IR 05000305/2005010

IR 05000305-05-010(DRP), on 04/15/2005 - 07/29/2005, Dominion Energy Kewaunee, Inc., Permanent Plant Modifications

ML052290348
Person / Time
Site:	Kewaunee
Issue date:	08/16/2005
From:	Satorius M Division Reactor Projects III
To:	Christian D Dominion Energy Kewaunee
References
EA-05-157 IR-05-010
Download: ML052290348 (26)

Text

ust 16, 2005

SUBJECT:

KEWAUNEE POWER STATION NRC INSPECTION REPORT NO. 05000305/2005010(DRP)

PRELIMINARY WHITE FINDING

Dear Mr. Christian:

On July 29, 2005, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Kewaunee Power Station. The results of this inspection were discussed on July 29, 2005, with Mr. Kyle Hoops and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with Commission rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents one NRC-identified finding of very low safety significance (Green). This NRC-identified finding was determined to involve a violation of NRC requirements. However, because of the very low safety significance and because the violation was entered in your corrective program, the NRC is treating this issue as a Non-Cited Violation, in accordance with Section VI.A.1 of the NRC Enforcement Policy.

This report also documents one finding concerning the design of the auxiliary feedwater (AFW) system that appears to have low to moderate safety significance. As described in Section 1R17.1 of this report, this finding involves the design of the AFW system pump discharge pressure trip switches that would not have protected the pumps from air ingestion during natural events such as tornado and seismic events as originally designed. In addition, the AFW pumps were not protected from potential runout conditions that may be encountered in other design and license basis scenarios. This finding did present an immediate safety concern in that the inadequate design of the AFW system pump discharge pressure trip switches could have resulted in pump failure during certain accident scenarios. This safety concern was resolved by the completion of extensive modifications to the AFW system. This finding was assessed based on the best available information, including influential assumptions, using the Reactor Safety Significance Determination Process (SDP) and was preliminarily determined to be a White Finding. This finding appears to have low to moderate safety significance because the likelihood of core damage increased due to a potential loss of decay heat removal using the AFW system pumps during design and license basis events.

The finding is also an apparent violation of NRC requirements and is being considered for escalated enforcement action in accordance with the NRC Enforcement Policy. The current Enforcement Policy is on the NRC website at http://www.nrc.gov/what-we-do/regulatory/enforcement/enforce-pol.html.

We believe that we have sufficient information to make our final risk determination for the performance deficiency regarding the design of the AFW system. However, before the NRC makes a final decision on this matter, we are providing you an opportunity to either submit a written response or to request a Regulatory Conference where you would be able to provide your perspectives on the significance of the finding and the basis for your position. If you choose to request a Regulatory Conference, we encourage you to submit your evaluation and any differences with the NRC evaluation on the docket at least 1 week prior to the conference in an effort to make the conference more efficient and effective. If a Regulatory Conference is held, it will be open for public observation. The NRC will also issue a press release to announce the Regulatory Conference.

Please contact Mr. Thomas Kozak at (630) 829-9866 within 10 business days of the date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision and you will be advised by separate correspondence of the results of our deliberations on this matter.

Since the NRC has not made a final determination in this matter, no Notice of Violation is being issued for the inspection finding at this time. In addition, please be advised that the characterization of the apparent violation described in this letter may change as a result of further NRC review.

If you contest the subject or severity of the Non-Cited Violation referred to earlier in this letter, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region III, 2443 Warrenville Road, Suite 210, Lisle, IL 60532-4352; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector Office at the Kewaunee facility. In accordance with 10 CFR 2.390 of NRC "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRC document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Mark A. Satorius, Director Division of Reactor Projects Docket No. 50-305 License No. DPR-43

Enclosure:

Inspection Report 05000305/2005010(DRP)

w/Attachment: Supplemental Information

REGION III==

Docket No.: 50-305 License No.: DPR-43 Report No.: 05000305/2005010(DRP)

Licensee: Dominion Energy Kewaunee Inc.

Facility: Kewaunee Power Station Location: N490 Highway 42 Kewaunee, WI 54216 Dates: April 15 through July 29, 2005 Inspectors: J. Lara, Chief, Electrical Engineering Branch L. Kozak, Senior Reactor Analyst S. Burton Senior Resident Inspector P. Higgins, Resident Inspector J. Giessner, Reactor Engineer, Region III C. Baron, Mechanical Engineering Consultant Observers: None Approved By: Mark A. Satorius, Director Division of Reactor Projects Enclosure

SUMMARY OF FINDINGS

IR 05000305/2005010(DRP); 04/15/2005 - 07/29/2005; Kewaunee Power Station; Permanent

Plant Modifications.

