Section 1R05)

05000280, 281/2009004-02 FIN Failure to provide an adequate basis for operability of ESW pump 1-SW-P-1B (Section 1R15)

05000280, 281/2009004-03 NCV Inadequate Tornado Protection for Engine-Driven Emergency Service Water Pumps 1-SW-P-1A/B/C (Section 1R18)

05000280, 281/2009004-04 NCV Inadequate Work Instructions lead to packing failure of ESW Pump 1-SW-P-1B (Section1R19)

05000280/2009004-05 NCV Failure to promptly identify and correct a ground on safety bus 1H (Section 4OA2)

05000280, 281/2009004-06 NCV Ineffective action for ELU performance deficiencies (Section 4OA2)

05000280/2009004-07 NCV Failure to remove blocking devices from piping supports (Section 4OA2)

Closed

05000280, 281/2009-001-00 LER Inoperable Emergency Service Water Pump Caused by Inadequate Design Change (Section 4OA3)