The inspection was a baseline inspection to address an auxiliary feedwater (AFW) pump performance deficiency. In addition, part of the biennial review of permanent plant modifications and 10 CFR 50.59 evaluations was inspected. The inspection was conducted by regional inspectors with mechanical engineer consultant assistance. One finding, assessed as Preliminary White, and one Green finding were identified. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609 significance determination process (SDP). Findings for which the SDP does not apply may be Green, or be assigned a severity level after Nuclear Regulatory Commission (NRC) management review. The NRC program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.

Inspection Findings

Cornerstone: Mitigating Systems

• To Be Determined. The inspectors identified a finding that was preliminarily determined to be of low to moderate safety significance, because Kewaunee failed to provide adequate design control to ensure the AFW pumps would be protected from failure due to air ingestion during tornado or seismic events; as well as from failure during potential runout conditions. The finding is also an apparent violation of 10 CFR Part 50,

Appendix B, Criterion III, "Design Control," for not effectively providing controls to check the adequacy of the design for protecting the AFW pumps during design and license basis events.

The finding was determined to be more than minor since it impacted Mitigating System cornerstone attributes of design control (initial design and plant modifications) and the cornerstone objective to ensure availability, reliability, and capability of the AFW system to respond to events to prevent core damage. A Significance Determination Process Phase 3 risk analysis determined that this finding was preliminarily of low to moderate safety significance. The licensee has taken significant corrective actions, including extensive modifications to the system. (Section 1R17)

Green.

The inspectors identified a finding involving a Green Non-Cited Violation (NCV)of 10 CFR 50, Appendix B, Criterion III, Design Control. The finding involved the revision of AFW pump discharge pressure trip setpoints. The licensee had not determined if the turbine driven AFW (TDAFW) pump was capable of providing the required flow under reduced steam pressure conditions prior to approving the modification. This issue could have affected the performance of the AFW system under post accident conditions.

This issue was greater than minor because it potentially affected the Mitigating System cornerstone objective of equipment capability. The issue screened as very low safety significance in Phase 1 of the SDP, because it was a design deficiency that was not found to result in a loss of function and the item was resolved prior to being in the plant conditions where the finding could have impacted the pumps performance. The licensee conducted post modification tests and revised permanent plant procedures to ensure the TDAFW pump was capable of providing the required flow under reduced steam pressure conditions. (Section 1R17)

REPORT DETAILS

1R02 Evaluations of Changes, Tests, or Experiments

Review of Evaluations and Screenings for Changes, Tests, or Experiments

a. Inspection Scope

The inspectors reviewed one 10 CFR 50.59 safety evaluation and five screenings for changes, tests, and experiments. These documents were reviewed to ensure consistency with the requirements of 10 CFR 50.59. The inspectors used Nuclear Energy Institute (NEI) 96-07, Guidelines of 50.59 Evaluations, Revision 1, to determine acceptability of the completed evaluations and screenings. The NEI document was endorsed by the NRC in Regulatory Guide 1.187, "Guidance for Implementation of 10 CFR 50.59, Changes, Tests, and Experiments," November 2000. The inspectors also consulted IMC, Part 9900, "10 CFR GUIDANCE: 50.59." Documents reviewed during the inspection are listed in the attachment to this report.

This review constituted six inspection samples.

b. Findings

No findings of significance were identified.

1R17 Permanent Plant Modifications

a. Inspection Scope

The inspectors reviewed the existing design of the AFW pumps. This review included the related Updated Safety Analysis Report (USAR) sections and Technical Specifications (TS), the system flow diagram, various flow analyses, summaries of inservice testing results, and various Corrective Action Program (CAP) documents related to the pumps. The inspectors reviewed the hydraulic model of the AFW system, as well as various other system analyses, including the net positive suction head (NPSH) analysis, pump runout analysis, and the analysis to establish the inservice testing acceptance criteria for the pumps. The inspectors reviewed the condensate storage tank (CST) level setpoints, as well as the capability of the pumps to be transferred from the CST to the safety related source (service water (SW) system). The inspectors also reviewed the results of inservice testing from 1991 through 2004. In addition, the inspectors reviewed the calculations and evaluations performed to assess the impact (probabilistic risk assessment (PRA)) and past operability related to the performance deficiency surrounding potential runout conditions and air ingestion of the AFW pumps. This review included seismic structural calculations, tornado missile and wind analysis, high energy line break (HELB), main steam line break (MSLB), and station blackout (SBO) risk assessments.

The inspectors performed three permanent plant modification inspections by reviewing Design Change Request (DCR) 3576, AFW Pump Protection Upgrades, Revisions 1 and 3; DCR 3588, Modify TDAFW Pump Steam Supply Pipe Supports due to Submergence Concerns, Revision 0; and DCR 3582, EDG Exhaust Duct Support Modifications for 360 MPH Tornado Wind Loading, Revision 0. The inspection included review of the design, discussion with plant staff, and walkdowns of the installed modifications.

Modification DCR 3576 included three major changes to the AFW system design. First, a portion of the common AFW pump suction piping was re-routed from the turbine building through the auxiliary building to protect it from hazards. The volume of this piping was also increased to ensure pump protection if the non-safety related portion of the piping were lost. Second, a suction pressure trip feature was added to the three AFW pumps. The new pressure switches were located in the auxiliary building. Third, the existing AFW pump discharge pressure switches were replaced and the trip setpoint was revised to protect the pumps from runout conditions.

This review constituted three inspection samples.

.1 Potential Failure of Auxiliary Feedwater Pumps Due to Air Ingestion or Runout

Introduction:

The inspectors identified a preliminary White finding associated with the design and function of the AFW pump discharge pressure switches. The inspectors identified the potential for air intrusion into operating AFW pumps, resulting in a common mode failure of the AFW pumps. Follow-up inspection, as part of extent of condition evaluations, identified potential runout of the AFW pumps during certain scenarios.

Description:

As discussed in USAR Section 6.6.3, the AFW system was modified in response to NRC NUREG-0737. One modification was the addition of an automatic trip of the AFW pumps upon low pump discharge pressure (separate pressure switch and trip for each AFW pump).

As documented in NRC correspondence dated September 21, 1979, NUREG-0737, Recommendation GL-4 stated, in part, Licensees having plants with unprotected normal AFW system water supplies should evaluate the design of their AFW systems to determine if automatic protection of the pumps is necessary following a seismic event or tornado. Consideration should be given to providing pump protection by means such as automatic switchover of the pump suctions to the alternate safety-grade source of water, automatic pump trips on low suction pressure or upgrading the normal source of water to meet seismic Category I and tornado protection requirements. In a letter dated May 7, 1993, the licensee stated that the recommended low pump suction pressure trip setpoint would need to be at sub-atmospheric pressure, and therefore, stated that a pump low discharge pressure trip would be installed instead, to provide the desired NPSH protection. The NRC stated that this design was acceptable in a letter dated June 8, 1993. This design change was installed in 1994 via DCR 2668, Revision 1.

Technical Specification Section 3.4.b was also amended to require operability of the low discharge pressure trip channels.

Another part of the AFW performance issue was associated with AFW pump operability after a MSLB event. NRC Bulletin 80-04 dated February 8, 1980, discussed issues of AFW performance during a MSLB. Item 1 identified the need to assure continued AFW operability after extended operation at runout flow. In response, the licensee noted that two and three pump operation system resistance exceeded the minimum back pressure required to assure pump operability. The licensee determined that in worst case conditions, assuming runout of one AFW pump, the plant could be brought to cold shutdown using the TDAFW pump, which was assumed to be undamaged, after feed was isolated to the faulted steam generator (SG). Based on the information provided by the licensee regarding system resistence, the NRC accepted this evaluation as documented in a letter dated June 8, 1983.

During a 1997 safety system operational performance inspection, the NRC raised the issue that the low discharge pressure trips on the AFW pumps could represent a potential unreviewed safety question (USQ) in that it represented the potential to increase the probability of a malfunction of equipment important to safety. The licensee responded in an Licensee Event Report (LER) 97-001-00 on March 3, 1997, that there was not an USQ, that the switches enhance protection, and although not explicitly designed to protect the pumps against cavitation from other causes [external events],

the system was designed to maximize protection while maintaining pump reliability.

The licensee indicated that pump runout protection was not credited in the USAR and the discharge pressure switches only improved reliability. Operator action was credited to isolate a faulted SG and establish flow to the unfaulted SG and therefore no USQ existed. The licensee concluded by indicating they would review 10 CFR 50.59 for the pressure switch modification as well as review NPSH requirements for the AFW pumps and determine if the pumps were susceptible to air entrainment from vortexing.

While reviewing the design of the AFW system, the licensee discovered the system resistance curves used to respond to NRC Bulletin 80-04 overestimated the system resistance. This was reported to the NRC in compliance with 10 CFR 50.72 (b)(2)(I) on April 16, 1997, and via LER 97-005-00 to comply with 10 CFR 50.9 as new information which could have significant implications on previous correspondence. The reports indicated that based on the pump curves, potential runout conditions could occur because the pump curve would not cross the system curve. In response to the issue, the licensee performed testing of the AFW pumps to determine if there would be any indications of cavitation using various pump combinations. The testing showed that as long as there was adequate NPSH, the pumps would not reach runout conditions. If NPSH was inadequate, the low discharge pressure switch may trip the pumps. This was consistent with the licensee position to maximize protection against cavitation from any cause, while minimizing inadvertent trips. In the conclusion of LER 97-005-00 for the 1997 issue, the licensee determined that the tripping of pumps on low discharge pressure ensures their operability for recovery from a MSLB event.

On January 27, 2005, during a high risk, low margin pilot NRC inspection, the inspectors questioned the licensee regarding the potential for air ingestion and pump damage and whether these failure mechanisms had been evaluated for the pump discharge pressure trip design. The inspectors were concerned that, in the event of a failure of the CSTs or suction piping due to a seismic event or tornado, the discharge pressure switches would not detect air ingestion until pump performance was significantly degraded. The inspectors were also concerned that the AFW pumps could be damaged due to potential runout conditions during certain scenarios.

The licensee stated that the pumps were protected from runout conditions. However, on February 4, 2005, the licensee initiated CAP 25341 which stated that the pump discharge pressure trip design was not in compliance with the plant licensing basis because it could not be shown that the AFW pumps would be protected if the CSTs or suction piping failed. However, the CAP also stated that the AFW system was operable.

On February 7, 2005, Operability Recommendation (OPR) 87, Revision 0, was approved. The OPR concluded that the AFW system was capable of performing its safety function after a seismic event or tornado, and the AFW system was considered operable but degraded. This conclusion was primarily based on a determination that the AFW pump suction piping was not expected to fail due to a seismic event or tornado.

Additionally, credible failures of the CSTs would be mitigated through reliance on the capabilities of the control room operators, using normal procedures and training, to prevent damage to the AFW pumps. The OPR stated that no compensatory measures were required to maintain operability. The inspectors questioned the licensee operability determination and reliance on existing operations procedures. The licensees position relied on existing SW system and abnormal operations procedures to mitigate the potential failure of the CSTs due to a seismic or tornado event. The inspectors considered such reliance to be inappropriate since the existing procedures were developed to address normal depletion of the CSTs during non-seismic or tornado events. Additionally, the licensees position relied on operators recognizing low CST level alarms following a seismic event or tornado, and likely plant trip, and taking actions to switchover the supply to the AFW pumps from the CST to the SW system. The inspectors expressed concern that operators would be in emergency operating procedures, may not have sufficient time to accomplish the tasks before the pumps were damaged, and may not recognize the CST low level alarm due to other annunciators and alarms. Lastly, the inspectors expressed concern that the licensee was relying upon the operator actions but had not performed any time validation in the plant simulator to provide a confidence level as to the adequacy of the existing procedures.

On February 8, 2005, OPR-87, Revision 1, was approved. Revision 1 continued to state that no compensatory measures were required to maintain AFW system operability.

However, it did include additional measures to provide a dedicated control room operator and procedure changes to transfer the AFW pumps to the SW system sooner in the event of an earthquake or tornado strike.

On February 9, 2005, OPR-87, Revision 2, was approved. Revision 2 included a qualitative discussion to support an additional conclusion that, if the pump suction was lost, there was reasonable assurance that the AFW pumps would not be damaged before the discharge pressure trips actuated and stopped the pumps.

On February 11, 2005, the licensee declared all three AFW pump discharge pressure trip switches inoperable based on a vendor analysis that predicted substantial damage to the CSTs from a tornado, and also that the AFW pumps could be damaged by air ingestion prior to actuation of the pump low pressure discharge pressure trip. NRC notification was provided in accordance with 10 CFR 50.72 (Event 41406). On February 12, 2005, the licensee implemented proceduralized compensatory actions to realign the AFW pump suctions to the SW system at the earliest indication of a tornado threat. Based on these actions, OPR-87, Revision 3, was approved and the AFW pump low discharge pressure trip switches were declared operable but non-conforming.

Subsequent detailed analysis of the auxiliary feedwater pumps indicated that pump failure would occur between five and ten seconds after air ingestion.

The inspectors continued to question the technical bases for the conclusions included in OPR-87, Revision 3. These questions included the capability of the CSTs and the pump suction piping to survive a seismic event, and the capability of the piping in the turbine building basement to survive a tornado. The day following the completion of this inspection, the licensee determined that the AFW pump suction piping was susceptible to damage from a HELB in the turbine building. As a result, on February 19, 2005, the licensee declared all three AFW trains inoperable and began a reduction in power and plant shutdown in accordance with the facility TS Section 3.4.b. NRC notification was provided in accordance with 10 CFR 50.72 (Event No. 41423). The licensee entered the issue into the corrective action program as CAP 25341. The licensee entered a forced outage to address these and other issues.

On March 15, 2005, during review of the design change for the AFW pump switches, the licensee determined that runout conditions could exist on the TDAFW pump which would damage the pump during a design MSLB event. As mentioned earlier in this report, the licensee had previously concluded that the TDAFW pump would not be in a runout condition during a MSLB event. The previous analysis was based on inadequate AFW system test data that did not bound design conditions in the CST (level and temperature), and an inaccurate AFW system flow model. The current evaluation concluded that the TDAFW pump likely would have been in a runout condition where one motor driven AFW (MDAFW) pump was not available due to it feeding a faulted steam generator, with the other MDAFW pump lost as a single failure. This was also reported in accordance with 10 CFR 50.73.

On March 26, 2005, CAP 26497 was written to identify the potential for damage to the AFW pumps by means of air ingestion through the pump packing. The licensee submitted an LER to address the potential to damage the AFW pumps during certain scenarios (depending on pump combination and CST level) when sub-atmospheric conditions existed at the pumps suction. Under these conditions, air could be drawn through the pump packing glands, resulting in air ingestion and sudden pump failure.

The discharge pressure trips, similar to the external event conditions where air is entrained, would not have protected the pumps.

During discussion with the NRC in May of 2005, the licensee indicated that there was a TDAFW pump runout potential during plant depressurization (dictated by Emergency Operating Procedures (EOPs)) used pursuant to a SBO event. This cooldown scenario is part of the plant base PRA model.

To address HELB concerns for which the licensee initially declared the AFW system inoperable, the licensee performed an evaluation using break exclusion methodology in Generic Letter (GL) 87-11, Relaxation in Arbitrary Intermediate Pipe Rupture Requirements. Using this methodology, the licensee would not need to assume that an intermediate break occurs. Thus, the AFW pumps could be considered operable but non-conforming under the license basis. Based on that information, this aspect would screen out in the Phase 1 SDP because the item would not result in a loss of function in accordance with the guidance of GL 91-18, Revision 1, Information to Licensees Regarding NRC Inspection Manual Section on Resolution of Degraded and Nonconforming Conditions. Therefore, this failure mechanism was not considered part of the performance deficiency or risk analysis.

The licensee implemented two design changes to address these issues; one to revise the discharge switch setpoint to afford pump protection, and another to install suction switches and modify plant piping. These design changes are discussed and reviewed in Section 1R17.2.

Analysis:

The inspectors determined that the inadequate design and design control for the AFW pump discharge pressure switches was a licensee performance deficiency warranting a significance evaluation. The discharge pressure switch design would not ensure that the AFW pumps could perform all safety related functions or protect the plant adequately for events that are part of the license basis. Specifically, the pump discharge switches would not have been effective in automatically stopping an AFW pump prior to pump failure due to air ingestion during seismic or tornado events. In addition, the pump discharge switches would not have been effective in protecting the TDAFW pump from unacceptable cavitation conditions which occur during high flow during a MSLB event or plant cooldown in response to a SBO event.

The finding was determined to be more than minor since it impacted Mitigating System cornerstone attributes of design control (initial design and plant modifications) and it impacted the cornerstone objective to ensure availability, reliability, and capability of systems to respond to events to prevent core damage. A single AFW equipment train, and in some cases all AFW trains, would be affected. The inspectors completed a significance determination of this finding using NRC IMC 0609, Appendix A, Significance Determination of Reactor Inspection Findings for At-Power Situations.

The inspectors determined that the Mitigating Systems evaluation in the Phase 1 Screening Worksheet had three areas where Phase 2 and/or Phase 3 would be required. First, the impact on the TDAFW pump performance after a MSLB event, using Phase 1 screening, represents a loss of function for greater than the TS period which requires a Phase 2 screening. Second, the potential loss of the TDAFW pump during a SBO event would be a loss of safety function or function required as risk significant per 10 CFR 50.65 per Phase 1. Thus, that impact would screen to Phase 2. Third, the Phase 1 screening for seismic, flooding, and severe weather determined a loss or degradation of the AFW system (multiple trains) did occur since the AFW system is used to mitigate seismic, and severe weather events. In addition, the potential for a common mode failure of all AFW pumps would involve the loss of the safety function to remove decay heat and thus require a Phase 3 assessment. Based on these three areas and the complexity of the issue, a Phase 3 SDP was used to evaluate the significance of the finding. The following assessment evaluates the different areas of the performance deficiency and its impact on the Core Damage Frequency (CDF).

The central portion of the performance deficiency is based on the inadequate design of the discharge pressure trips to provide protective features to prevent air ingestion and pump runout. As such, the combined impact of all the specific scenarios would be appropriate in evaluating the change in CDF. For each of the scenarios considered, the dominant sequences involved the initiating event, the failure of the AFW system, and the failure of high pressure injection or high pressure recirculation.

Seismic The licensee performed a risk evaluation of the change in CDF due to the performance deficiency for seismic scenarios. Seismic fragility analyses were performed for the CSTs and attached piping. The licensee assumed that failure of the CSTs or any attached piping greater than 3" would result in failure of all three AFW pumps due to air ingestion. For failure of attached piping less than 3", the licensee determined that time was available for operators to take action to swap the suction of the AFW pumps from the CST to the SW system. The inspectors and an NRC Region III Senior Reactor Analyst (SRA) reviewed this evaluation and determined that it was reasonable but contained two potentially influential assumptions that, if evaluated, could increase the estimated risk. The first assumption was that operators would have adequate time to swap the suction of the AFW system from the CST to the safety-related SW system in situations where the seismic event resulted in only a leak in the CST and not catastrophic failure. However, the inspectors determined that prior to 2004, the CST level setpoint for swapover specified in the procedures was too low and had operators waited to begin actions until that setpoint, air ingestion may have occurred.

The second potentially influential assumption was that the high pressure recirculation function was not impacted by the postulated seismic event. The residual heat removal (RHR) pumps are required for this function but can potentially be impacted by seismically-induced flooding due to non-safety related water sources in the area. The licensee estimated the change in CDF due to seismic events to be 5.4E-7. The SRA determined that the estimate was generally reasonable, but would be higher if the two assumptions above were evaluated further.

Tornado The licensee performed a plant specific analysis to determine the risk associated with the performance deficiency considering a tornado initiating event and estimated the change in CDF due to tornado events to be 4.0E-8. The inspectors and the SRA reviewed the this analysis and determined that it was reasonable and that the contribution to the overall increase in risk from postulated tornado events was small.

MSLB The licensee performed a plant specific analysis to determine the risk associated with the performance deficiency considering a MSLB initiating event. The inspectors reviewed this analysis. The licensee initially calculated a change in CDF of 7.4E-8 due to MSLB events. This estimate included only failure of the TDAFW pump due to postulated runout conditions and did not consider an increased failure probability for the MDAFW pumps. Because the MDAFW pumps would experience cavitation during a MSLB, the inspectors determined that the risk evaluation should include an increase in failure probability for the pump. The best estimate failure probability was determined to be 2.0E-1. The licensee re-analyzed the MSLB scenario using this probability estimate but also reduced the initiating event frequency. The initiating event frequency was reduced because the licensee determined that only certain break locations and break sizes could result in the failure of the pumps. In concept, the NRC determined that an analysis of this type could be appropriate; however, the methods used to evaluate only certain break scenarios (i.e., applying a factor) were not appropriately justified.

Therefore the NRC determined that the best estimate of the change in CDF for the MSLB scenario was 7.2E-7 based on the licensee risk evaluation using a 2.0E-1 failure probability for the MDAFW pumps and removing the change to the initiating event frequency.

SBO The SRA performed an evaluation of the change in CDF for SBO scenarios using the NRC Standardized Plant Analysis Risk model for Kewaunee. The TDAFW pump was assigned an increased failure probability due to the potential for pump runout and failure during the rapid SG depressurization required by procedure during SBO events. Two analyses were performed, one considering a pump failure probability of 1.0E-1 and the second considering a pump failure probability of 2.0E-1. The change in CDF given these assumptions was estimated at 2.8E-6 to 5.8E-6.

Phase 3 SDP Conclusion The NRC determined that the overall risk significance of the finding was best characterized as low to moderate safety significance (White) based on a combination of the analyses performed by the licensee to assess seismic, tornado, and MSLB scenarios and the SBO analysis performed by the NRC. The change in CDF calculated ranged from approximately 4E-6 to 7E-6. Although the NRC determined that several assumptions made by the licensee in the seismic analysis were influential and could increase the risk if evaluated differently, it was unlikely that the risk would exceed the NRC threshold for a low to moderate safety significance finding. Therefore, the finding was preliminarily determined to be White.

Old Design Issue Considerations The performance deficiency was evaluated to determine if it met the criteria for an old design issue. The NRC IMC 0305, "Operating Reactor Assessment Program,"

Section 04.07, defines an "Old Design Issue" as a finding that involves a past design-related problem in an engineering analysis or installation of plant equipment (e.g., a modification), that does not reflect a performance deficiency associated with an existing program or procedure. Section 06.06(a), provides guidance for the treatment of Old Design Issues, and states that the NRC may refrain from considering safety significant findings if the issue satisfies, in part, the following criteria: the issue was licensee identified and was not likely to have been previously identified by on-going licensee efforts. The inspectors determined that a performance deficiency exists; the issue associated with potential air ingestion was NRC-identified; and the issue associated with potential runout protection resulted from inspector questions surrounding the discharge switches that should have been identified in previous pump performance evaluations in 1997. Therefore, because this design-related finding did not satisfy IMC 0305 criteria, it is not considered to be an Old Design Issue and is being treated similar to any other inspection finding, in accordance with IMC 0305, Section 06.06(a). This guidance is consistent with Section VII.B.3 of the NRC Enforcement Policy.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, and by the use of alternate or simplified calculational methods. Contrary to the above, the licensee did not implement adequate design measures to ensure the AFW pump discharge switches could perform their specified functions to support the license basis. The specific license basis events for the AFW pumps are seismic, tornado, and MSLB events. Pending final determination of the safety significance, this finding is considered an apparent violation of NRC requirements (AV 05000305/2005010-01). Corrective actions to address this issue included extensive plant modifications that were completed during this time period and are evaluated below.

.2 Modification for AFW Pump Protection

Introduction:

The inspectors identified a finding involving a Green NCV of 10 CFR 50, Appendix B, Criterion III, Design Control. The finding involved the revision of AFW pump discharge pressure trip setpoints. The licensee did not determine if the TDAFW pump was capable of providing the required flow under reduced steam pressure conditions prior to approving the modification. This issue could have affected the performance of the AFW system under post accident conditions.

Description:

Modification DCR 3576, AFW Pump Protection Upgrades, Revision 1, included changes to the AFW pump discharge pressure setpoints to protect the pumps from potential damage under runout conditions. These setpoint values were increased significantly to ensure that the pumps would automatically trip prior to reaching their NPSH limits. As a result of this change, additional operator actions could be required under post-accident conditions. Although the required operating procedure changes had not been completed at the time of the inspection, the design description indicated that the operators strategy for recovering a tripped pump would involve throttling the pump discharge valve to ensure the pump discharge pressure remains above the discharge pressure trip setpoint. The design description did not specifically address the capacity of the TDAFW pump under these conditions.

The inspectors questioned if the TDAFW pump would have sufficient performance capability to provide the required flow with reduced steam pressure and the pump discharge valve throttled. This was a concern because the postulated accident conditions that could result in AFW pump runout could also result in reduced steam pressure to the AFW pump drive. Throttling of the pump discharge valve would be expected to increase the pump power requirement for a given flow. In response to this issue, the licensee initiated CAP 27356, Review of Items for DCR 3576 and LAR-123, dated May 13, 2005. The CAP stated that the operators may have to bypass the discharge pressure trip under some conditions. The licensee conducted extensive post modification tests and determined that the bypass switch would need to be operated at low pressures. Licensee procedures were changed to address this issue.

Analysis:

The inspectors determined that this issue constituted a performance deficiency because the licensee failed to fully evaluate the impact of the modification of system performance. This issue was greater than minor because it potentially affected the Mitigating System cornerstone objective of equipment capability. The issue screened as very low safety significance in Phase 1 of the SDP, because it was a design deficiency that was not found to result in a loss of function.

Enforcement:

10 CFR Part 50 Appendix B, Criterion III, Design Control, requires, in part, that design control measures be established and implemented to assure that applicable regulatory requirements and the design basis for structures, systems, and components are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, the licensee did not ensure that the revised system design would perform as expected without additional operator actions. The potential operator actions to bypass the AFW pump discharge pressure trip had not been identified as requiring operating procedure changes. Because this violation is of very low safety significance and because the licensee entered the issue into their corrective action program (CAP 27356), this violation is being treated as an NCV consistent with Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000305/2005010-02, Failure to Evaluate the Effect of Modification on Turbine Driven AFW Pump Performance with Reduced Steam Pressure). The licensee took actions to revise plant procedures to address this issue.

4OA2 Problem Identification and Resolution (PI&R)

.1 Review of Condition Reports

a. Inspection Scope

The inspectors reviewed a sample of condition reports associated with modifications and 10 CFR 50.59 evaluations. The inspectors focused on use of manual operator actions in lieu of automatic equipment performance since the issue of manual actions had surfaced during the review of the current modification for the AFW discharge switches as well as during the high risk, low margin inspection as compensatory actions by the operator to maintain equipment operable.

b. Findings

One Unresolved Item (URI) was identified during this review. This issue is documented in IR 05000305/2005008 and is associated with the potential fouling of the SW pump bearing cooling filters.

4OA5 Other

The inspectors reviewed items discussed in previous inspection reports to determine if further regulatory action was required to be taken.

.1 (Closed) URI 05000305/2005002-05: "Potential Common Mode Failure of Auxiliary

Feedwater Pumps "

a. Inspection Scope

URI 05000305/2005002-05 is associated with the design of the AFW pumps discharge pressure switches. The inspectors identified the potential for air intrusion into operating AFW pumps, potentially resulting in a common mode failure of the AFW system. This could occur during certain events where the suction source is lost prior to being able to manually swap the source of water from the CST to the SW system.

b. Findings

This issue was resolved in Section 1R17.1 and is a preliminary White finding. This URI is closed.

4OA6 Meetings, Including Exits

Exit Meeting The inspectors presented the inspection results to Mr. Kyle Hoops and other members of licensee management on July 29, 2005. The licensee acknowledged the findings presented.

The inspectors asked the licensee whether any materials examined during the inspection should be considered as proprietary. Proprietary information was reviewed during the inspection, as documented in the list of documents. The inspectors confirmed that the proprietary material had been returned and discussed the likely content of the inspection report. The licensee did not indicate any potential conflicts with information presented.

4OA7 Licensee-Identified Violations

None

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

M. Gaffney, Site Vice-President

L. Hartz, Recovery Director

K. Davison, Plant Manager

L. Armstrong, Engineering Director

P. Phelps, Design Engineering Manager

J. Ruttar, Operations Manager

J. Stafford, Assistant Operations Manager

W. Hunt, Maintenance Manager

L. Debois, Design Engineer

J. Holly, Safety Analysis Engineer

A. Perez, Supervisor, Design Mechanical Engineering

E. Coen, Primary Risk Analyst

B. Koehler, AFW Project Engineer

Nuclear Regulatory Commission

T. Kozak, Reactor Projects Branch, TSS

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000305/2005010-01 AV Potential Failure of Auxiliary Feedwater Pumps Due to Air Ingestion or During Runout Conditions

Opened and Closed

05000305/2005010-02 NCV Failure to Evaluate the Effect of Modification on Turbine Driven AFW Pump Performance with Reduced Steam Pressure

Closed

05000305/2005002-05 URI Potential Common Mode Failure of AFW pumps

Discussed

None Attachment